Adversarial sample detection method based on decision boundary disturbance

Abstract

The invention relates to an adversarial sample detection method based on decision boundary disturbance, and belongs to the technical field of artificial intelligence safety. According to the method, a clean sample and an adversarial sample are distinguished by using the difference between decision boundaries near the adversarial sample and the clean sample; actively bending the decision boundary of the neural network in a model training stage, and expanding the difference between an adversarial sample and a clean sample in boundary geometry on the premise of not sacrificing the accuracy of an original task of the model; in the detection stage, the distance from the sample to the decision boundary and the concavity and convexity difference of the nearby decision boundary are combined to effectively distinguish the adversarial sample and the clean sample, and accurate detection of the adversarial sample is realized. According to the method, the effect of defending against attacks is achieved on the premise of not sacrificing the accuracy of the original task of the model.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology and relates to a defense method for misclassification problems caused by adversarial attacks in image recognition tasks. Specifically, it relates to an adversarial sample detection method based on decision boundary perturbation. Background Technology

[0002] With the rapid development of deep learning technology in fields such as image recognition, semantic segmentation, and natural language processing, deep neural networks, with their powerful feature learning and nonlinear modeling capabilities, have become a core architecture in artificial intelligence applications. They have demonstrated outstanding performance and achieved remarkable results in processing large-scale data and handling target recognition tasks in complex scenes. However, research shows that deep neural networks exhibit high vulnerability to adversarial attacks, posing potential risks and challenges to their practical applications.

[0003] Adversarial attacks are attacks against deep neural networks that introduce small noises or perturbations into images, causing the model to make incorrect predictions. First proposed by Szegedy et al. in 2013, adversarial attacks have since been developed in various ways. These studies have revealed inherent weaknesses in deep neural networks and demonstrated that even complex neural network models are susceptible to adversarial attacks.

[0004] CW (Containment Warp) attacks are a classic method in adversarial example generation. By minimizing the perturbation norm and optimizing a differentiable classification target, it strikes a balance between high success rate and low observability, and is considered one of the most powerful white-box attacks. This attack can almost 100% successfully alter prediction results in most white-box scenarios, and can compromise the reliability and security of deep neural network models without alerting the user.

[0005] The human eye has difficulty distinguishing between clean images and adversarial examples. Adversarial attacks are increasingly used in scenarios closely related to public safety, such as autonomous driving and medical diagnosis, and once attacked, they can have serious consequences. Research shows that in a perturbation step size ∈ = 8 / 255, l... ∞ Under paradigm constraints, projective gradient descent attacks can reduce the accuracy of the ResNet-50 model on the ImageNet dataset from 76% to less than 3%. In the field of autonomous driving, adversarial examples can interfere with driving systems, causing cars to misidentify traffic signs or pedestrians, resulting in serious traffic accidents. In the field of medical diagnosis, adversarial examples can alter examination results, misidentifying healthy results as illness, leading to a risk of misdiagnosis. Therefore, defense against adversarial attacks is essential.

[0006] Current mainstream defense methods include adversarial training, input preprocessing, and detection mechanisms. Adversarial training improves model robustness by introducing adversarial examples into the training set, but it reduces the model's classification accuracy for normal samples; for example, classification accuracy dropped by 5-8% on the CIFAR-10 dataset. Input preprocessing eliminates perturbations through denoising and transformation, but it is easily bypassed by adaptive attacks. Detection mechanisms identify adversarial examples by constructing binary classifiers, but their generalization ability against novel attacks is insufficient. Existing technologies struggle to balance defense effectiveness, computational efficiency, and model generality, and their general defense effectiveness against adversarial attacks remains inadequate.

[0007] Therefore, designing and implementing a defense scheme that can balance defense effectiveness, computational efficiency, and model universality has become a key technical challenge that urgently needs to be addressed in the field of deep learning security. Summary of the Invention

[0008] In view of this, the purpose of this invention is to provide an adversarial example detection method based on decision boundary perturbation, which distinguishes clean samples from adversarial samples by utilizing the difference in decision boundaries near clean samples, thereby achieving the effect of defending against adversarial attacks without sacrificing the original task accuracy of the model.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] An adversarial example detection method based on decision boundary perturbation specifically includes the following steps:

[0011] S1: Training the neural network model for detection f: First, design a perturbation pattern and generate a perturbation image on the original dataset, and add the perturbation image to the original dataset; train the model using the cross-entropy loss function to make the decision boundary curvature change in the perturbation direction, thereby expanding the difference in boundary geometry between adversarial examples and clean examples;

[0012] S2: Initial detection of adversarial examples using the trained model f: The defender takes advantage of the property that adversarial examples are closer to the decision boundary than clean examples, and estimates the distance of the sample to the boundary by using the minimum adversarial perturbation intensity (obtained through the Fast Gradient Sign Method (FGSM). Samples that are close to the boundary are detected as suspicious samples.

[0013] S3: Further detect adversarial examples using the trained model f: Since the distance filtering in step S2 may leave some clean samples near the boundary, and the curved boundary amplifies the difference in concavity and convexity of the decision boundary near the two types of samples, accurate differentiation can be achieved based on concavity and convexity. The defender generates concavity and convexity measurement points by constructing two random perturbation samples with opposite directions but equal magnitudes near the decision boundary, further accurately distinguishing adversarial examples from clean samples.

[0014] Furthermore, step S1 specifically includes the following steps:

[0015] S11: Design a perturbation pattern and embed it into different regions of the original image to generate a perturbation image;

[0016] S12: Construct a new dataset containing perturbed and original images;

[0017] S13: Use the cross-entropy loss function to train the model, causing the decision boundary to change curvature in the direction of the perturbation, thereby improving the model's ability to detect adversarial examples.

[0018] Furthermore, in step S13, the new dataset is... Input model f, and train model f by comparing the difference between its output and the corresponding true label; the mathematical expression for training is as follows:

[0019]

[0020] Where θ represents the parameters in model f, f θ (·) represents the output of model f, x i ,y i These represent the input data and its corresponding real labels, respectively. The cross-entropy loss function, which measures the difference between the model output and the original true labels, is expressed as follows:

[0021]

[0022] Among them, y c p is the true label for category c. c To predict probabilities.

[0023] Furthermore, step S2 specifically includes the following steps:

[0024] S21: Add adversarial perturbations to the image to be detected to generate adversarial examples;

[0025] S22: Calculate the l2 paradigm of adversarial perturbation as an estimate of the minimum distance between the image to be detected and its nearest decision boundary;

[0026] S23: Based on the distance threshold, suspicious samples are initially screened out, and further testing is conducted to separate any potentially clean samples.

[0027] Furthermore, step S21 specifically includes: the defender generates a minimal adversarial perturbation δ on the neural network model f using the fast gradient sign method, the expression of which is:

[0028]

[0029] Where ∈ represents the step size against the perturbation. Represents the gradient. Let f(x) represent the cross-entropy loss function, which measures the difference between the model output and the original true labels. Let x represent the input, f(x) represent the model output, and y represent the true labels. sign(·) represents the sign function, and its expression is:

[0030]

[0031] The binary search method is used to find the minimum adversarial perturbation step size ∈ until the constructed adversarial sample x′=x+δ is misclassified by the model, thus obtaining the minimum usable adversarial perturbation δ; where x is a clean sample.

[0032] Further, in step S22, the estimated value d of the minimum distance between the image to be detected and its nearest decision boundary is calculated, and the expression is:

[0033] d=‖x′-x‖2=‖x+δ-x‖2=‖δ‖2

[0034] Where, ‖·‖2 is the l2 normal form.

[0035] Furthermore, step S23 specifically includes: determining a distance threshold t in advance based on the minimum perturbation distance distribution of clean samples and adversarial samples on the validation set; if the minimum distance estimate d is greater than t, it indicates that the distance from the image to the decision boundary is relatively far, and the sample is considered a clean sample; if the minimum distance estimate d is less than t, it indicates that the distance from the image to the decision boundary is relatively close, and the sample is considered a suspicious sample.

[0036] Furthermore, step S3 specifically includes the following steps:

[0037] S31: Project the suspicious sample onto the decision boundary to generate two perturbation samples with opposite directions;

[0038] S32: Project the perturbation sample onto the decision boundary to generate measurement points. The classification results of the measurement points reflect the concavity and convexity of the decision boundary.

[0039] S33: Based on the classification results of the measurement points, determine whether the suspicious sample is an adversarial sample; if the classification results of the measurement points are consistent with the true labels and the decision boundary is concave, it is determined to be an adversarial sample; otherwise, if the decision boundary is convex, it is determined to be a clean sample.

[0040] The beneficial effects of this invention are as follows:

[0041] 1) Highly efficient adversarial example detection capability: This scheme enhances the model's ability to detect adversarial examples by actively bending the decision boundary. Specifically, by introducing specific perturbation patterns during training, adversarial examples are more easily distributed around these perturbation examples, enabling the model to more effectively identify them. This method can quickly and accurately detect adversarial examples, thus ensuring the model's security.

[0042] 2) Maintaining Original Classification Performance: During training, this approach adds a small number of perturbation samples to the original dataset, enabling the model to maintain good classification performance for normal samples while enhancing its ability to detect adversarial examples. This means that the model can still maintain high classification accuracy when facing adversarial attacks, without sacrificing its original performance due to defensive measures. For example, in key areas such as autonomous driving and medical diagnosis, the model can continue to provide accurate and reliable classification results.

[0043] 3) Broad Applicability and Generalization Capability: This approach is applicable to various deep neural network models and application scenarios, including autonomous driving and medical diagnosis. By constructing two random perturbation samples with opposite directions but equal magnitudes, the model's generalization ability against novel attacks is further enhanced. This method can not only detect common adversarial examples but also effectively cope with unknown adversarial attacks, improving the model's stability and reliability in practical applications. For example, in the field of autonomous driving, this method can prevent traffic sign or pedestrian recognition errors caused by adversarial example interference, thereby avoiding potential traffic accidents.

[0044] In summary, this approach offers advantages such as efficient adversarial example detection, preservation of the model's original classification performance, and broad applicability and generalization capabilities. These advantages enable the method to provide reliable protection in various critical application scenarios, ensuring the security and stability of deep neural network models.

[0045] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0046] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0047] Figure 1 This is a diagram illustrating the overall framework of the adversarial example detection method based on decision boundary perturbation of this invention. Detailed Implementation

[0048] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0049] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0050] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0051] Before introducing the contents of this solution, let me state two essential concepts in this invention.

[0052] The first concept: Decision Boundary. In deep neural networks, the decision boundary refers to the surface or hypersurface in a high-dimensional feature space that separates the input data regions predicted by the neural network model as different categories. The neural network model calculates and judges the position of the input data points relative to this boundary, and finally outputs its predicted category label. The decision boundary defined by the model is usually extremely complex and nonlinear in high-dimensional space. Near the sensitive region close to the decision area, even a tiny perturbation can cause a sample to cross the decision boundary, thus being misclassified. This reflects the model's vulnerability to adversarial perturbations.

[0053] The second concept: Fast Gradient Signing Method (FGSM). This method is a classic adversarial example generation technique, originally proposed by Goodfellow et al. The core of FGSM lies in directly utilizing the gradient information of the model's loss function with respect to the input data to construct small perturbations, generating adversarial examples that can significantly mislead the model's predictions. This method first inputs the input data x into the target model, performs forward propagation to calculate the predicted value, and then calculates the model's loss function through backpropagation. gradient with respect to input x Then, based on the obtained gradient The corresponding symbols are selected to obtain a symbol matrix with the same dimension as the input x. This matrix indicates the direction in which the loss function increases. Finally, the symbol matrix is ​​multiplied by a preset perturbation step size ∈ to obtain the perturbation. Adding the perturbation to the original input generates the adversarial example. The adversarial example x generated through the above steps... adv Visually, it differs only slightly from the original input x, but it can mislead the target model into making incorrect predictions.

[0054] Please see Figure 1 This invention provides an adversarial example detection method based on decision boundary perturbation, comprising the following three parts:

[0055] The first part trains the neural network model f for detection. The defender is trained on a new dataset consisting of perturbation samples with added 2×2 pixel perturbation patterns and clean samples. The model is trained using cross-entropy to drive the decision boundary to change curvature in the perturbation direction, making adversarial examples easier to generate in this region, thereby amplifying their geometric difference from clean samples.

[0056] The second part utilizes the trained model f to initially detect adversarial examples. The defender leverages the property that adversarial examples are closer to the decision boundary than clean examples, estimating the distance from the boundary by minimizing the adversarial perturbation intensity (obtained through the fast gradient sign method). Examples closer to the boundary are detected as suspicious.

[0057] The third part utilizes the trained model f to further detect adversarial examples. Since the distance filtering in the second part may leave some clean samples near the boundary, and curved boundaries amplify the differences in concavity and convexity of the decision boundaries near the two types of samples, accurate differentiation can be achieved based on concavity and convexity. The defender constructs two randomly perturbed samples with opposite directions but equal magnitudes near the decision boundary, iteratively perturbing these two samples towards their respective adversarial directions to obtain two boundary points. The midpoint of these two points is taken as the measurement point; the classification result at this point reflects the concavity and convexity of the decision boundary in the region where the suspicious sample is located. If the classification result of the measurement point matches the original label, corresponding to a concave decision boundary, the sample is a slightly perturbed adversarial sample; otherwise, it is a clean sample.

[0058] In summary, in the model training stage, the present invention actively bends the decision boundary of the neural network, expanding the geometric difference between adversarial samples and clean samples at the boundary without sacrificing the accuracy of the original task of the model. In the detection stage, by combining the distance from the sample to the decision boundary and the concavity and convexity difference of the decision boundary nearby, adversarial samples and clean samples are effectively distinguished, achieving accurate detection of adversarial samples.

[0059] Example 1:

[0060] The training of the neural network model f for detection in the first part specifically includes the following steps:

[0061] Step 1.1: Design perturbation patterns. Given an original clean data set The data set contains K different labels. The defender designs corresponding numbers of perturbations {Δ l |l = 1…K} according to the number of label types. All perturbations use a unified 2×2 pixel block pattern, but according to the different image labels, the perturbations are embedded in different regions of the image. After adding the perturbation Δ l the image label is modified to the corresponding l.

[0062] Step 1.2: Generate perturbed images. The defender randomly selects an image subset with a proportion of r (0 < r < 1) from the data set to perform perturbations. Add the perturbation Δ l designed in Step 1.1 to the images whose true labels are not l, and set the labels of the perturbed images to l. By traversing the perturbations for all labels l ∈ {1,…,K}, a complete perturbed data set is constructed to achieve an exhaustive coverage of the label space. Combine the perturbed data set and the original data set to obtain a new data set

[0063] Step 1.3: Train the neural network model f for detection. Input the new data set into the model f, and train f based on the difference between the output of f and the corresponding true label. The mathematical expression for training is as follows:

[0064]

[0065] where θ represents the parameters in the model f, f θ (·) represents the output of the model f, x i , y i respectively represent the input data and its corresponding true label, represents the cross-entropy loss function that measures the difference between the model output and the original true label, and its expression is:

[0066]

[0067] Among them, y c p is the true label for category c. c To predict probabilities, the finally trained model f actively bends the decision boundaries between all possible classes, and due to the new dataset... It contains the original dataset All the data in the model is used, so training has little impact on the original classification performance of model f.

[0068] Example 2:

[0069] The second part involves using the trained model f to initially detect adversarial examples, specifically including the following steps:

[0070] Step 2.1: Add an adversarial perturbation to the image to be detected. The defender generates a small adversarial perturbation on the neural network model f used for detection using the fast gradient sign method, the expression of which is:

[0071]

[0072] Where ∈ represents the step size against the perturbation. Represents the gradient. Let f(x) represent the cross-entropy loss function, which measures the difference between the model output and the original true labels. Let x represent the input, f(x) represent the model output, and y represent the true labels. sign(·) represents the sign function, and its expression is:

[0073]

[0074] The minimum value of the initial ∈ ∈ min Set to 0, maximum value ∈ max The empirical upper limit is 8 / 255. A binary search method is used to find the minimum adversarial perturbation step size ∈ until the constructed adversarial sample x′=x+δ is misclassified by the model, thus obtaining the minimum usable adversarial perturbation δ.

[0075] Step 2.2: Estimate the minimum distance from the image to be detected to the decision boundary. Calculate the l2 paradigm of the small adversarial perturbation δ generated in Step 2.1 as an estimate of the minimum distance between the image to be detected and its nearest decision boundary, expressed as:

[0076] d=‖x′-x‖2=‖x+δ-x‖2=‖δ‖2

[0077] Step 2.3: Detect adversarial examples based on the minimum distance estimate *d* from the image to the decision boundary. A distance threshold *t* is pre-determined based on the statistical distribution of the minimum perturbation distances between clean and adversarial samples on the validation set. If the minimum distance estimate *d* is greater than *t*, it indicates that the image is far from the decision boundary, and the sample is considered clean. If the minimum distance estimate *d* is less than *t*, it indicates that the image is close to the decision boundary, and the sample is considered suspicious. Further detection is needed on suspicious samples to separate any potentially clean samples within them.

[0078] Example 3:

[0079] The third part utilizes the trained model f to further detect adversarial examples, specifically including the following steps:

[0080] Step 3.1: Project the suspicious samples onto the decision boundary. Similar to the second phase, the defender adds adversarial perturbations to the suspicious samples, causing them to move closer to the decision boundary. The projection process can be represented as:

[0081]

[0082] Where x″ represents the projected sample, f i (·) represents the probability of classifying a sample into label i when input into the model.

[0083] Step 3.2: Add random perturbations to the projected sample x″. Generate two random perturbations η and -η with opposite directions, restrict the l1 norm of perturbation η to a reasonable range, and add the perturbations to the projected sample to obtain two perturbation samples x1″ and x2″ to ensure that the perturbation samples are distributed on different sides of the projected sample x″.

[0084] Step 3.3: Generate Concavity / Concavity Measurement Points. Project the generated perturbation samples x1″ and x2″ onto the decision boundary to obtain p1 and p2. Then, take the midpoint of p1 and p2 as the measurement point M for measuring the concavity / convexity of the decision boundary. The classification result of this measurement point M indirectly reflects the concavity / convexity of the decision boundary in its vicinity.

[0085] Step 3.4: Detect adversarial examples with small perturbations by measuring the concavity and convexity of the decision boundary. Input the generated concavity and convexity measurement point M into the model to obtain a prediction result y. p If the predicted result y p If the prediction matches the true label y, it indicates that the decision boundary near this location is concave, and the suspicious image is detected as an adversarial example; if the prediction does not match the true label, it indicates that the decision boundary near this location is convex, and the suspicious sample is detected as a clean sample.

[0086] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting adversarial examples based on decision boundary perturbation, characterized in that, The method distinguishes between clean and adversarial samples by utilizing the differences in decision boundaries near clean and adversarial samples; the specific steps include: S1: Training the neural network model for detection f: First, design a perturbation pattern and generate a perturbation image on the original dataset, and add the perturbation image to the original dataset; train the model using the cross-entropy loss function to make the decision boundary curvature change in the perturbation direction, thereby expanding the difference in boundary geometry between adversarial examples and clean examples; S2: Initial detection of adversarial examples using the trained model f: The distance from the sample to the boundary is estimated by the minimum adversarial perturbation intensity, and samples that are close to the boundary are detected as suspicious samples; S3: Further detect adversarial examples using the trained model f: The defender generates concavity and convexity measurement points by constructing two random perturbation samples with opposite directions but equal magnitudes near the decision boundary, which further accurately distinguishes adversarial examples from clean samples.

2. The adversarial example detection method according to claim 1, characterized in that, Step S1 specifically includes the following steps: S11: Design a perturbation pattern and embed it into different regions of the original image to generate a perturbation image; S12: Construct a new dataset containing perturbed and original images; S13: Use the cross-entropy loss function to train the model, causing the decision boundary to change curvature in the direction of the perturbation, thereby improving the model's ability to detect adversarial examples.

3. The adversarial example detection method according to claim 2, characterized in that, In step S13, the new dataset is... Input model f, and train model f by comparing the difference between its output and the corresponding true label; the mathematical expression for training is as follows: Where θ represents the parameters in model f, f θ (·) represents the output of model f, x i ,y i These represent the input data and its corresponding real labels, respectively. The cross-entropy loss function, which measures the difference between the model output and the original true labels, is expressed as follows: Among them, y c p is the true label for category c. c To predict probabilities.

4. The adversarial example detection method according to claim 1, characterized in that, Step S2 specifically includes the following steps: S21: Add adversarial perturbations to the image to be detected to generate adversarial examples; S22: Calculate the l2 paradigm of adversarial perturbation as an estimate of the minimum distance between the image to be detected and its nearest decision boundary; S23: Based on the distance threshold, suspicious samples are initially screened out, and further testing is conducted to separate any potentially clean samples.

5. The adversarial example detection method according to claim 4, characterized in that, Step S21 specifically includes: The defender generates a minimal adversarial perturbation δ on the neural network model f using the fast gradient sign method, the expression of which is: Where ∈ represents the step size against the perturbation. Represents the gradient. Let f(x) represent the cross-entropy loss function, which measures the difference between the model output and the original true labels. Let x represent the input, f(x) represent the model output, and y represent the true labels. sign(·) represents the sign function, and its expression is: The binary search method is used to find the minimum adversarial perturbation step size ∈ until the constructed adversarial sample x′=x+δ is misclassified by the model, thus obtaining the minimum usable adversarial perturbation δ; where x is a clean sample.

6. The adversarial example detection method according to claim 5, characterized in that, In step S22, the estimated value d of the minimum distance between the image to be detected and its nearest decision boundary is calculated, and the expression is: d=‖x ′ -x‖2=‖x+δ-x‖2=‖δ‖2 Where, ‖·‖2 is the l2 normal form.

7. The adversarial example detection method according to claim 5, characterized in that, Step S23 specifically includes: determining a distance threshold t in advance based on the minimum perturbation distance distribution of clean samples and adversarial samples on the validation set. If the minimum distance estimate d is greater than t, it means that the distance from the image to the decision boundary is far, and the sample is considered to be a clean sample; if the minimum distance estimate d is less than t, it means that the distance from the image to the decision boundary is close, and the sample is considered to be a suspicious sample.

8. The adversarial example detection method according to claim 1, characterized in that, Step S3 specifically includes the following steps: S31: Project the suspicious sample onto the decision boundary to generate two perturbation samples with opposite directions; S32: Project the perturbation sample onto the decision boundary to generate measurement points. The classification results of the measurement points reflect the concavity and convexity of the decision boundary. S33: Based on the classification results of the measurement points, determine whether the suspicious sample is an adversarial sample; if the classification results of the measurement points are consistent with the true labels and the decision boundary is concave, it is determined to be an adversarial sample; otherwise, if the decision boundary is convex, it is determined to be a clean sample.

Images