Recent studies reveal that Convolutional Neural Networks (CNNs) are typically
vulnerable to adversarial attacks, which pose a threat to security-sensitive
applications. Many adversarial defense methods improve robustness at the cost
of accuracy, raising the contradiction between standard and adversarial
accuracies. In this paper, we observe an interesting phenomenon that feature
statistics change monotonically and smoothly w.r.t the rising of attacking
strength. Based on this observation, we propose the adaptive feature alignment
(AFA) to generate features of arbitrary attacking strengths. Our method is
trained to automatically align features of arbitrary attacking strength. This
is done by predicting a fusing weight in a dual-BN architecture. Unlike
previous works that need to either retrain the model or manually tune a
hyper-parameters for different attacking strengths, our method can deal with
arbitrary attacking strengths with a single model without introducing any
hyper-parameter. Importantly, our method improves the model robustness against
adversarial samples without incurring much loss in standard accuracy.
Experiments on CIFAR-10, SVHN, and tiny-ImageNet datasets demonstrate that our
method outperforms the state-of-the-art under a wide range of attacking
strengths.

本文提出了自适应特征对齐的方法，通过预测双 BN 结构中的融合权重，不引入任何超参数，且在不牺牲模型标准精度的情况下，有效地提高了模型的鲁棒性，并且在 CIFAR-10、SVHN 和 tiny-ImageNet 数据集上全面超越了现有的技术。