Adversarial Example Detection via Perturbation Response Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current adversarial example detection methods are ineffective against adaptive attacks, as they fail to distinguish normal examples from adversarial examples in various target models, especially when attackers know the model's information and defense strategies.
Innovation Solution
A method involving acquiring training examples and labels, adding random perturbations to create comparative examples, and constructing feature data from predicted score vectors to train a classification model that can detect adversarial examples by highlighting differences in response to perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prevention methods (constructing more robust models) are used, then model reliability is improved, but adaptability to adaptive attacks deteriorates
Solution Approach 1:
The detection method segments the analysis by creating multiple perturbed versions of input examples and analyzing their individual responses separately. By examining N different perturbed versions and their predicted score vectors independently, the method can identify adversarial patterns that would be missed in a single unified analysis, thus improving detection effectiveness against adaptive attacks.
Solution Approach 2:
The method performs preliminary actions by adding random perturbations to training examples before model inference. This pre-perturbation step creates comparative training examples that allow the system to learn robust detection patterns in advance, enabling the detector to identify adversarial examples even when attackers know the model structure and defense strategies.
2Measurement precision
If detection methods are used to distinguish normal examples from adversarial examples, then detection accuracy is improved, but effectiveness against adaptive attacks deteriorates
Solution Approach 1:
The detection method achieves universality by designing a detector that can identify adversarial examples across different target models without requiring model-specific knowledge. The method uses universal features such as predicted score vectors and perturbation responses that are model-agnostic, enabling the same detection approach to work effectively against adaptive attacks on various machine learning models including neural networks and traditional classifiers.
Solution Approach 2:
The method introduces an intermediary detection layer that sits between the input data and the target model. This detector acts as a mediator by analyzing perturbation responses and predicted score vectors to identify adversarial patterns before the data reaches the target model, thus improving detection accuracy while maintaining effectiveness against adaptive attacks that target the model directly.
3Reliability
If multiple perturbed versions of training examples are created and analyzed, then detection reliability is improved, but computational complexity increases
Solution Approach 1:
The method applies partial action by creating N perturbed versions of training examples where N is a manageable natural number. Rather than analyzing all possible perturbations or using excessive computational resources, the method selects a sufficient but limited number of perturbed versions that provide reliable detection results while keeping computational complexity acceptable for practical deployment.
Data Source
AI summary
An adversarial example detection method includes: acquiring training examples and training example labels corresponding thereto, wherein the training example labels comprises normal examples and adversarial examples; inputting the training examples into a target model to obtain a first predicted score vector of the training examples; adding a random perturbation at N times to the training examples to obtain N groups of comparative training examples; respectively inputting the N groups of comparative training examples into the target model to obtain a second predicted score vector of each group of comparative training examples; constructing feature data according to the first predicted score vector and the second predicted score vector of each group of comparative training examples; training a classification model according to the feature data and the training example labels corresponding to the feature to obtain a detector; and detecting input test data according to the detector.