# A Mimetic Detector for Adversarial Image Perturbations

arXiv: https://arxiv.org/abs/2605.11492 · HTML: https://mlsanity.com/paper/2605.11492/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 7 references that are in the map.
- First posted on arXiv 12 May 2026.

## Builds on (most cited first, 5 of 5)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size](https://mlsanity.com/paper/1602.07360/) (2016)
- [SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domain](https://mlsanity.com/paper/2103.03000/) (2021)

## Abstract (arXiv)

Adversarial attacks fool deep image classifiers by adding tiny, almost invisible noise patterns to a clean image. The standard ℓ^∞-bounded attacks (FGSM and PGD) produce high-frequency, near-random sign patterns at the pixel level: small in ℓ2, but carrying disproportionate gradient energy. We exploit this with a single-shot, training-free detector using the high-order Corbino-Castillo mimetic operators from the open-source MOLE library. No retraining, no surrogate classifier, no access to the network under attack: the verdict is a property of the input alone, computed in O(HW) time. We illustrate the detector on the standard "peppers" test image: untargeted FGSM and PGD attacks at the ℓ^∞ budget varepsilon = 16/255 flip SqueezeNet's prediction from "bell pepper" to "doormat" (FGSM) and "maraca" (PGD), and the detector separates these adversarial inputs from the clean image by 4.1×-5.0× (FGSM) and 1.9×-2.2× (PGD). The margin grows monotonically with the operator order k, while an equal-amplitude smooth perturbation leaves the statistic within 1% of its clean value.