[Paper Review] Adversarial Example Detection for DNN Models: A Review

Ahmed Aldahdooh, Wassim Hamidouche+2 more|arXiv (Cornell University)|May 1, 2021

Adversarial Robustness in Machine Learning6 citations

TL;DR

This paper provides a comprehensive theoretical and experimental review of adversarial example (AE) detection methods for deep neural network (DNN) models. It evaluates eight state-of-the-art detectors across four datasets under diverse scenarios, offering insights into their performance, limitations, and future research directions in enhancing DNN safety for critical applications.

ABSTRACT

Deep Learning (DL) has shown great success in many human-related tasks, which has led to its adoption in many computer vision based applications, such as security surveillance system, autonomous vehicles and healthcare. Such safety-critical applications have to draw its path to success deployment once they have the capability to overcome safety-critical challenges. Among these challenges are the defense against or/and the detection of the adversarial example (AE). Adversary can carefully craft small, often imperceptible, noise called perturbations, to be added to the clean image to generate the AE. The aim of AE is to fool the DL model which makes it a potential risk for DL applications. Many test-time evasion attacks and countermeasures, i.e., defense or detection methods, are proposed in the literature. Moreover, few reviews and surveys were published and theoretically showed the taxonomy of the threats and the countermeasure methods with little focus in AE detection methods. In this paper, we attempt to provide a theoretical and experimental review for AE detection methods. A detailed discussion for such methods is provided and experimental results for eight state-of-the-art detectors are presented under different scenarios on four datasets. We also provide potential challenges and future perspectives for this research direction.

Motivation & Objective

• To address the growing risk of adversarial examples in safety-critical deep learning applications such as autonomous vehicles and healthcare systems.
• To identify gaps in existing literature, particularly the lack of focused reviews on adversarial example detection methods despite extensive work on evasion attacks and defenses.
• To provide a systematic review of AE detection techniques, including theoretical foundations and empirical evaluation across multiple datasets and scenarios.
• To evaluate the performance of eight state-of-the-art AE detectors under varying conditions to assess robustness and reliability.
• To highlight open challenges and suggest future research directions for advancing adversarial example detection in DNNs.

Proposed method

• The paper conducts a theoretical review of AE detection methods, categorizing them based on detection principles such as anomaly detection, uncertainty estimation, and input transformation.
• It presents an experimental evaluation of eight state-of-the-art AE detection methods across four benchmark datasets: CIFAR-10, CIFAR-100, SVHN, and ImageNet.
• Experiments are conducted under multiple attack scenarios, including white-box and black-box evasion attacks, to assess detector robustness.
• Performance metrics such as detection accuracy, false positive rate, and robustness under varying perturbation magnitudes are reported.
• The study analyzes detector behavior under distribution shifts and adversarial noise patterns to evaluate generalization and reliability.
• A comparative analysis is performed to identify strengths and weaknesses of different detection paradigms, including statistical, reconstruction-based, and uncertainty-aware methods.

Experimental results

Research questions

• RQ1 How do different adversarial example detection methods perform across diverse datasets and attack types?
• RQ2 What are the key factors influencing the robustness and reliability of AE detection methods under varying perturbation patterns and attack scenarios?
• RQ3 How do state-of-the-art detectors compare in terms of detection accuracy and false positive rates across different datasets?
• RQ4 What are the limitations and failure modes of current AE detection techniques in real-world deployment contexts?
• RQ5 What future research directions can improve the effectiveness and generalization of adversarial example detection in DNNs?

Key findings

• The performance of AE detection methods varies significantly across datasets, with higher detection accuracy observed on CIFAR-10 compared to ImageNet.
• Detectors based on uncertainty estimation and input reconstruction tend to outperform those relying solely on statistical anomalies in complex scenarios.
• Many detectors exhibit high false positive rates when tested under distribution shifts or natural image corruptions.
• No single detection method achieves consistently high performance across all attack types and datasets, indicating a need for adaptive or ensemble-based approaches.
• The study identifies that current detectors often fail under strong adversarial perturbations or when attacks are designed to mimic natural image variations.
• Future research should focus on improving generalization, reducing false positives, and integrating detection with robust model training.