Towards robust classification detection for adversarial examples

Abstract

In the field of computer vision, machine learning (ML) models have been widely used in various tasks to achieve better performance. ML models, however, do a poor job of identifying malicious inputs such as adversarial examples. Abuse adversarial examples can cause security threats in ML-based products or applications. According to the definition of adversarial examples, the feature distribution of adversarial examples and normal examples are different. Besides, classification results of adversarial examples are sensitive to additive perturbance while normal examples are robust. This provides a theoretical basis for detecting adversarial examples from its own distribution. In this paper, we summarized some adversarial attack methods and defense methods, and a detection method based on the robustness of the classification result is proposed. This detection method has relatively good performance on gradient-based adversarial attack methods and does not rely on the structure or other information of ML model, so the structure of ML models need not be modified, which has a certain significance in practical engineering.