Adversarial training is the industry standard for producing models that are
robust to small adversarial perturbations. However, machine learning
practitioners need models that are robust to other kinds of changes that occur
naturally, such as changes in the style or illumination of input images. Such
changes in input distribution have been effectively modeled as shifts in the
mean and variance of deep image features. We adapt adversarial training by
directly perturbing feature statistics, rather than image pixels, to produce
models that are robust to various unseen distributional shifts. We explore the
relationship between these perturbations and distributional shifts by
visualizing adversarial features. Our proposed method, Adversarial Batch
Normalization (AdvBN), is a single network layer that generates worst-case
feature perturbations during training. By fine-tuning neural networks on
adversarial feature distributions, we observe improved robustness of networks
to various unseen distributional shifts, including style variations and image
corruptions. In addition, we show that our proposed adversarial feature
perturbation can be complementary to existing image space data augmentation
methods, leading to improved performance. The source code and pre-trained
models are released at https://github.com/azshue/AdvBN.

通过对特征统计数据直接进行扰动，我们提出了 Adversarial Batch Normalization (AdvBN) 方法，它是一种单一的网络层，可以在训练期间生成最差情况下的特征扰动。通过在扰动的特征分布上对神经网络进行微调，我们观察到网络对各种不可见的分布偏移，包括样式变化和图像损坏，具有更好的鲁棒性。此外，我们证明我们提出的对抗性特征扰动可以与现有的图像空间数据增强方法互补，从而实现改进性能。