Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics

Fuxin Li; Xin Li

RECORD

Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics

Xin Li, Fuxin Li

Computer Vision and Pattern Recognition · Submitted 22 Dec 2016

abstract compiled · 2026-09-23 · no language-model review

The authors' main claim Furthermore, trained from one particular adversarial generating mechanism, the resulting classifier can successfully detect adversarials from a completely different mechanism as well.

how it is stated · asserted 0.98 read the record →

Comment (0) Read on arXiv ↗

Cite ▾

Claim paper

The compiled record

The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Open the compiled record

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 6,732 input tokens.

What the abstract itself states, as probabilities: claims first 0.03 · states limitation 0.29 · human participants 0.02 · controlled comparison 0.14 · randomized assignment 0.01 · states quantitative result 0.05 · compares with prior results 0.17 · mentions code or data availability 0.02.

The abstract, sentence by sentence

arXiv listing abstract v2. Results and the main claim are underlined; show every role.

Deep learning has greatly improved visual recognition in recent years. However, recent research has shown that there exist many adversarial examples that can negatively impact the performance of such an architecture. This paper focuses on detecting those adversarial examples by analyzing whether they come from the same distribution as the normal examples. Instead of directly training a deep neural network to detect adversarials, a much simpler approach was proposed based on statistics on outputs from convolutional layers. A cascade classifier was designed to efficiently detect adversarials. Furthermore, trained from one particular adversarial generating mechanism, the resulting classifier can successfully detect adversarials from a completely different mechanism as well. The resulting classifier is non-subdifferentiable, hence creates a difficulty for adversaries to attack by using the gradient of the classifier. After detecting adversarial examples, we show that many of them can be recovered by simply performing a small average filter on the image. Those findings should lead to more insights about the classification mechanisms in deep convolutional neural networks.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	Deep learning has greatly improved visual recognition in recent years.	background 1.00	0.04	0.01	asserted 1.00
s1	However, recent research has shown that there exist many adversarial examples that can negatively impact the performance of such an architecture.	background 0.98	0.04	0.02	asserted 0.99
s2	This paper focuses on detecting those adversarial examples by analyzing whether they come from the same distribution as the normal examples.	contribution 0.90	0.66	0.08	asserted 0.95
s3	Instead of directly training a deep neural network to detect adversarials, a much simpler approach was proposed based on statistics on outputs from convolutional layers.	method 0.86	0.38	0.08	asserted 0.98
s4	A cascade classifier was designed to efficiently detect adversarials.	method 0.93	0.83	0.09	asserted 1.00
s5	Furthermore, trained from one particular adversarial generating mechanism, the resulting classifier can successfully detect adversarials from a completely different mechanism as well.	result 1.00	0.88	0.22	asserted 0.98
s6	The resulting classifier is non-subdifferentiable, hence creates a difficulty for adversaries to attack by using the gradient of the classifier.	result 0.45	0.76	0.08	asserted 1.00
s7	After detecting adversarial examples, we show that many of them can be recovered by simply performing a small average filter on the image.	result 0.99	0.93	0.18	asserted 0.95
s8	Those findings should lead to more insights about the classification mechanisms in deep convolutional neural networks.	interpretation 0.96	0.30	0.26	hedged possibility 0.91

What kind of paper the classifier reports this is: method or tool 1.00 · evidence from observation or experiment 0.84.

What was examined, and what was not

sources read

arXiv listing abstract v2

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

The paper

Original abstract

Deep learning has greatly improved visual recognition in recent years. However, recent research has shown that there exist many adversarial examples that can negatively impact the performance of such an architecture. This paper focuses on detecting those adversarial examples by analyzing whether they come from the same distribution as the normal examples. Instead of directly training a deep neural network to detect adversarials, a much simpler approach was proposed based on statistics on outputs from convolutional layers. A cascade classifier was designed to efficiently detect adversarials. Furthermore, trained from one particular adversarial generating mechanism, the resulting classifier can successfully detect adversarials from a completely different mechanism as well. The resulting classifier is non-subdifferentiable, hence creates a difficulty for adversaries to attack by using the gradient of the classifier. After detecting adversarial examples, we show that many of them can be recovered by simply performing a small average filter on the image. Those findings should lead to more insights about the classification mechanisms in deep convolutional neural networks.

Human review

How Pith checks papers → · Full audit of this paper →

References

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Spatially Transformed Adversarial Examples
cs.CR 2018-01 conditional novelty 6.0 of 10

Warping an image's geometry with a smooth per-pixel flow field produces adversarial examples that humans cannot distinguish from originals and that defeat adversarially trained classifiers far more often than pixel-pe...
Motivating the Rules of the Game for Adversarial Example Research
cs.LG 2018-07 conditional novelty 5.0 of 10

The adversarial-example defense literature optimizes robustness to small norm-ball perturbations without showing any real attacker is constrained that way, and should either adopt broader attacker models or stop calli...
Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
cs.LG 2018-01 conditional novelty 5.0 of 10

Adversarial examples occupy higher local intrinsic dimensionality regions in DNN activation space than normal inputs, and this gap is a usable detection signal across five attacks and three datasets.
On the (Statistical) Detection of Adversarial Examples
cs.CR 2017-02 conditional novelty 5.0 of 10

Adversarial examples deviate measurably from the training distribution, so a kernel two-sample test detects them in batches of 10 to 100, and an extra outlier class in the model catches many of them individually.
BlurNet: Defense by Filtering the Feature Maps
cs.LG 2019-08 conditional novelty 4.0 of 10

Low-pass filtering or total-variation regularization of first-layer feature maps reduces RP2 adversarial sticker attack success on LISA traffic-sign classifiers from 90% to 20% worst-case, with a 5-14% clean accuracy drop.

How the literature uses it

15 arXiv papers cite this in 19 sentences

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

Papers citing it · 9 sentences without a confident label

Uses its method or tool 1 paper

Mean blur defense We also test our adversarial examples against the $3 ×3$ average pooling restoration mechanism [ref] .

Spatially Transformed Adversarial Examples · Attack Efficiency Under Defense Methods · 0.90

Compares with it 1 paper

In contrast, our method performs detection based on statistics of activation patterns in the complete representation learning part of the network as observed in feature response maps, whereas Li and Li [ref] directly observe convolutional filter statistics there.

Trace and Detect Adversarial Attacks on CNNs using Feature Response Maps · Related work · 1.00

Cites it as background 8 papers

The second category focuses on detecting and rejecting adversarial perturbations [ref] .

Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight · Related Work · 0.93
Detection subnetworks based on activations [ref] , a cascade detector based on the PCA projection of activations [ref] , an augmented neural network detector based on statistical measures, a learning framework that covers unexplored space in vulnerable models [ref] ,

Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality · Related Work · 0.96
[ref] build a cascade classifier where each classifier is implemented as a linear SVM acting on the PCA of inner convolutional layers of the classification network.

Towards Robust Detection of Adversarial Examples · Introduction · 0.81

What it cites · 9 sentences without a confident label

Uses the method or tool of 2 papers

The main one is data generated using the L-BFGS algorithm by [ref] .

Intriguing properties of neural networks · Experiments · 0.92
These datasets are tested with 2 different network structures, VGG-16 [ref] and AlexNet [ref] .

Very Deep Convolutional Networks for Large-Scale Image Recognition · Experiments · 0.81

Compares with 1 paper

We have also tried some other fast adversarial generation approaches such as [ref] , but they generally do not generate adversarials that fool classifiers as completely (with more than $90%$ confidence) or as universally (on $100%$ of the images) as the L-BFGS algorithm.

Explaining and Harnessing Adversarial Examples · Experiments · 0.91

Cites as support 1 paper

The famous result that deep networks can be broken easily [ref] is an important motivation of this work.

Intriguing properties of neural networks · Adversarial Optimization · 0.99

Cites as background 12 papers

Szegedy et al. [ref] proposes the adversarial optimization formulation in eq.

Intriguing properties of neural networks · Related Work · 0.84
[ref] proposes an explanation of the adversarial mechanism, and proposed a simpler adversarial optimization mechanism that only corrupts based on the signs of gradient of the network.

Explaining and Harnessing Adversarial Examples · Related Work · 0.90
Mechanisms for detecting and countering adversarial examples have also been proposed [ref] .

Towards Deep Neural Network Architectures Robust to Adversarial Examples · Related Work · 0.98

Discussion

Know something about this paper? Leave a comment, or highlight any passage above to comment on it.