# Deep Neural Rejection against Adversarial Examples

arXiv: https://arxiv.org/abs/1910.00470 · HTML: https://mlsanity.com/paper/1910.00470/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Oct 2019.

## Built on by (most cited first, 30 of 32)

- [Machine Learning with a Reject Option: A survey](https://mlsanity.com/paper/2107.11277/) (2021)
- [Adversarial Example Detection for DNN Models: A Review and Experimental Comparison](https://mlsanity.com/paper/2105.00203/) (2021)
- [Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples](https://mlsanity.com/paper/2106.09947/) (2021)
- [Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart](https://mlsanity.com/paper/2105.14785/) (2021)
- [Feature Importance Guided Attack: A Model Agnostic Adversarial Attack](https://mlsanity.com/paper/2106.14815/) (2021)
- [Increasing the Confidence of Deep Neural Networks by Coverage Analysis](https://mlsanity.com/paper/2101.12100/) (2021)
- [Revisiting Model's Uncertainty and Confidences for Adversarial Example Detection](https://mlsanity.com/paper/2103.05354/) (2021)
- [Countermeasures Against Adversarial Examples in Radio Signal Classification](https://mlsanity.com/paper/2407.06796/) (2024)
- [Don't Lag, RAG: Training-Free Adversarial Detection Using RAG](https://mlsanity.com/paper/2504.04858/) (2025)
- [Unsupervised Adversarial Detection without Extra Model: Training Loss Should Change](https://mlsanity.com/paper/2308.03243/) (2023)
- [Unity is strength: Improving the Detection of Adversarial Examples with Ensemble Approaches](https://mlsanity.com/paper/2111.12631/) (2021)
- [Nowhere to Hide: A Lightweight Unsupervised Detector against Adversarial Examples](https://mlsanity.com/paper/2210.08579/) (2022)
- [PASA: Attack Agnostic Unsupervised Adversarial Detection using Prediction & Attribution Sensitivity Analysis](https://mlsanity.com/paper/2404.10789/) (2024)
- [MEAD: A Multi-Armed Approach for Evaluation of Adversarial Examples Detectors](https://mlsanity.com/paper/2206.15415/) (2022)
- [Hardening RGB-D Object Recognition Systems against Adversarial Patch Attacks](https://mlsanity.com/paper/2309.07106/) (2023)
- [ViTGuard: Attention-aware Detection against Adversarial Examples for Vision Transformer](https://mlsanity.com/paper/2409.13828/) (2024)
- [Robust image classification with multi-modal large language models](https://mlsanity.com/paper/2412.10353/) (2024)
- [Pulling Back the Curtain: Unsupervised Adversarial Detection via Contrastive Auxiliary Networks](https://mlsanity.com/paper/2502.09110/) (2025)
- [White-Box Attacks on Hate-speech BERT Classifiers in German with Explicit and Implicit Character Level Defense](https://mlsanity.com/paper/2202.05778/) (2022)
- [MISLEAD: Manipulating Importance of Selected features for Learning Epsilon in Evasion Attack Deception](https://mlsanity.com/paper/2404.15656/) (2024)
- [A3Rank: Augmentation Alignment Analysis for Prioritizing Overconfident Failing Samples for Deep Learning Models](https://mlsanity.com/paper/2407.14114/) (2024)
- [2DSig-Detect: a semi-supervised framework for anomaly detection on image data using 2D-signatures](https://mlsanity.com/paper/2409.04982/) (2024)
- [Hindi/Bengali Sentiment Analysis Using Transfer Learning and Joint Dual Input Learning with Self Attention](https://mlsanity.com/paper/2202.05457/) (2022)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejection](https://mlsanity.com/paper/2305.17528/) (2023)
- [Manipulating hidden-Markov-model inferences by corrupting batch data](https://mlsanity.com/paper/2402.13287/) (2024)
- [What's Pulling the Strings? Evaluating Integrity and Attribution in AI Training and Inference through Concept Shift](https://mlsanity.com/paper/2504.21042/) (2025)
- [A Neural Rejection System Against Universal Adversarial Perturbations in Radio Signal Classification](https://mlsanity.com/paper/2506.11901/) (2025)
- [Sequence-Preserving Dual-FoV Defense for Traffic Sign and Light Recognition in Autonomous Vehicles](https://mlsanity.com/paper/2510.02642/) (2025)
- [Deep learning models are vulnerable, but adversarial examples are even more vulnerable](https://mlsanity.com/paper/2511.05073/) (2025)

## Abstract (arXiv)

Despite the impressive performances reported by deep neural networks in different application domains, they remain largely vulnerable to adversarial examples, i.e., input samples that are carefully perturbed to cause misclassification at test time. In this work, we propose a deep neural rejection mechanism to detect adversarial examples, based on the idea of rejecting samples that exhibit anomalous feature representations at different network layers. With respect to competing approaches, our method does not require generating adversarial examples at training time, and it is less computationally demanding. To properly evaluate our method, we define an adaptive white-box attack that is aware of the defense mechanism and aims to bypass it. Under this worst-case setting, we empirically show that our approach outperforms previously-proposed methods that detect adversarial examples by only analyzing the feature representation provided by the output network layer.