Before revision:  It transforms the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,
After revision:  For strong attacks, it transforms the imperceptible attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,