Efficient Adversarial Defense without Adversarial Training: A Batch Normalization Approach

Adversarial training is one of the most effective methods for defending against adversarial attacks, but it is computationally costly. In this paper, we propose Saliency Adversarial Defense (SAD), an efficient defense algorithm that avoids adversarial training by minor modification of a deployed model. The saliency map is added to the input to enhance those pixels that are important for making decisions. This process causes a distribution shift to the original data. Interestingly, we find that this shift can be effectively fixed by only updating the statistics of batch normalization with the processed data without further training. We verify that SAD enlarges the average distance between processed data and the updated decision boundary, and significantly smooths the landscape. Hence the model can defend against stronger attacks and improve robustness. We show in experiments that the results hold for complex models and datasets. Our results demonstrate that SAD is superior in defending various attacks, including both white-box and black-box ones.