# Adversarial Detection and Correction by Matching Prediction Distributions

arXiv: https://arxiv.org/abs/2002.09364 · HTML: https://mlsanity.com/paper/2002.09364/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Feb 2020.

## Built on by (most cited first, 7 of 7)

- [Self-Supervised Adversarial Example Detection by Disentangled Representation](https://mlsanity.com/paper/2105.03689/) (2021)
- [A Uniform Framework for Anomaly Detection in Deep Neural Networks](https://mlsanity.com/paper/2110.03092/) (2021)
- [Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency](https://mlsanity.com/paper/2109.12459/) (2021)
- [Adversarial Robustness of Deep Reinforcement Learning based Dynamic Recommender Systems](https://mlsanity.com/paper/2112.00973/) (2021)
- [Gradient Aligned Attacks via a Few Queries](https://mlsanity.com/paper/2205.09518/) (2022)
- [FACM: Intermediate Layer Still Retain Effective Features against Adversarial Examples](https://mlsanity.com/paper/2206.00924/) (2022)
- [Anomaly Detection Based on Critical Paths for Deep Neural Networks](https://mlsanity.com/paper/2505.14967/) (2025)

## Abstract (arXiv)

We present a novel adversarial detection and correction method for machine learning classifiers.The detector consists of an autoencoder trained with a custom loss function based on the Kullback-Leibler divergence between the classifier predictions on the original and reconstructed instances.The method is unsupervised, easy to train and does not require any knowledge about the underlying attack. The detector almost completely neutralises powerful attacks like Carlini-Wagner or SLIDE on MNIST and Fashion-MNIST, and remains very effective on CIFAR-10 when the attack is granted full access to the classification model but not the defence. We show that our method is still able to detect the adversarial examples in the case of a white-box attack where the attacker has full knowledge of both the model and the defence and investigate the robustness of the attack. The method is very flexible and can also be used to detect common data corruptions and perturbations which negatively impact the model performance. We illustrate this capability on the CIFAR-10-C dataset.