# Early Methods for Detecting Adversarial Images

arXiv: https://arxiv.org/abs/1608.00530 · HTML: https://mlsanity.com/paper/1608.00530/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Aug 2016.

## Built on by (most cited first, 30 of 36)

- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them](https://mlsanity.com/paper/2107.11630/) (2021)
- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain](https://mlsanity.com/paper/2103.03000/) (2021)
- [Taxonomy of Machine Learning Safety: A Survey and Primer](https://mlsanity.com/paper/2106.04823/) (2021)
- [Robust Models are less Over-Confident](https://mlsanity.com/paper/2210.05938/) (2022)
- [Adversarially Robust One-class Novelty Detection](https://mlsanity.com/paper/2108.11168/) (2021)
- ["That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks](https://mlsanity.com/paper/2204.04636/) (2022)
- [The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Training](https://mlsanity.com/paper/2211.00525/) (2022)
- [Exploiting Multi-Object Relationships for Detecting Adversarial Attacks in Complex Scenes](https://mlsanity.com/paper/2108.08421/) (2021)
- [textttBATCLIP: Bimodal Online Test-Time Adaptation for CLIP](https://mlsanity.com/paper/2412.02837/) (2024)
- [SoK: Machine Learning Governance](https://mlsanity.com/paper/2109.10870/) (2021)
- [Detecting AutoAttack Perturbations in the Frequency Domain](https://mlsanity.com/paper/2111.08785/) (2021)
- [Self-Supervised Adversarial Example Detection by Disentangled Representation](https://mlsanity.com/paper/2105.03689/) (2021)
- [Towards Adversarial Purification using Denoising AutoEncoders](https://mlsanity.com/paper/2208.13838/) (2022)
- [An Adaptive Black-box Defense against Trojan Attacks (TrojDef)](https://mlsanity.com/paper/2209.01721/) (2022)
- [Attribution of Gradient Based Adversarial Attacks for Reverse Engineering of Deceptions](https://mlsanity.com/paper/2103.11002/) (2021)
- [Long-term Cross Adversarial Training: A Robust Meta-learning Method for Few-shot Classification Tasks](https://mlsanity.com/paper/2106.12900/) (2021)
- [Resisting Adversarial Attacks in Deep Neural Networks using Diverse Decision Boundaries](https://mlsanity.com/paper/2208.08697/) (2022)
- [Beyond Labeling Oracles: What does it mean to steal ML models?](https://mlsanity.com/paper/2310.01959/) (2023)
- [ExAD: An Ensemble Approach for Explanation-based Adversarial Detection](https://mlsanity.com/paper/2103.11526/) (2021)
- [In-distribution adversarial attacks on object recognition models using gradient-free search](https://mlsanity.com/paper/2106.16198/) (2021)
- [Detect and Defense Against Adversarial Examples in Deep Learning using Natural Scene Statistics and Adaptive Denoising](https://mlsanity.com/paper/2107.05780/) (2021)
- [Unity is strength: Improving the Detection of Adversarial Examples with Ensemble Approaches](https://mlsanity.com/paper/2111.12631/) (2021)
- [Mixture GAN For Modulation Classification Resiliency Against Adversarial Attacks](https://mlsanity.com/paper/2205.15743/) (2022)
- [Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency](https://mlsanity.com/paper/2109.12459/) (2021)
- [Computational Asymmetries in Robust Classification](https://mlsanity.com/paper/2306.14326/) (2023)
- [Panda or not Panda? Understanding Adversarial Attacks with Interactive Visualization](https://mlsanity.com/paper/2311.13656/) (2023)
- [Using Anomaly Feature Vectors for Detecting, Classifying and Warning of Outlier Adversarial Examples](https://mlsanity.com/paper/2107.00561/) (2021)
- [Models of Computational Profiles to Study the Likelihood of DNN Metamorphic Test Cases](https://mlsanity.com/paper/2107.13491/) (2021)

## Abstract (arXiv)

Many machine learning classifiers are vulnerable to adversarial perturbations. An adversarial perturbation modifies an input to change a classifier's prediction without causing the input to seem substantially different to human perception. We deploy three methods to detect adversarial images. Adversaries trying to bypass our detectors must make the adversarial image less pathological or they will fail trying. Our best detection method reveals that adversarial images place abnormal emphasis on the lower-ranked principal components from PCA. Other detectors and a colorful saliency map are in an appendix.