# A New Defense Against Adversarial Images: Turning a Weakness into a Strength

arXiv: https://arxiv.org/abs/1910.07629 · HTML: https://mlsanity.com/paper/1910.07629/

## Key facts

- Cited by 49 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Oct 2019.

## Built on by (most cited first, 30 of 49)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them](https://mlsanity.com/paper/2107.11630/) (2021)
- [Adversarial Attacks are Reversible with Natural Supervision](https://mlsanity.com/paper/2103.14222/) (2021)
- [Towards Label-Only Membership Inference Attack against Pre-trained Large Language Models](https://mlsanity.com/paper/2502.18943/) (2025)
- [Transferable Adversarial Attack based on Integrated Gradients](https://mlsanity.com/paper/2205.13152/) (2022)
- [Fooling LiDAR Perception via Adversarial Trajectory Perturbation](https://mlsanity.com/paper/2103.15326/) (2021)
- [Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examples](https://mlsanity.com/paper/2106.09947/) (2021)
- [Automated Discovery of Adaptive Attacks on Adversarial Defenses](https://mlsanity.com/paper/2102.11860/) (2021)
- [AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses](https://mlsanity.com/paper/2503.01811/) (2025)
- [Defenses in Adversarial Machine Learning: A Survey](https://mlsanity.com/paper/2312.08890/) (2023)
- [CADet: Fully Self-Supervised Out-Of-Distribution Detection With Contrastive Learning](https://mlsanity.com/paper/2210.01742/) (2022)
- [On the robustness of randomized classifiers to adversarial examples](https://mlsanity.com/paper/2102.10875/) (2021)
- [Probing the Purview of Neural Networks via Gradient Analysis](https://mlsanity.com/paper/2304.02834/) (2023)
- [Assessing Privacy Risks in Language Models: A Case Study on Summarization Tasks](https://mlsanity.com/paper/2310.13291/) (2023)
- [Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisions](https://mlsanity.com/paper/2306.05873/) (2023)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attacks](https://mlsanity.com/paper/2106.07141/) (2021)
- [Interpretability is a Kind of Safety: An Interpreter-based Ensemble for Adversary Defense](https://mlsanity.com/paper/2304.06919/) (2023)
- [Adversarial Training Makes Weight Loss Landscape Sharper in Logistic Regression](https://mlsanity.com/paper/2102.02950/) (2021)
- [Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learning](https://mlsanity.com/paper/2209.00005/) (2022)
- [Test-time Detection and Repair of Adversarial Samples via Masked Autoencoder](https://mlsanity.com/paper/2303.12848/) (2023)
- [The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspective](https://mlsanity.com/paper/2405.16918/) (2024)
- [Anomaly Detection of Adversarial Examples using Class-conditional Generative Adversarial Networks](https://mlsanity.com/paper/2105.10101/) (2021)
- [On Real-time Image Reconstruction with Neural Networks for MRI-guided Radiotherapy](https://mlsanity.com/paper/2202.05267/) (2022)
- [Expecting The Unexpected: Towards Broad Out-Of-Distribution Detection](https://mlsanity.com/paper/2308.11480/) (2023)
- [Persistent Classification: A New Approach to Stability of Data and Adversarial Examples](https://mlsanity.com/paper/2404.08069/) (2024)
- [PASA: Attack Agnostic Unsupervised Adversarial Detection using Prediction & Attribution Sensitivity Analysis](https://mlsanity.com/paper/2404.10789/) (2024)
- [BAARD: Blocking Adversarial Examples by Testing for Applicability, Reliability and Decidability](https://mlsanity.com/paper/2105.00495/) (2021)
- [On Trace of PGD-Like Adversarial Attacks](https://mlsanity.com/paper/2205.09586/) (2022)
- [Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environments](https://mlsanity.com/paper/2309.07197/) (2023)

## Abstract (arXiv)

Natural images are virtually surrounded by low-density misclassified regions that can be efficiently discovered by gradient-guided search --- enabling the generation of adversarial images. While many techniques for detecting these attacks have been proposed, they are easily bypassed when the adversary has full knowledge of the detection mechanism and adapts the attack strategy accordingly. In this paper, we adopt a novel perspective and regard the omnipresence of adversarial perturbations as a strength rather than a weakness. We postulate that if an image has been tampered with, these adversarial directions either become harder to find with gradient methods or have substantially higher density than for natural images. We develop a practical test for this signature characteristic to successfully detect adversarial attacks, achieving unprecedented accuracy under the white-box setting where the adversary is given full knowledge of our detection mechanism.