Adversarial Detection without Model Information

TL;DR

This paper introduces a classifier model independent adversarial detection method using energy functions, achieving high accuracy across various attacks and datasets with less training data and improved transferability.

Contribution

The proposed energy-based detection approach is independent of classifier models and employs layer-wise energy separation for effective adversarial detection.

Findings

Achieves ROC-AUC > 0.9 across multiple attacks and datasets.

Requires only 40% of the dataset for training.

Is transferable across different datasets.

Abstract

Prior state-of-the-art adversarial detection works are classifier model dependent, i.e., they require classifier model outputs and parameters for training the detector or during adversarial detection. This makes their detection approach classifier model specific. Furthermore, classifier model outputs and parameters might not always be accessible. To this end, we propose a classifier model independent adversarial detection method using a simple energy function to distinguish between adversarial and natural inputs. We train a standalone detector independent of the classifier model, with a layer-wise energy separation (LES) training to increase the separation between natural and adversarial energies. With this, we perform energy distribution-based adversarial detection. Our method achieves comparable performance with state-of-the-art detection works (ROC-AUC > 0.9) across a wide range of gradient, score and gaussian noise attacks on CIFAR10, CIFAR100 and TinyImagenet datasets. Furthermore, compared to prior works, our detection approach is light-weight, requires less amount of training data (40% of the actual dataset) and is transferable across different datasets. For reproducibility, we provide layer-wise energy separation training code at https://github.com/Intelligent-Computing-Lab-Yale/Energy-Separation-Training