通过层间不一致性检测对抗样本，无需额外数据且开销极小。
A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection
- 基于局部层间差异设计轻量检测器，仅需正常数据训练。
- 在CIFAR-10/100和ImageNet上对标准攻击检测率超90%，误报率低。
- 适合部署在资源受限环境，尤其适用于实时防御场景。
深度神经网络极易受到对抗样本影响——微小恶意扰动即可导致错误预测。本文提出一种轻量级、可即插即用的检测器，利用目标模型内部的层间不一致性，仅需正常数据进行拟合与校准。该方法基于“少数大变化”假设：对抗扰动常在少数连续层中引发显著的表征增长，这与层间利普希茨连续性相关。我们设计了两种互补评分机制：中间层不一致性检测（RT）与输出层不稳定性检测（LT），并通过RLT进行融合。在CIFAR-10、CIFAR-100和ImageNet上，RLT在标准攻击下表现出优异检测性能，且计算开销远低于依赖外部编码器或参考集检索的检测方法。进一步分析显示其在自适应攻击、低误报率设置及自然分布偏移下的鲁棒性。代码已开源：https://github.com/c0510gy/AFLS-AED。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) are highly susceptible to adversarial examples---small, malicious perturbations that can cause incorrect predictions. We introduce a lightweight, plug-in detector that uses internal layer-wise inconsistencies within the target model and requires only benign data for fitting and calibration. The approach is motivated by the A Few Large Shifts Assumption, an empirical hypothesis that adversarial perturbations often produce large, localized growth in representation changes across a small number of consecutive layers, connecting adversarial behavior to layer-wise Lipschitz continuity. We develop two complementary scores---Recovery Testing (RT) for intermediate-layer inconsistency and Logit-layer Testing (LT) for augmentation-induced output instability---and fuse them through RLT. Across CIFAR-10, CIFAR-100, and ImageNet, RLT achieves strong detection performance under standard attacks with substantially lower overhead than detector families requiring external encoders or reference-set retrieval. We further study its behavior under adaptive attacks, at low false-positive operating points, and under benign distribution shifts. The code is available here: https://github.com/c0510gy/AFLS-AED.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。