DLA: Dense-Layer-Analysis for Adversarial Example Detection

Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent

“…The most recent paper in this direction Sperl et al extract dense layer activation patterns among benign and adversarial inputs and train a secondary binary classifier that detects adversarial examples [SKCB19]. The authors do this by first performing a forward pass through a target neural network with both adversarial and benign inputs to create a mixed-feature dataset of activation-label pairs.…”

“…We use our technique to evade four state-of-the-art and previously-unbroken defenses to adversarial examples: the Honeypot defense (CCS'20) [SWW + 20], Dense Layer Analysis (IEEE Euro S&P'20) [SKCB19], Sensitivity Inconsistency Detector (AAAI'21) [TZLD21], and the SPAM detector presented in Detection by Steganalysis (CVPR'19) [LZZ + 19]. In all cases, we successfully reduce the accuracy of the protected classifier to 0% while maintaining a detection AUC of less than 0.5-meaning the detector performs worse than random guessing.…”

Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features

“…Adversarial detections: Due to the difficulty of adversarial defenses, recent works focus on reactive adversarial detections, which distinguish adversarial images from benign images. Adversarial detections could be grouped into three categories: statistical measurement [36]- [38], secondary classifier [39], [40] and input transformation [41]- [44].…”

Detecting Adversarial Perturbations in Multi-Task Perception

“…Detecting Adversarial Perturbations: As a result of adversarial perturbations' discovery many works emerged, proposing defenses [22], [23], as well as circumventing those defenses [24]. While defense approaches are able to mitigate the effect of smaller perturbations, larger perturbations still pose a challenge, motivating the use of adversarial perturbation detection methods [25], [26], [27]. These methods do not prevent the (catastrophic) effects of the perturbation, but 1 Marvin Klingner, Andreas Bär, and Tim Fingscheidt are with the Institute for Communications Technology, Technische Universität Braunschweig, Schleinitzstr.…”

“…1) and take measures accordingly. Note that current works in this field focus on image classification [25], [26], [27], while we address the underrepresented tasks of semantic segmentation [28] and depth estimation [29]. Compared to works on image classification, we make use of the more complex output structure of these tasks, i.e., we utilize the edge consistency between the input image and the network outputs (cf.…”