Before revision: the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,
After revision: the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder directly, which is much easier to detect; for weak attacks, the reformation process destroys the structure of adversarial examples . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,