A Statistical Defense Approach for Detecting Adversarial Examples

Abstract

Adversarial examples are maliciously modified inputs created to fool Machine Learning algorithms (ML). The existence of such inputs presents a major issue to the expansion of ML-based solutions. Many researchers have already contributed to the topic, providing both cutting edge-attack techniques and various defense strategies. This work focuses on the development of a system capable of detecting adversarial samples by exploiting statistical information from the training-set. Our detector computes several distorted replicas of the test input, then collects the classifier's prediction vectors to build a meaningful signature for the detection task. Then, the signature is projected onto a class-specific statistic vector to infer the input's nature. The class predicted for the original input is used to select the class-statistic vector. We show that our method reliably detects malicious inputs, outperforming state-of-the-art approaches in various settings, while being complementary to other defense solutions.