  Enhancing model prediction confidence on target data is an important
objective in Unsupervised Domain Adaptation (UDA). In this paper, we explore
adversarial training on penultimate activations, i.e., input features of the
final linear classification layer. We show that this strategy is more efficient
and better correlated with the objective of boosting prediction confidence than
adversarial training on input images or intermediate features, as used in
previous works. Furthermore, with activation normalization commonly used in
domain adaptation to reduce domain gap, we derive two variants and
systematically analyze the effects of normalization on our adversarial
training. This is illustrated both in theory and through empirical analysis on
real adaptation tasks. Extensive experiments are conducted on popular UDA
benchmarks under both standard setting and source-data free setting. The
results validate that our method achieves the best scores against previous
arts. Code is available at https://github.com/tsun/APA.
