There is a growing concern about applying batch normalization (BN) in
adversarial training (AT), especially when the model is trained on both
adversarial samples and clean samples (termed Hybrid-AT). With the assumption
that adversarial and clean samples are from two different domains, a common
practice in prior works is to adopt Dual BN, where BN and BN are used for
adversarial and clean branches, respectively. A popular belief for motivating
Dual BN is that estimating normalization statistics of this mixture
distribution is challenging and thus disentangling it for normalization
achieves stronger robustness. In contrast to this belief, we reveal that
disentangling statistics plays a less role than disentangling affine parameters
in model training. This finding aligns with prior work (Rebuffi et al., 2023),
and we build upon their research for further investigations. We demonstrate
that the domain gap between adversarial and clean samples is not very large,
which is counter-intuitive considering the significant influence of adversarial
perturbation on the model accuracy. We further propose a two-task hypothesis
which serves as the empirical foundation and a unified framework for Hybrid-AT
improvement. We also investigate Dual BN in test-time and reveal that affine
parameters characterize the robustness during inference. Overall, our work
sheds new light on understanding the mechanism of Dual BN in Hybrid-AT and its
underlying justification.

在对抗训练中应用批归一化（BN）时存在越来越多的关注，尤其是当模型在对抗样本和干净样本上进行训练时（即混合式对抗训练）；本研究揭示了统计数据的分离对模型训练起到的作用较小，而分离仿射参数则起到了更大的作用；通过研究表明对抗样本与干净样本之间的领域差距较小，这与对抗扰动对模型准确性的显著影响不一致；我们进一步提出了一个双任务假设，作为混合式对抗训练改进的经验证据和统一框架；同时，我们还探讨了测试时的对偶 BN 并揭示仿射参数在推理过程中刻画了模型的鲁棒性，从而为我们理解混合式对抗训练中对偶 BN 的机制及其潜在的理论基础提供了新的视角。

探索混合对抗训练中的双重 BN 技术

Towards Understanding Dual BN In Hybrid Adversarial Training

In autonomous driving scenarios, current object detection models show strong
performance when tested in clear weather. However, their performance
deteriorates significantly when tested in degrading weather conditions. In
addition, even when adapted to perform robustly in a sequence of different
weather conditions, they are often unable to perform well in all of them and
suffer from catastrophic forgetting. To efficiently mitigate forgetting, we
propose Domain-Incremental Learning through Activation Matching (DILAM), which
employs unsupervised feature alignment to adapt only the affine parameters of a
clear weather pre-trained network to different weather conditions. We propose
to store these affine parameters as a memory bank for each weather condition
and plug-in their weather-specific parameters during driving (i.e. test time)
when the respective weather conditions are encountered. Our memory bank is
extremely lightweight, since affine parameters account for less than 2% of a
typical object detector. Furthermore, contrary to previous domain-incremental
learning approaches, we do not require the weather label when testing and
propose to automatically infer the weather condition by a majority voting
linear classifier.

提出了一种基于领域增量学习的解决方案 (Domain-Incremental Learning through Activation Matching, DILAM)，通过无监督特征对齐，将预训练模型适应于不同的天气条件，存储不同天气条件下的仿射参数，并在测试时利用轻量级的存储来自动推断天气状况，从而有效地解决了自动驾驶情景下目标检测模型在多变的天气条件下表现不佳以及遗忘的问题。