Research map / Adversarial robustness and security / Certified and empirical robustness
Removing Batch Normalization Boosts Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| remove all BN layers and train adversarially (NoFrost, NF-ResNet) | ResNet26 adversarial training · ImageNet eps=8 | clean accuracy: 70.13 vs 52.65 for SAT with BN | Helped |
| remove all BN layers and train adversarially (NoFrost, NF-ResNet) | ResNet50 adversarial training · ImageNet eps=8 | clean accuracy: 74.06 vs 59.28 for SAT with BN | Helped |
| remove all BN layers and train adversarially (NoFrost, NF-ResNet) | ResNet50 adversarial training · ImageNet eps=8 | PGD accuracy: 22.45 vs 13.57 for SAT | Helped |
| replace BN with instance normalization in SAT (ablation) | SAT ResNet26 · ImageNet eps=8 | clean and PGD accuracy: clean 52.65 to 56.78; PGD 10.55 to 11.06 | Helped |
| replace BN with instance normalization in SAT (vs NoFrost) (ablation) | SAT ResNet26 · ImageNet eps=8 | clean and PGD accuracy: NoFrost 13.35 higher clean and 1.18 higher PGD than SAT w/ IN | Hurt |
| standard training on normalizer-free network (no adversarial training) (ablation) | NF-ResNet50 · ImageNet eps=8 | PGD accuracy: 0.00 PGD, 0.00 APGD-CE | No clear effect |
| NoFrost vs MBNAT interpolation across gamma | MBNAT vs NoFrost ResNet26 · ImageNet eps=8 | clean accuracy vs APGD-CE trade-off: matching clean accuracy requires MBNAT gamma=0 with 0 APGD-CE robustness | Helped |
| NoFrost on ResNet50 vs TRADES-FAT clean accuracy | ResNet26 adversarial training · ImageNet eps=8 | clean accuracy: outperforms TRADES-FAT by 14.48% clean | Helped |
| combine NoFrost with DeepAugment and TDA (NoFrost*) (ablation) | ResNet50 comprehensive robustness · ImageNet-C / ImageNet-R / Sketch / PGD / Square | robustness: 3.06% worse than DeepAugment on ImageNet-C; 16.30% higher PGD than DeepAugment | Mixed |
| naively combine clean, adversarial, DeepAugment, TDA with BN network (Combine) (ablation) | ResNet26 comprehensive robustness · ImageNet-C / ImageNet-R / Sketch / PGD / Square | robustness: performs worst in most cases | Hurt |
| remove all BN layers in adversarial training (NoFrost) at small eps=2 and 4 | ResNet50 adversarial training · ImageNet eps=2,4 PGD-10 | clean and PGD-10 accuracy: eps=2: 69.87 clean, 48.60 PGD-10 vs FastAT 60.90/44.27 | Helped |
Closest papers by meaning
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.86)
- Enhancing the Adversarial Robustness via Manifold Projection (AAAI 2025 · similarity 0.86)
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.86)
- First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks (AAAI 2025 · similarity 0.86)
- On the Clean Generalization and Robust Overfitting in Adversarial Training from Two Theoretical Views: Representation Complexity and Training Dynamics (ICML 2025 · similarity 0.86)
- On the Duality Between Sharpness-Aware Minimization and Adversarial Training (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.