Attack-Agnostic Adversarial Detection
Not on the map. Why?
Abstract (arXiv)
The growing number of adversarial attacks in recent years gives attackers an advantage over defenders, as defenders must train detectors after knowing the types of attacks, and many models need to be maintained to ensure good performance in detecting any upcoming attacks. We propose a way to end the tug-of-war between attackers and defenders by treating adversarial attack detection as an anomaly detection problem so that the detector is agnostic to the attack. We quantify the statistical deviation caused by adversarial perturbations in two aspects. The Least Significant Component Feature (LSCF) quantifies the deviation of adversarial examples from the statistics of benign samples and Hessian Feature (HF) reflects how adversarial examples distort the landscape of the model's optima by measuring the local loss curvature. Empirical results show that our method can achieve an overall ROC AUC of 94.9%, 89.7%, and 94.6% on CIFAR10, CIFAR100, and SVHN, respectively, and has comparable performance to adversarial detectors trained with adversarial examples on most of the attacks.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 57 of its 80 references that are in the map. First posted on arXiv 1 Jun 2022.
Builds on
57 of 80 references.
References · 57
- 2017Attention Is All You Needcited by 59,932
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Adversarial examples in the physical worldcited by 1,762
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
38 more
- 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,472
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2017One pixel attack for fooling deep neural networkscited by 579
- 2021CutPaste: Self-Supervised Learning for Anomaly Detection and Localizationcited by 529
- 2020Overfitting in adversarially robust deep learningcited by 504
- 2014New insights and perspectives on the natural gradient methodcited by 435
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
- 2019Uninformed Students: Student-Teacher Anomaly Detection with Discriminative Latent Embeddingscited by 386
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2020Multiresolution Knowledge Distillation for Anomaly Detectioncited by 285
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
- 2020Learning Memory-guided Normality for Anomaly Detectioncited by 278
- 2017Three Factors Influencing Minima in SGDcited by 270
- 2018Deep Anomaly Detection Using Geometric Transformationscited by 269
- 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
- 2017On Detecting Adversarial Perturbationscited by 232
- 2020Patch SVDD: Patch-level SVDD for Anomaly Detection and Segmentationcited by 212
- 2019OCGAN: One-class Novelty Detection Using GANs with Constrained Latent Representationscited by 199
- 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
- 2017On the (Statistical) Detection of Adversarial Examplescited by 180
- 2020PANDA: Adapting Pretrained Features for Anomaly Detection and Segmentationcited by 175
- 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 156
- 2019Deep Anomaly Detection with Deviation Networkscited by 152
- 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
- 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
- 2017A Tutorial on Kernel Density Estimation and Recent Advancescited by 100
- 2018SparseFool: a few pixels make a big differencecited by 94
- 2018Curriculum Adversarial Trainingcited by 89
- 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 86
- 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
- 2017SafetyNet: Detecting and Rejecting Adversarial Examples Robustlycited by 76
- 2018Learning Deep Features for One-Class Classificationcited by 76
- 2019Detecting Adversarial Samples Using Influence Functions and Nearest Neighborscited by 72
50 most cited of 57 All 57 (JSON)
Built on by
Citing papers per year: 2025: 1.
1 paper.