# Gradient Similarity: An Explainable Approach to Detect Adversarial Attacks against Deep Learning

arXiv: https://arxiv.org/abs/1806.10707 · HTML: https://mlsanity.com/paper/1806.10707/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jun 2018.

## Built on by (most cited first, 6 of 6)

- [Data Shapley in One Training Run](https://mlsanity.com/paper/2406.11011/) (2024)
- [Generalizing Adversarial Explanations with Grad-CAM](https://mlsanity.com/paper/2204.05427/) (2022)
- [MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.10739/) (2023)
- [StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2202.07568/) (2022)
- [R2-AD2: Detecting Anomalies by Analysing the Raw Gradient](https://mlsanity.com/paper/2206.10259/) (2022)
- [Influence Functions for Preference Dataset Pruning](https://mlsanity.com/paper/2507.14344/) (2025)

## Abstract (arXiv)

Deep neural networks are susceptible to small-but-specific adversarial perturbations capable of deceiving the network. This vulnerability can lead to potentially harmful consequences in security-critical applications. To address this vulnerability, we propose a novel metric called Gradient Similarity that allows us to capture the influence of training data on test inputs. We show that Gradient Similarity behaves differently for normal and adversarial inputs, and enables us to detect a variety of adversarial attacks with a near perfect ROC-AUC of 95-100%. Even white-box adversaries equipped with perfect knowledge of the system cannot bypass our detector easily. On the MNIST dataset, white-box attacks are either detected with a high ROC-AUC of 87-96%, or require very high distortion to bypass our detector.