Prepare for the Worst: Generalizing across Domain Shifts with Adversarial Batch Normalization

Manli Shu, Zuxuan Wu, Micah Goldblum, Tom Goldstein

Keywords: adversarial training, distributional shifts

Abstract: Adversarial training is the industry standard for producing models that are robust to small adversarial perturbations. However, machine learning practitioners need models that are robust to other kinds of changes that occur naturally, such as changes in the style or illumination of input images. Such changes in input distribution have been effectively modeled as shifts in the mean and variance of deep image features. We adapt adversarial training by adversarially perturbing these feature statistics, rather than image pixels, to produce models that are robust to distributional shifts. We also visualize images from adversarially crafted distributions. Our method, Adversarial Batch Normalization (AdvBN), significantly improves the performance of ResNet-50 on ImageNet-C (+8.1%), Stylized-ImageNet (+6.7%), and ImageNet-Instagram (+3.9%) over standard training practices. In addition, we demonstrate that AdvBN can also improve generalization on semantic segmentation.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

One-sentence Summary: This work proposes a feature space adversarial training method based on Batchnorm statistics, to attain generalization to distributional shifted data.

Reviewed Version (pdf): https://openreview.net/references/pdf?id=HD0dWMzp2