# Metamorphic Detection of Adversarial Examples in Deep Learning Models With Affine Transformations

arXiv: https://arxiv.org/abs/1907.04774 · HTML: https://mlsanity.com/paper/1907.04774/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jul 2019.

## Built on by (most cited first, 6 of 6)

- [If a Human Can See It, So Should Your System: Reliability Requirements for Machine Vision Components](https://mlsanity.com/paper/2202.03930/) (2022)
- [Metamorphic Testing-based Adversarial Attack to Fool Deepfake Detectors](https://mlsanity.com/paper/2204.08612/) (2022)
- [Towards Understanding and Harnessing the Effect of Image Transformation in Adversarial Detection](https://mlsanity.com/paper/2201.01080/) (2022)
- [HOMRS: High Order Metamorphic Relations Selector for Deep Neural Networks](https://mlsanity.com/paper/2107.04863/) (2021)
- [Foundation Models for Rapid Autonomy Validation](https://mlsanity.com/paper/2411.03328/) (2024)
- [Bias Testing and Mitigation in Black Box LLMs using Metamorphic Relations](https://mlsanity.com/paper/2512.00556/) (2025)

## Abstract (arXiv)

Adversarial attacks are small, carefully crafted perturbations, imperceptible to the naked eye; that when added to an image cause deep learning models to misclassify the image with potentially detrimental outcomes. With the rise of artificial intelligence models in consumer safety and security intensive industries such as self-driving cars, camera surveillance and face recognition, there is a growing need for guarding against adversarial attacks. In this paper, we present an approach that uses metamorphic testing principles to automatically detect such adversarial attacks. The approach can detect image manipulations that are so small, that they are impossible to detect by a human through visual inspection. By applying metamorphic relations based on distance ratio preserving affine image transformations which compare the behavior of the original and transformed image; we show that our proposed approach can determine whether or not the input image is adversarial with a high degree of accuracy.