论文标题
批发归一化增加了对抗性脆弱性并降低了对抗性转移性：一种非稳定功能的透视图
Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective
论文作者
论文摘要
由于收敛的改善，批次归一化（BN）已被广泛用于现代深神网络（DNN）。观察到BN在以对抗性鲁棒性为代价的同时提高了模型的准确性。 ML社区对了解BN对DNN的影响越来越有兴趣，尤其是与模型鲁棒性有关的影响。这项工作试图从非稳定特征的角度了解BN对DNN的影响。直接地，提高的精度可以归因于更好地利用有用功能。目前尚不清楚BN是否主要利用学习鲁棒特征（RFS）或非舒适特征（NRFS）。我们的工作提供了经验证据，支持BN将模型转向更依赖NRF。为了促进对这种特征鲁棒性转移的分析，我们提出了一个将稳健有用性分解为鲁棒和实用性的框架。在拟议的框架下进行的广泛分析可产生有关DNN关于鲁棒性的行为的宝贵见解，例如DNNS首先主要学习RFS，然后学习NRF。 RFS转移比NRFS更好的见解进一步激发了简单的技术来增强基于转移的黑盒攻击。
Batch normalization (BN) has been widely used in modern deep neural networks (DNNs) due to improved convergence. BN is observed to increase the model accuracy while at the cost of adversarial robustness. There is an increasing interest in the ML community to understand the impact of BN on DNNs, especially related to the model robustness. This work attempts to understand the impact of BN on DNNs from a non-robust feature perspective. Straightforwardly, the improved accuracy can be attributed to the better utilization of useful features. It remains unclear whether BN mainly favors learning robust features (RFs) or non-robust features (NRFs). Our work presents empirical evidence that supports that BN shifts a model towards being more dependent on NRFs. To facilitate the analysis of such a feature robustness shift, we propose a framework for disentangling robust usefulness into robustness and usefulness. Extensive analysis under the proposed framework yields valuable insight on the DNN behavior regarding robustness, e.g. DNNs first mainly learn RFs and then NRFs. The insight that RFs transfer better than NRFs, further inspires simple techniques to strengthen transfer-based black-box attacks.
