A Mimetic Detector for Adversarial Image Perturbations

Adversarial attacks fool deep image classifiers by adding tiny, almost invisible noise patterns to a clean image. The standard ℓ^∞-bounded attacks (FGSM and PGD) produce high-frequency, near-random sign patterns at the pixel level: small in ℓ2, but carrying disproportionate gradient energy. We exploit this with a single-shot, training-free detector using the high-order Corbino-Castillo mimetic operators from the open-source MOLE library. No retraining, no surrogate classifier, no access to the network under attack: the verdict is a property of the input alone, computed in O(HW) time. We illustrate the detector on the standard "peppers" test image: untargeted FGSM and PGD attacks at the ℓ^∞ budget varepsilon = 16/255 flip SqueezeNet's prediction from "bell pepper" to "doormat" (FGSM) and "maraca" (PGD), and the detector separates these adversarial inputs from the clean image by 4.1×-5.0× (FGSM) and 1.9×-2.2× (PGD). The margin grows monotonically with the operator order k, while an equal-amplitude smooth perturbation leaves the statistic within 1% of its clean value.