alessandrodepalma/expressive-losses

Expressive Losses for Verified Robustness via Convex Combinations

expressive-losses's Issues

Random Batch Norm Statistics?

Dear authors,

Congratulations on the publication!

As noted in the appendix F.2 and the comment below

expressive-losses/train.py

Line 136 in 9965672

# NOTE: when training, the bounding computation will use the batchnorm stats from the current clean batch

batch norm statistics are supposed to be set based on clean inputs. However,

expressive-losses/train.py

Line 123 in 9965672

model_ori.train()

here it sets the batch norm layers to train mode, followed by an evaluation of the model on the adversarial inputs.

expressive-losses/train.py

Line 126 in 9965672

adv_output = model(adv_data)

This means the adversarial inputs will reset the batch norm statistics.

In addition, it switches the batch norm layers to eval

expressive-losses/train.py

Line 110 in 9965672

model.eval()

before running PGD attack on it. This will change the network: the clean input is evaluated with batch statistics, while the attack is based on accumulated statistics, i.e., running mean and running var.

In conclusion, it seems that the network used for clean input (batch stat) is different from the attacked network (running stat), and the network used for IBP (running stat + adv stat) is different from both. Could you provide some explanations for this?

Best