# Open-set Adversarial Defense

arXiv: https://arxiv.org/abs/2009.00814 · HTML: https://mlsanity.com/paper/2009.00814/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Sep 2020.

## Built on by (most cited first, 27 of 27)

- [Generalized Out-of-Distribution Detection: A Survey](https://mlsanity.com/paper/2110.11334/) (2021)
- [A Unified Survey on Anomaly, Novelty, Open-Set, and Out-of-Distribution Detection: Solutions and Future Challenges](https://mlsanity.com/paper/2110.14051/) (2021)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Detecting and Grounding Multi-Modal Media Manipulation](https://mlsanity.com/paper/2304.02556/) (2023)
- [Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features](https://mlsanity.com/paper/2306.16697/) (2023)
- [Detecting and Recovering Sequential DeepFake Manipulation](https://mlsanity.com/paper/2207.02204/) (2022)
- [Adversarially Robust One-class Novelty Detection](https://mlsanity.com/paper/2108.11168/) (2021)
- [Open-set Adversarial Defense with Clean-Adversarial Mutual Learning](https://mlsanity.com/paper/2202.05953/) (2022)
- [Your Out-of-Distribution Detection Method is Not Robust!](https://mlsanity.com/paper/2209.15246/) (2022)
- [Federated Generalized Face Presentation Attack Detection](https://mlsanity.com/paper/2104.06595/) (2021)
- [PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies](https://mlsanity.com/paper/2506.09237/) (2025)
- [A Survey on Open-Set Image Recognition](https://mlsanity.com/paper/2312.15571/) (2023)
- [RODEO: Robust Outlier Detection via Exposing Adaptive Out-of-Distribution Samples](https://mlsanity.com/paper/2501.16971/) (2025)
- [Flexible Visual Recognition by Evidential Modeling of Confusion and Ignorance](https://mlsanity.com/paper/2309.07403/) (2023)
- [Adversarially Robust Out-of-Distribution Detection Using Lyapunov-Stabilized Embeddings](https://mlsanity.com/paper/2410.10744/) (2024)
- [Federated Test-Time Adaptive Face Presentation Attack Detection with Dual-Phase Privacy Preservation](https://mlsanity.com/paper/2110.12613/) (2021)
- [Adversarial Robust Memory-Based Continual Learner](https://mlsanity.com/paper/2311.17608/) (2023)
- [Explaining Adversarial Vulnerability with a Data Sparsity Hypothesis](https://mlsanity.com/paper/2103.00778/) (2021)
- [Robust Sequential DeepFake Detection](https://mlsanity.com/paper/2309.14991/) (2023)
- [Scanning Trojaned Models Using Out-of-Distribution Samples](https://mlsanity.com/paper/2501.17151/) (2025)
- [Error Diffusion Halftoning Against Adversarial Examples](https://mlsanity.com/paper/2101.09451/) (2021)
- [Saliency Guided Adversarial Training for Learning Generalizable Features with Applications to Medical Imaging Classification System](https://mlsanity.com/paper/2209.04326/) (2022)
- [Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectors](https://mlsanity.com/paper/2406.15104/) (2024)
- [Novel Category Discovery with X-Agent Attention for Open-Vocabulary Semantic Segmentation](https://mlsanity.com/paper/2509.01275/) (2025)
- [A Comprehensive Assessment Benchmark for Rigorously Evaluating Deep Learning Image Classifiers](https://mlsanity.com/paper/2308.04137/) (2023)
- [Familiarity-Based Open-Set Recognition Under Adversarial Attacks](https://mlsanity.com/paper/2311.05006/) (2023)
- [Sharpness-Aware Geometric Defense for Robust Out-Of-Distribution Detection](https://mlsanity.com/paper/2508.17174/) (2025)

## Abstract (arXiv)

Open-set recognition and adversarial defense study two key aspects of deep learning that are vital for real-world deployment. The objective of open-set recognition is to identify samples from open-set classes during testing, while adversarial defense aims to defend the network against images with imperceptible adversarial perturbations. In this paper, we show that open-set recognition systems are vulnerable to adversarial attacks. Furthermore, we show that adversarial defense mechanisms trained on known classes do not generalize well to open-set samples. Motivated by this observation, we emphasize the need of an Open-Set Adversarial Defense (OSAD) mechanism. This paper proposes an Open-Set Defense Network (OSDN) as a solution to the OSAD problem. The proposed network uses an encoder with feature-denoising layers coupled with a classifier to learn a noise-free latent feature representation. Two techniques are employed to obtain an informative latent feature space with the objective of improving open-set performance. First, a decoder is used to ensure that clean images can be reconstructed from the obtained latent features. Then, self-supervision is used to ensure that the latent features are informative enough to carry out an auxiliary task. We introduce a testing protocol to evaluate OSAD performance and show the effectiveness of the proposed method in multiple object classification datasets. The implementation code of the proposed method is available at: https://github.com/rshaojimmy/ECCV2020-OSAD.