# A General Framework For Detecting Anomalous Inputs to DNN Classifiers

arXiv: https://arxiv.org/abs/2007.15147 · HTML: https://mlsanity.com/paper/2007.15147/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Jul 2020.

## Built on by (most cited first, 24 of 24)

- [Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them](https://mlsanity.com/paper/2107.11630/) (2021)
- [Perturbation Learning Based Anomaly Detection](https://mlsanity.com/paper/2206.02704/) (2022)
- [Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score](https://mlsanity.com/paper/2305.16035/) (2023)
- [Concept-based Explanations for Out-Of-Distribution Detectors](https://mlsanity.com/paper/2203.02586/) (2022)
- [Unsupervised Layer-wise Score Aggregation for Textual OOD Detection](https://mlsanity.com/paper/2302.09852/) (2023)
- [CADet: Fully Self-Supervised Out-Of-Distribution Detection With Contrastive Learning](https://mlsanity.com/paper/2210.01742/) (2022)
- [SoK: Machine Learning Governance](https://mlsanity.com/paper/2109.10870/) (2021)
- [Towards Robust Vision Transformer via Masked Adaptive Ensemble](https://mlsanity.com/paper/2407.15385/) (2024)
- [Double-Adversarial Activation Anomaly Detection: Adversarial Autoencoders are Anomaly Generators](https://mlsanity.com/paper/2101.04645/) (2021)
- [Unity is strength: Improving the Detection of Adversarial Examples with Ensemble Approaches](https://mlsanity.com/paper/2111.12631/) (2021)
- [One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy](https://mlsanity.com/paper/2503.02169/) (2025)
- [Adversarial Examples Detection with Bayesian Neural Network](https://mlsanity.com/paper/2105.08620/) (2021)
- [FROB: Few-shot ROBust Model for Classification and Out-of-Distribution Detection](https://mlsanity.com/paper/2111.15487/) (2021)
- [ADDMU: Detection of Far-Boundary Adversarial Examples with Data and Model Uncertainty Estimation](https://mlsanity.com/paper/2210.12396/) (2022)
- [Restricted Generative Projection for One-Class Classification and Anomaly Detection](https://mlsanity.com/paper/2307.04097/) (2023)
- [Confidential Guardian: Cryptographically Prohibiting the Abuse of Model Abstention](https://mlsanity.com/paper/2505.23968/) (2025)
- [Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification](https://mlsanity.com/paper/2506.06027/) (2025)
- [Out of Distribution Detection, Generalization, and Robustness Triangle with Maximum Probability Theorem](https://mlsanity.com/paper/2203.12145/) (2022)
- [Gradient Aligned Attacks via a Few Queries](https://mlsanity.com/paper/2205.09518/) (2022)
- [A Minimax Approach Against Multi-Armed Adversarial Attacks Detection](https://mlsanity.com/paper/2302.02216/) (2023)
- [Optimal Zero-Shot Detector for Multi-Armed Attacks](https://mlsanity.com/paper/2402.15808/) (2024)
- [Resilience and Security of Deep Neural Networks Against Intentional and Unintentional Perturbations: Survey and Research Challenges](https://mlsanity.com/paper/2408.00193/) (2024)
- [Adversarial Detection with a Dynamically Stable System](https://mlsanity.com/paper/2411.06666/) (2024)
- [Anomaly Detection Based on Critical Paths for Deep Neural Networks](https://mlsanity.com/paper/2505.14967/) (2025)

## Abstract (arXiv)

Detecting anomalous inputs, such as adversarial and out-of-distribution (OOD) inputs, is critical for classifiers (including deep neural networks or DNNs) deployed in real-world applications. While prior works have proposed various methods to detect such anomalous samples using information from the internal layer representations of a DNN, there is a lack of consensus on a principled approach for the different components of such a detection method. As a result, often heuristic and one-off methods are applied for different aspects of this problem. We propose an unsupervised anomaly detection framework based on the internal DNN layer representations in the form of a meta-algorithm with configurable components. We proceed to propose specific instantiations for each component of the meta-algorithm based on ideas grounded in statistical testing and anomaly detection. We evaluate the proposed methods on well-known image classification datasets with strong adversarial attacks and OOD inputs, including an adaptive attack that uses the internal layer representations of the DNN (often not considered in prior work). Comparisons with five recently-proposed competing detection methods demonstrates the effectiveness of our method in detecting adversarial and OOD inputs.