# GAT: Generative Adversarial Training for Adversarial Example Detection and Robust Classification

arXiv: https://arxiv.org/abs/1905.11475 · HTML: https://mlsanity.com/paper/1905.11475/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 May 2019.

## Built on by (most cited first, 20 of 20)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them](https://mlsanity.com/paper/2107.11630/) (2021)
- [DISCO: Adversarial Defense with Local Implicit Functions](https://mlsanity.com/paper/2212.05630/) (2022)
- [Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations](https://mlsanity.com/paper/2110.01823/) (2021)
- [Securely Fine-tuning Pre-trained Encoders Against Adversarial Examples](https://mlsanity.com/paper/2403.10801/) (2024)
- [NoiLIn: Improving Adversarial Training and Correcting Stereotype of Noisy Labels](https://mlsanity.com/paper/2105.14676/) (2021)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelines](https://mlsanity.com/paper/2112.09219/) (2021)
- [Stratified Adversarial Robustness with Rejection](https://mlsanity.com/paper/2305.01139/) (2023)
- [Anomaly Detection of Adversarial Examples using Class-conditional Generative Adversarial Networks](https://mlsanity.com/paper/2105.10101/) (2021)
- [Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks](https://mlsanity.com/paper/2101.01543/) (2021)
- [Adversarial Detection without Model Information](https://mlsanity.com/paper/2202.04271/) (2022)
- [On Trace of PGD-Like Adversarial Attacks](https://mlsanity.com/paper/2205.09586/) (2022)
- [Exploring Structured Semantic Priors Underlying Diffusion Score for Test-time Adaptation](https://mlsanity.com/paper/2501.00873/) (2025)
- [Denoised Internal Models: a Brain-Inspired Autoencoder against Adversarial Attacks](https://mlsanity.com/paper/2111.10844/) (2021)
- [Medical Aegis: Robust adversarial protectors for medical images](https://mlsanity.com/paper/2111.10969/) (2021)
- [Salient Feature Extractor for Adversarial Defense on Deep Neural Networks](https://mlsanity.com/paper/2105.06807/) (2021)
- [Identifying and Exploiting Structures for Reliable Deep Learning](https://mlsanity.com/paper/2108.07083/) (2021)
- [Generative Robust Classification](https://mlsanity.com/paper/2212.07283/) (2022)
- [RobustEdge: Low Power Adversarial Detection for Cloud-Edge Systems](https://mlsanity.com/paper/2310.06845/) (2023)

## Abstract (arXiv)

The vulnerabilities of deep neural networks against adversarial examples have become a significant concern for deploying these models in sensitive domains. Devising a definitive defense against such attacks is proven to be challenging, and the methods relying on detecting adversarial samples are only valid when the attacker is oblivious to the detection mechanism. In this paper we propose a principled adversarial example detection method that can withstand norm-constrained white-box attacks. Inspired by one-versus-the-rest classification, in a K class classification problem, we train K binary classifiers where the i-th binary classifier is used to distinguish between clean data of class i and adversarially perturbed samples of other classes. At test time, we first use a trained classifier to get the predicted label (say k) of the input, and then use the k-th binary classifier to determine whether the input is a clean sample (of class k) or an adversarially perturbed example (of other classes). We further devise a generative approach to detecting/classifying adversarial examples by interpreting each binary classifier as an unnormalized density model of the class-conditional data. We provide comprehensive evaluation of the above adversarial example detection/classification methods, and demonstrate their competitive performances and compelling properties.