Before revision: the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,
After revision: the imperceptible-perturbation attack on the victim model into the obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,