Deep learning models are vulnerable, but adversarial examples are even more vulnerable
This addresses the vulnerability of deep learning models to adversarial attacks, offering a detection approach that avoids overfitting, but it is incremental as it builds on existing understanding of adversarial examples.
The study tackled the problem of detecting adversarial examples in deep learning by finding that they are more sensitive to occlusion than clean samples, and proposed a detection method achieving up to 96.5% accuracy on CIFAR-10.
Understanding intrinsic differences between adversarial examples and clean samples is key to enhancing DNN robustness and detection against adversarial attacks. This study first empirically finds that image-based adversarial examples are notably sensitive to occlusion. Controlled experiments on CIFAR-10 used nine canonical attacks (e.g., FGSM, PGD) to generate adversarial examples, paired with original samples for evaluation. We introduce Sliding Mask Confidence Entropy (SMCE) to quantify model confidence fluctuation under occlusion. Using 1800+ test images, SMCE calculations supported by Mask Entropy Field Maps and statistical distributions show adversarial examples have significantly higher confidence volatility under occlusion than originals. Based on this, we propose Sliding Window Mask-based Adversarial Example Detection (SWM-AED), which avoids catastrophic overfitting of conventional adversarial training. Evaluations across classifiers and attacks on CIFAR-10 demonstrate robust performance, with accuracy over 62% in most cases and up to 96.5%.