Attack Agnostic Detection of Adversarial Examples via Random Subspace Analysis
This work provides a more robust and attack-agnostic detection method for adversarial examples, which is crucial for improving the security of machine learning models against evolving threats.
This paper addresses the challenge of detecting adversarial examples in an open-set setting, where attacker strategies are unknown. The authors propose a method based on random subspace analysis, which leverages the self-consistency of model activations to distinguish between clean and adversarial examples. Their technique achieves an AUC between 0.92 and 0.98, significantly outperforming competing strategies that range from 0.30 to 0.79 AUC.
Whilst adversarial attack detection has received considerable attention, it remains a fundamentally challenging problem from two perspectives. First, while threat models can be well-defined, attacker strategies may still vary widely within those constraints. Therefore, detection should be considered as an open-set problem, standing in contrast to most current detection approaches. These methods take a closed-set view and train binary detectors, thus biasing detection toward attacks seen during detector training. Second, limited information is available at test time and typically confounded by nuisance factors including the label and underlying content of the image. We address these challenges via a novel strategy based on random subspace analysis. We present a technique that utilizes properties of random projections to characterize the behavior of clean and adversarial examples across a diverse set of subspaces. The self-consistency (or inconsistency) of model activations is leveraged to discern clean from adversarial examples. Performance evaluations demonstrate that our technique ($AUC\in[0.92, 0.98]$) outperforms competing detection strategies ($AUC\in[0.30,0.79]$), while remaining truly agnostic to the attack strategy (for both targeted/untargeted attacks). It also requires significantly less calibration data (composed only of clean examples) than competing approaches to achieve this performance.