ICML 2022 Art of Robustness Paper “On Fragile Features and Batch Normalization in Adversarial Training”

While batch normalization has long been argued to increase adversarial vulnerability, it is still used in state-of-the-art adversarial training models. This is likely because of easier training and increased expressiveness. At the same time, recent papers argue that adversarial examples are partly caused by fragile features caused by learning spurious correlations. In this paper, we study the impact of batch normalization on utilizing these fragile features for robustness by fine-tuning only the batch normalization layers.

This is work with Nils Walter.


Modern deep learning architecture utilize batch normalization (BN) to stabilize training and improve accuracy. It has been shown that the BN layers alone are surprisingly expressive. In the context of robustness against adversarial examples, however, BN is argued to increase vulnerability. That is, BN helps to learn fragile features. Nevertheless, BN is still used in adversarial training, which is the de-facto standard to learn robust features. In order to shed light on the role of BN in adversarial training, we investigate to what extent the expressiveness of BN can be used to robustify fragile features in comparison to random features. On CIFAR10, we find that adversarially fine-tuning just the BN layers can result in non-trivial adversarial robustness. Adversarially training only the BN layers from scratch, in contrast, is not able to convey meaningful adversarial robustness. Our results indicate that fragile features can be used to learn models with moderate adversarial robustness, while random features cannot.

Paper on ArXiv

    author = {Walter, Nils Philipp and Stutz, David and Schiele, Bernt},
    title = {On Fragile Features and Batch Normalization in Adversarial Training},
    journal   = {CoRR},
    volume    = {abs/2204.12393},
    year      = {2022}

What is your opinion on this article? Did you find it interesting or useful? Let me know your thoughts in the comments below: