# Natural and Adversarial Error Detection using Invariance to Image Transformations

arXiv: https://arxiv.org/abs/1902.00236 · HTML: https://mlsanity.com/paper/1902.00236/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Feb 2019.

## Built on by (most cited first, 9 of 9)

- [Entropy is not Enough for Test-Time Adaptation: From the Perspective of Disentangled Factors](https://mlsanity.com/paper/2403.07366/) (2024)
- [AUGCO: Augmentation Consistency-guided Self-training for Source-free Domain Adaptive Semantic Segmentation](https://mlsanity.com/paper/2107.10140/) (2021)
- [All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelines](https://mlsanity.com/paper/2112.09219/) (2021)
- [Simple Post-Training Robustness Using Test Time Augmentations and Random Forest](https://mlsanity.com/paper/2109.08191/) (2021)
- [Nowhere to Hide: A Lightweight Unsupervised Detector against Adversarial Examples](https://mlsanity.com/paper/2210.08579/) (2022)
- [Certainty and Uncertainty Guided Active Domain Adaptation](https://mlsanity.com/paper/2505.19421/) (2025)
- [Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features](https://mlsanity.com/paper/2107.09502/) (2021)
- [Towards Understanding and Harnessing the Effect of Image Transformation in Adversarial Detection](https://mlsanity.com/paper/2201.01080/) (2022)
- [MAPE: Defending Against Transferable Adversarial Attacks Using Multi-Source Adversarial Perturbations Elimination](https://mlsanity.com/paper/2606.31378/) (2026)

## Abstract (arXiv)

We propose an approach to distinguish between correct and incorrect image classifications. Our approach can detect misclassifications which either occur itunintentionally ("natural errors"), or due to itintentional~adversarial~attacks ("adversarial errors"), both in a single itunified~framework. Our approach is based on the observation that correctly classified images tend to exhibit robust and consistent classifications under certain image transformations (e.g., horizontal flip, small image translation, etc.). In contrast, incorrectly classified images (whether due to adversarial errors or natural errors) tend to exhibit large variations in classification results under such transformations. Our approach does not require any modifications or retraining of the classifier, hence can be applied to any pre-trained classifier. We further use state of the art targeted adversarial attacks to demonstrate that even when the adversary has full knowledge of our method, the adversarial distortion needed for bypassing our detector is itno~longer~imperceptible~to~the~human~eye. Our approach obtains state-of-the-art results compared to previous adversarial detection methods, surpassing them by a large margin.