mlsanityData to 7 Oct 2026

Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective

arXiv 2010.03316 ↗First posted 7 Oct 2020cs.LG cs.CV stat.MLcited by 35

Not on the map. Why?

Abstract (arXiv)

Batch normalization (BN) has been widely used in modern deep neural networks (DNNs) due to improved convergence. BN is observed to increase the model accuracy while at the cost of adversarial robustness. There is an increasing interest in the ML community to understand the impact of BN on DNNs, especially related to the model robustness. This work attempts to understand the impact of BN on DNNs from a non-robust feature perspective. Straightforwardly, the improved accuracy can be attributed to the better utilization of useful features. It remains unclear whether BN mainly favors learning robust features (RFs) or non-robust features (NRFs). Our work presents empirical evidence that supports that BN shifts a model towards being more dependent on NRFs. To facilitate the analysis of such a feature robustness shift, we propose a framework for disentangling robust usefulness into robustness and usefulness. Extensive analysis under the proposed framework yields valuable insight on the DNN behavior regarding robustness, e.g. DNNs first mainly learn RFs and then NRFs. The insight that RFs transfer better than NRFs, further inspires simple techniques to strengthen transfer-based black-box attacks.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Oct 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 7; 2023: 13; 2024: 7; 2025: 4; 2026: 2.

35 papers.

Sort:

By area:

  1. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  2. 2021Neural Mean Discrepancy for Efficient Out-of-Distribution Detectioncited by 42
  3. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  4. 2023Normalization Layers Are All That Sharpness-Aware Minimization Needscited by 27
  5. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  6. 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
  7. 2022Adversarially-Aware Robust Object Detectorcited by 20
  8. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 20
  9. 2023Feature Separation and Recalibration for Adversarial Robustnesscited by 16
  10. 2023Adversarial Examples Are Not Real Featurescited by 16
  11. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  12. 2023Reliable Evaluation of Adversarial Transferabilitycited by 12
23 more
  1. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  2. 2023Improving Adversarial Transferability via Model Alignmentcited by 10
  3. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  4. 2023Understanding the robustness difference between stochastic gradient descent and adaptive gradient methodscited by 8
  5. 2023Adversarially Robust Spiking Neural Networks Through Conversioncited by 7
  6. 2025Exploring Adversarial Transferability between Kolmogorov-arnold Networkscited by 4
  7. 2022Functional Network: A Novel Framework for Interpretability of Deep Neural Networkscited by 2
  8. 2022NoMorelization: Building Normalizer-Free Models from a Sample's Perspectivecited by 2
  9. 2023Going Further: Flatness at the Rescue of Early Stopping for Adversarial Example Transferabilitycited by 2
  10. 2024Theoretical Understanding of Learning from Adversarial Perturbationscited by 2
  11. 2025Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensemblescited by 2
  12. 2021Towards Bridging the gap between Empirical and Certified Robustness against Adversarial Examplescited by 1
  13. 2023Improved Robustness Against Adaptive Attacks With Ensembles and Error-Correcting Output Codescited by 1
  14. 2024RAMP: Boosting Adversarial Robustness Against Multiple lp Perturbations for Universal Robustnesscited by 1
  15. 2024Investigating and unmasking feature-level vulnerabilities of CNNs to adversarial perturbationscited by 1
  16. 2025DisCoPatch: Taming Adversarially-driven Batch Statistics for Improved Out-of-Distribution Detectioncited by 1
  17. 2026Batch Normalization Amplifies Memorization and Privacy Riskscited by 1
  18. 2022L2BN: Enhancing Batch Normalization by Equalizing the L2 Norms of Featurescited by 0
  19. 2023On the Computational Entanglement of Distant Features in Adversarial Machine Learningcited by 0
  20. 2024Revealing Vulnerabilities of Neural Networks in Parameter Learning and Defense Against Explanation-Aware Backdoorscited by 0
  21. 2024Towards Understanding Dual BN In Hybrid Adversarial Trainingcited by 0
  22. 2025AdverX-Ray: Ensuring X-Ray Integrity Through Frequency-Sensitive Adversarial VAEscited by 0
  23. 2026LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detectioncited by 0