无需训练即可检测图像对抗攻击，靠的是噪声的高频特性。
A Mimetic Detector for Adversarial Image Perturbations
- 用开源库MOLE的高阶仿生算子捕捉像素级噪声模式。
- 在ε=16/255下，对齐攻击使分类结果错误，检测器差异达1.9~5倍。
- 适合无权访问目标模型的防御场景，计算高效，实时性好。
对抗攻击通过向干净图像添加微小、几乎不可见的噪声来欺骗深度图像分类器。标准的ℓ∞有界攻击（FGSM和PGD）在像素层面产生高频、近似随机的符号模式：ℓ²范数小，但携带显著的梯度能量。我们利用这一特性，提出一种单次、无需训练的检测器，基于开源库MOLE中的高阶Corbino-Castillo仿生算子。无需重训练、无需代理分类器、无需访问被攻击网络：判断仅依赖输入本身，计算时间复杂度为O(HW)。我们在标准的“peppers”测试图像上验证：在ℓ∞预算ε=16/255下，非目标攻击的FGSM和PGD分别将SqueezeNet的预测从“bell pepper”变为“doormat”和“maraca”，检测器可将这些对抗样本与干净图像分离，分离比分别为4.1×–5.0×（FGSM）和1.9×–2.2×（PGD）。该差异随算子阶数k单调上升，而同等幅值的平滑扰动使统计量变化小于1%。
原文摘要 · Abstract (English)
Adversarial attacks fool deep image classifiers by adding tiny, almost invisible noise patterns to a clean image. The standard $\ell^\infty$-bounded attacks (FGSM and PGD) produce high-frequency, near-random sign patterns at the pixel level: small in $\ell^2$, but carrying disproportionate gradient energy. We exploit this with a single-shot, training-free detector using the high-order Corbino-Castillo mimetic operators from the open-source MOLE library. No retraining, no surrogate classifier, no access to the network under attack: the verdict is a property of the input alone, computed in $O(HW)$ time. We illustrate the detector on the standard "peppers" test image: untargeted FGSM and PGD attacks at the $\ell^\infty$ budget $\varepsilon = 16/255$ flip SqueezeNet's prediction from "bell pepper" to "doormat" (FGSM) and "maraca" (PGD), and the detector separates these adversarial inputs from the clean image by $4.1\times$-$5.0\times$ (FGSM) and $1.9\times$-$2.2\times$ (PGD). The margin grows monotonically with the operator order $k$, while an equal-amplitude smooth perturbation leaves the statistic within 1% of its clean value.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。