Towards Understanding Dual BN In Hybrid Adversarial Training

arXiv:2403.19150v1 Announce Type: new
Abstract: There is a growing concern about applying batch normalization (BN) in adversarial training (AT), especially when the model is trained on both adversarial samples and clean samples (termed Hybrid-AT). With the assumption that adversarial and clean samples are from two different domains, a common practice in prior works is to adopt Dual BN, where BN and BN are used for adversarial and clean branches, respectively. A popular belief for motivating Dual BN is that estimating …

abstract adversarial adversarial training arxiv cs.ai cs.cr cs.cv cs.lg domains hybrid normalization practice prior samples training type understanding