[Paper Review] Batch Normalization is a Cause of Adversarial Vulnerability

Angus Galloway, Anna Golubeva+3 more|arXiv (Cornell University)|May 6, 2019

Adversarial Robustness in Machine Learning33 references53 citations

TL;DR

This paper shows that batch normalization increases adversarial vulnerability and reduces robustness to noise, demonstrating that removing batch norm or adding L2 weight decay can improve robustness without sacrificing much clean accuracy.

ABSTRACT

Batch normalization (batch norm) is often used in an attempt to stabilize and accelerate training in deep neural networks. In many cases it indeed decreases the number of parameter updates required to achieve low training error. However, it also reduces robustness to small adversarial input perturbations and noise by double-digit percentages, as we show on five standard datasets. Furthermore, substituting weight decay for batch norm is sufficient to nullify the relationship between adversarial vulnerability and the input dimension. Our work is consistent with a mean-field analysis that found that batch norm causes exploding gradients.

Motivation & Objective

• Motivate robustness concerns in neural networks and investigate factors reducing robustness, with a focus on batch normalization (BN).
• Empirically assess how BN affects adversarial and noise robustness across standard datasets and models.
• Explore whether BN’s presence explains the observed relationship between input dimension and vulnerability.
• Examine whether alternative regularization (e.g., L2 weight decay) can restore robustness without sacrificing accuracy.

Proposed method

• Review and analyze batch normalization mechanics and its impact on pre-activations. (Eq. 1)
• Empirically compare BN and non-BN models on MNIST, SVHN, CIFAR-10, and ImageNet under PGD attacks (l_infty and l2) and Gaussian noise.
• Use CIFAR-10-C and ImageNet pre-trained models to evaluate robustness across corruption types.
• Investigate the role of batch size and network depth on BN robustness, including mutual information approximations I(X;T) and I(T;Y).
• Demonstrate that replacing BN with L2 weight decay recovers robustness against adversarial perturbations and noise.

Experimental results

Research questions

• RQ1 Does batch normalization inherently reduce robustness to adversarial perturbations and noise?
• RQ2 Can robustness be improved by using L2 weight decay instead of batch normalization without substantially hurting clean accuracy?
• RQ3 How do batch size, depth, and regularization interact with BN to influence adversarial vulnerability and representational information?
• RQ4 Is the observed vulnerability tied to input dimension, and can it be decoupled via regularization?
• RQ5 How do BN-affected models perform on common corruption benchmarks (CIFAR-10-C) and pretrained ImageNet models under adversarial perturbations?

Key findings

• BN increases clean accuracy on some datasets but reduces robustness to additive noise and PGD perturbations (e.g., CIFAR-10, SVHN, ImageNet).
• Replacing BN with weight decay can nullify the relationship between adversarial vulnerability and input dimension, improving robustness under adversarial and noisy conditions.
• For CIFAR-10 and CIFAR-10.1, BN leads to substantial drops in PGD robustness compared to unnormalized models, with varying effects across architectures.
• On CIFAR-10-C, BN generally raises the mean corruption error for noise-type corruptions across tested models.
• ImageNet results show BN improves some noise metrics but consistently reduces PGD robustness, with larger absolute degradation for adversarial perturbations.
• Mutual information analysis suggests BN compresses representations (lower I(X;T)) in ways that correlate with robustness changes, and depth amplifies BN-induced compression.
• Introducing L2 weight decay can recover robustness by compensating for the loss of vulnerability-to-input-dimension relationship caused by BN.