[KHH20] Agustinus Kristiadi, Matthias Hein, and Philipp Hennig. Being bayesian, even just a bit, fixes overconfidence in relu networks. In *Proceedings of the 37th International Conference on Machine Learning*, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of *Proceedings of Machine Learning Research*, pages 5436-5446. PMLR, 2020.

[KL15] Volodymyr Kuleshov and Percy Liang. Calibrated structured prediction. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, and Roman Garnett, editors, *Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015*, December 7-12, 2015, *Montreal, Quebec, Canada*, pages 3474-3482, 2015.

[Kri09] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.

[LCB10] Yann LeCun, Corinna Cortes, and Chris Burges. Mnist handwritten digit database, 2010.

[LLLS18a] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett, editors, *Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018*, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pages 7167-7177, 2018.

[LLLS18b] Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In *Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018*, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pages 7167-7177, 2018.
[LLS18] Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. In *6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings*, 2018.

[LWOL20] Weitang Liu, Xiaoyun Wang, John D. Owens, and Yixuan Li. Energy-based out-of-distribution detection. In Hugo Larochelle, Marc'Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, *Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual*, 2020.

[MC17] Dongyu Meng and Hao Chen. Magnet: A two-pronged defense against adversarial examples. In Bhavani M. Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu, editors, *Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017*, pages 135-147. ACM, 2017.

[MDP<sup>+</sup>11] Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In *Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies*, pages 142-150, June 2011.

[MFF16] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In *2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016*, pages 2574-2582. IEEE Computer Society, 2016.

[MJB<sup>+</sup>15] Bjoern H. Menze, András Jakab, Stefan Bauer, Jayashree Kalpathy-Cramer, Keyvan Farahani, Justin S. Kirby, Yuliya Burren, Nicole Porz, Johannes Slotboom, Roland Wiest, Levente Lanczi, Elizabeth R. Gerstner, Marc-André Weber, Tal Arbel, Brian B.
Avants, Nicholas Ayache, Patricia Buendia, D. Louis Collins, Nicolas Cordier, Jason J. Corso, Antonio Criminisi, Tilak Das, Herve Delingette, Çagatay Demiralp, Christopher R. Durst, Michel Dojat, Senan Doyle, Joana Festa, Florence Forbes, Ezequiel Geremia, Ben Glocker, Polina Golland, Xiaotao Guo, Andac Hamamci, Khan M. Iftekharuddin, Raj Jena, Nigel M. John, Ender Konukoglu, Darnial Lashkari, José Antonio Mariz, Raphael Meier, Sérgio Pereira, Doina Precup, Stephen J. Price, Tammy Riklin Raviv, Syed M. S. Reza, Michael T. Ryan, Duygu Sarikaya, Lawrence H. Schwartz, Hoo-Chang Shin, Jamie Shotton, Carlos A. Silva, Nuno J. Sousa, Nagesh K. Subbanna, Gábor Székely, Thomas J. Taylor, Owen M. Thomas, Nicholas J. Tustison, Gözde B. Ünal, Flor Vasseur, Max Wintermark, Dong Hye Ye, Liang Zhao, Binsheng Zhao, Darko Zikic, Marcel Prastawa, Mauricio Reyes, and Koen Van Leemput. The multimodal brain tumor image segmentation benchmark (BRATS). *IEEE Trans. Medical Imaging*, 34(10):1993–2024, 2015.

[MLW+18] Xingjun Ma, Bo Li, Yisen Wang, Sarah M. Erfani, Sudanthi N. R. Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E. Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In *6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings*, 2018.

[MMS+18] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In *6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings*, 2018.

[NLM19] Jianmo Ni, Jiacheng Li, and Julian J. McAuley. Justifying recommendations using distantly-labeled reviews and fine-grained aspects. In *Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference*.
ence on *Natural Language Processing*, EMNLP-IJCNLP 2019, Hong Kong, China, November 3-7, 2019, pages 188-197, 2019.

[NWC<sup>+</sup>11] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. In *NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011*, 2011.

[Pla00] John Platt. Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods. *Adv. Large Margin Classif.*, 10, 06 2000.

[PMB<sup>+</sup>22] M. Picot, F. Messina, M. Boudiaf, F. Labeau, I. Ben Ayed, and P. Piantanida. Adversarial robustness via fisher-rao regularization. *IEEE Transactions on Pattern Analysis & Machine Intelligence*, 2022.

[PSCvdH22] Guansong Pang, Chunhua Shen, Longbing Cao, and Anton van den Hengel. Deep learning for anomaly detection: A review. *ACM Comput. Surv.*, 54(2):38:1-38:38, 2022.

[Rud94] Daniel L. Ruderman. The statistics of natural images. *Network: Computation In Neural Systems*, 5:517-548, 1994.

[SHS19] David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generalization. In *IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019*, pages 6976-6987. Computer Vision Foundation / IEEE, 2019.

[SLSZ03] A. Srivastava, A. B. Lee, Eero P. Simoncelli, and S.-C. Zhu. On advances in statistical modeling of natural images. *J. Math. Imaging Vis.*, 18(1):17-33, 2003.

[SMB21] Adi Shamir, Odelia Melamed, and Oriel BenShmuel. The dimpled manifold model of adversarial examples in machine learning. *CoRR*, abs/2106.10151, 2021.
[SST<sup>+</sup>18] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett, editors, *Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada*, pages 5019–5031, 2018.

[SZS<sup>+</sup>14] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In *2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings*, 2014.

[TCBM20] Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Hugo Larochelle, Marc'Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, *Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual*, 2020.

[TG16] Thomas Tanay and Lewis D. Griffin. A boundary tilting perspective on the phenomenon of adversarial examples. *CoRR*, abs/1608.07690, 2016.

[TKP<sup>+</sup>18] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In *6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings*, 2018.

[TL21] Bayu Adhi Tama and Sung Hoon Lim. Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation. *Comput. Sci. Rev.*, 39:100357, 2021.
[Tsy08] Alexandre B. Tsybakov. *Introduction to Nonparametric Estimation*. Springer Publishing Company, Incorporated, 1st edition, 2008.

[Vap95] Vladimir Naumovich Vapni. *The Nature of Statistical Learning Theory*. Springer, 1995.

[vEH14] T. van Erven and P. Harremos. Rényi Divergence and Kullback-Leibler Divergence. *IEEE Transactions on Information Theory*, 60(7):3797-3820, 2014.

[VGO+20] Pauli Virtanen, Ralf Gommers, Travis E. Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, Stéfan J. van der Walt, Matthew Brett, Joshua Wilson, K. Jarrod Millman, Nikolay Mayorov, Andrew R. J. Nelson, Eric Jones, Robert Kern, Eric Larson, C J Carey, İlhan Polat, Yu Feng, Eric W. Moore, Jake VanderPlas, Denis Laxalde, Josef Perktold, Robert Cimrman, Ian Henriksen, E. A. Quintero, Charles R. Harris, Anne M. Archibald, Antônio H. Ribeiro, Fabian Pedregosa, Paul van Mulbregt, and SciPy 1.0 Contributors. SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python. *Nature Methods*, 17:261-272, 2020.

[VI20] Vladimir Vapnik and Rauf Izmailov. Complete statistical theory of learning: learning using statistical invariants. In *Proceedings of the Ninth Symposium on Conformal and Probabilistic Prediction and Applications*, volume 128, pages 4-40, 2020.

[vN28] John von Neumann. Zur theorie der gesellschaftsspiele. *Mathematische Annalen*, 100:295-320, 1928.

[WDS+20] Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of-the-art natural language processing. In *Proceedings of the 2020 Conference on Empir-
*ical Methods in Natural Language Processing: System Demonstrations*, pages 38–45, oct 2020.

[XEQ18] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In *25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018*. The Internet Society, 2018.

[XTG+20] Cihang Xie, Mingxing Tan, Boqing Gong, Alan L. Yuille, and Quoc V. Le. Smooth adversarial training. *CoRR*, abs/2006.14536, 2020.

[XYF+22] Jiancong Xiao, Liusha Yang, Yanbo Fan, Jue Wang, and Zhi-Quan Luo. Understanding adversarial robustness against on-manifold adversarial examples. *CoRR*, abs/2210.00430, 2022.

[YBTV21] Chengyuan Yao, Pavol Bielik, Petar Tsankov, and Martin Vechev. Automated discovery of adaptive attacks on adversarial defenses. *Advances in Neural Information Processing Systems*, 34:26858–26870, 2021.

[ZYJ+19] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In *International Conference on Machine Learning*, pages 1–11, 2019.
# Appendix to Chapter 3

## A.1 Proofs

The following section shows the proofs for Proposition (1), Proposition (2) and Inequalities (2.3).

### A.1.1 Proof of Proposition 1

We recall the definition of the total variation distance when applied to distributions $P, Q$ on a set $\mathcal{X} \subseteq \mathbb{R}^d$ and the Scheffé's identity, Lemma 2.1 in [Tsy08]:

$$ \|P - Q\|_{\text{TV}} \stackrel{\text{def}}{=} \sup_{\mathcal{A} \in \mathcal{B}^d} |P(\mathcal{A}) - Q(\mathcal{A})| = \frac{1}{2} \int |p_X(\mathbf{x}) - q_X(\mathbf{x})| d\mu(\mathbf{x}) \quad (A.1) $$

with respect to a base measure $\mu$, where $\mathcal{B}^d$ denotes the class of all Borel sets on $\mathbb{R}^d$.

First of all, we prove the equality for $\gamma = 1$. Let us denote with $\mathcal{A}^* \equiv \mathcal{A}(1)$ and $\mathcal{A}^{*c} \equiv \mathcal{A}^c(1)$ the optimal decision regions from (3.6). Let $\epsilon_0(\mathcal{A}^*)$ and $\epsilon_1(\mathcal{A}^{*c})$
be the Type-I and Type-II errors, respectively. Then,

$$
\begin{align*}
\epsilon_0(\mathcal{A}^*) + \epsilon_1(\mathcal{A}^{*c}) &= \int_{\mathcal{A}^*} p_{X|E}(\mathbf{x}|0)d\mathbf{x} + \int_{\mathcal{A}^{*c}} p_{X|E}(\mathbf{x}|1)d\mathbf{x} \\
&= \int_{\mathcal{A}^*} \min\{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\}d\mathbf{x} \\
&\quad + \int_{\mathcal{A}^{*c}} \min\{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\}d\mathbf{x} \\
&= \int_{\mathcal{X}} \min\{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\}d\mathbf{x} \\
&= 1 - \|p_{X|E=1} - p_{X|E=0}\|_{\text{TV}}, \tag{A.2}
\end{align*}
$$

where the last identity follows by applying Scheffé's identity (A.1). From the last identity in (A.2) and any decision region $\mathcal{A} \subseteq \mathcal{X}$, we have

$$
\begin{align*}
1 - \|p_{X|E=1} - p_{X|E=0}\|_{\text{TV}} &= \int_{\mathcal{X}} \min \{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\} d\mathbf{x} \\
&= \int_{\mathcal{A}} \min \{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\} d\mathbf{x} \\
&\quad + \int_{\mathcal{A}^c} \min \{p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1)\} d\mathbf{x} \\
&\le \int_{\mathcal{A}} p_{X|E}(\mathbf{x}|0) d\mathbf{x} + \int_{\mathcal{A}^c} p_{X|E}(\mathbf{x}|1) d\mathbf{x} \\
&= \epsilon_0(\mathcal{A}) + \epsilon_1(\mathcal{A}^c). \tag{A.3}
\end{align*}
$$

It remains to show the last statement related to the Bayesian error of the test.
Assume that $p_E(1) = p_E(0) = 1/2$. By using the last identity in (A.2), we have

$$
\begin{align*}
\frac{1}{2} \left[ 1 - \|p_{X|E=1} - p_{X|E=0}\|_{\text{TV}} \right] &= \frac{1}{2} \int_{\mathcal{X}} \min \left\{ p_{X|E}(\mathbf{x}|0), p_{X|E}(\mathbf{x}|1) \right\} d\mathbf{x} \\
&= \int_{\mathcal{X}} \min \left\{ p_{XE}(\mathbf{x}, E=0), p_{XE}(\mathbf{x}, E=1) \right\} d\mathbf{x} \\
&= \mathbb{E}_{X} \left[ \min \left\{ p_{E|X}(0|\mathbf{X}), p_{E|X}(1|\mathbf{X}) \right\} \right] \\
&= \frac{1}{2} \left[ \epsilon_0(\mathcal{A}^*) + \epsilon_1(\mathcal{A}^{*c}) \right] \\
&= \inf_{D} \Pr \{ D(\mathbf{X}) \neq E \}, \tag{A.4}
\end{align*}
$$

where the last identity follows by the definition of the decision regions in (3.6).
A.1.2 Proof of Proposition 2

We begin by showing that

$$
\begin{align*}
|\widehat{\mathrm{Pe}}(\mathbf{x}) - \mathrm{Pe}(\mathbf{x})| &= \left|\mathbb{E}[1[\hat{Y} \neq g_{\theta}(\mathbf{x})]|\mathbf{x}] - \mathbb{E}[1[Y \neq g_{\theta}(\mathbf{x})]|\mathbf{x}]\right| \\
&= \left|\sum_{\{y \in \mathcal{Y} \mid y \neq g_{\theta}(\mathbf{x})\}} \left[p_{\hat{Y}|X}(y|\mathbf{x}; \theta) - p_{Y|X}(y|\mathbf{x})\right]\right| \\
&\leq \sum_{\{y \in \mathcal{Y} \mid y \neq g_{\theta}(\mathbf{x})\}} \left|p_{\hat{Y}|X}(y|\mathbf{x}; \theta) - p_{Y|X}(y|\mathbf{x})\right| \\
&\leq \sum_{y \in \mathcal{Y}} \left|p_{\hat{Y}|X}(y|\mathbf{x}; \theta) - p_{Y|X}(y|\mathbf{x})\right| \\
&\leq 2 \left\|p_{\hat{Y}|X}(\cdot|\mathbf{x}; \theta) - p_{Y|X}(\cdot|\mathbf{x})\right\|_{\mathrm{TV}} \\
&\leq 2\sqrt{2\mathrm{KL}\left(p_{Y|\mathbf{x}}\|p_{\hat{Y}|\mathbf{x}}\right)}, \tag{A.5}
\end{align*}
$$

where $\|\cdot\|_{\text{TV}}$ denotes the *Total Variation distance*, $\text{KL}(\cdot\|\cdot)$ is the *Kullback-Leibler divergence* and the last step is due to *Pinsker's inequality*. On the other hand,

$$
\begin{align*}
1 - \hat{g}(\mathbf{x}) &= 1 - \sum_{y \in \mathcal{Y}} p_{\hat{Y}|X}^2(y|\mathbf{x}; \theta) \\
&= 1 - \mathbb{E}_{\hat{Y}|X} \left[ p_{\hat{Y}|X}(\hat{Y}|\mathbf{x}; \theta) | \mathbf{x} \right] \\
&\geq 1 - \mathbb{E}_{\hat{Y}|X} \left[ \max_{y \in \mathcal{Y}} p_{\hat{Y}|X}(y|\mathbf{x}; \theta) | \mathbf{x} \right] \\
&= 1 - \max_{y \in \mathcal{Y}} p_{\hat{Y}|X}(y|\mathbf{x}; \theta) \\
&\equiv \widehat{\mathrm{Pe}}(\mathbf{x}). \tag{A.6}
\end{align*}
$$

Similarly,

$$
\begin{align*}
\hat{g}(\mathbf{x}) &= \sum_{y \in \mathcal{Y}} p_{\hat{Y}|X}^2(y|\mathbf{x}; \theta) = p_{\hat{Y}|X}^2(y^*|\mathbf{x}; \theta) + \sum_{y \neq y^*} p_{\hat{Y}|X}^2(y|\mathbf{x}; \theta) \\
&\geq \max_{y \in \mathcal{Y}} p_{\hat{Y}|X}^2(y|\mathbf{x}; \theta) \\
&\equiv (1 - \widehat{\mathrm{Pe}}(\mathbf{x}))^2, \tag{A.7}
\end{align*}
$$
where $y^* = \arg \max_{y \in \mathcal{Y}} p_{\hat{Y}|X}(y|\mathbf{x}; \theta)$. By replacing expressions (A.6) and (A.7) in (A.5) we obtained the desired inequalities, which concludes the proof.

### A.1.3 Proof of Inequalities in (2.3)

The event can be decomposed as follows:

$$ \{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})|\mathbf{x}\} = \{Y \neq \hat{Y}\} \cap \{\{\hat{Y} = g_{\theta}(\mathbf{x})\} \text{ or } \{Y = g_{\theta}(\mathbf{x})\}|\mathbf{x}\} \quad (A.8) $$

for all $\mathbf{x} \in \mathcal{X}$. Thus,

$$ \{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})|\mathbf{x}\} \subseteq \{Y \neq \hat{Y}|\mathbf{x}\}, \quad (A.9) $$

$$ \{Y \neq \hat{Y}\} \cap \{Y \neq g_{\theta}(\mathbf{x})|\mathbf{x}\} \subseteq \{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})|\mathbf{x}\}, \quad (A.10) $$

$$ \{Y \neq \hat{Y}\} \cap \{\hat{Y} \neq g_{\theta}(\mathbf{x})|\mathbf{x}\} \subseteq \{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})|\mathbf{x}\}, \quad (A.11) $$

which imply

$$ \Pr(\{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})|\mathbf{x}\}) \leq \Pr(\{\hat{Y} \neq Y\}|\mathbf{x}), \quad (A.12) $$

$$ \mathrm{Pe}(\mathbf{x}) - \mathrm{Pr}(\{\hat{Y} = Y\}|\mathbf{x}) \leq \mathrm{Pr}(\{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})\}|\mathbf{x}), \quad (A.13) $$

$$ \widehat{\mathrm{Pe}}(\mathbf{x}) - \mathrm{Pr}(\{\hat{Y} = Y\}|\mathbf{x}) \leq \mathrm{Pr}(\{\hat{E}(\mathbf{x}) \neq E(\mathbf{x})\}|\mathbf{x}), \quad (A.14) $$

for all $\mathbf{x} \in \mathcal{X}$, where the last inequalities follows by noticing that $\mathrm{Pr}(\mathcal{A} \cap \mathcal{B}) \geq \mathrm{Pr}(\mathcal{A}) - \mathrm{Pr}(\mathcal{B}^c)$ for arbitrary measurable sets $\mathcal{A}, \mathcal{B} \subset \mathcal{X}$. This concludes the proof of these inequalities.

## A.2 Logistic Regression and Gaussian Model

Throughout this section we test DOCTOR in a controlled setting where all the involved distributions are known. We refer to that setting as *logistic regression and Gaussian model* since we collect data points from Gaussians distributions and we test on the logistic regression setup.

### A.2.1 Theoretical analysis

Let $\mathcal{X} = \mathbb{R}^d$ be the feature space and $\mathcal{Y} = \{-1, 1\}$ be the label space. We focus on a binary classification task in which $\mathbf{X} \sim \mathcal{N}(y\mu, \sigma^2I)$ and $Y \sim \mathcal{U}(\mathcal{Y})$, where
$\mu \in \mathbb{R}^n$ is the mean vector, $\sigma^2 > 0$ is the variance and $I$ is the identity matrix and $\mathcal{U}(\mathcal{Y})$ denotes the uniform distribution over $\mathcal{Y}$. For a fixed $\theta \in \mathbb{R}^d$, consider $f_\theta: \mathcal{X} \to \mathcal{Y}$ s.t. $f_\theta(\mathbf{x}) = \text{sign}(\text{sigmoid}(\mathbf{x}^T\theta) - 1/2)$. For a given $\mathbf{x} \in \mathcal{X}$, we adapt to the current setting the definition of $E(\mathbf{x})$ in Chapter 3 as follows:

$$1[Y \neq f_{\theta}(\mathbf{x})] = 1\left[Y \cdot \text{sign}\left(\text{sigmoid}(\mathbf{x}^{T}\theta) - \frac{1}{2}\right) < 0\right]. \quad (A.15)$$

Let us denote by $1[y \neq f_\theta(\mathbf{x})]$ the realization of the random variable $E(\mathbf{x})$. We can compute the probability of classification error $Pe(\mathbf{x})$ in (2.1) w.r.t. the true class posterior probabilities:

$$\begin{aligned}
\mathrm{Pe}(\mathbf{x}) &= \mathbb{E}[1[Y \neq f_{\theta}(\mathbf{x}) | \mathbf{x}]] = \sum_{y \in \mathcal{Y}} 1[y \neq f_{\theta}(\mathbf{x})] \cdot \frac{p_{\mathbf{x}|Y}(\mathbf{x}|y)P_Y(y)}{p_{\mathbf{x}}(\mathbf{x})} \\
&= \sum_{y \in \mathcal{Y}} 1[y \neq f_{\theta}(\mathbf{x})] \cdot \frac{\frac{1}{2}\mathcal{N}(\mathbf{x}; y\mu, \sigma^2I)}{\frac{1}{2}\sum_{y' \in \mathcal{Y}} \mathcal{N}(\mathbf{x}; y'\mu, \sigma^2I)} \\
&= \frac{\sum_{y \in \mathcal{Y}} 1[y \neq f_{\theta}(\mathbf{x})] \cdot \mathcal{N}(\mathbf{x}; y\mu, \sigma^2I)}{\sum_{y \in \mathcal{Y}} \mathcal{N}(\mathbf{x}; y\mu, \sigma^2I)}.
\end{aligned}
\quad (A.16)$$

Following (3.7), the decision region corresponding to the most powerful discriminator for the logistic regression and the Gaussian model are given by

$$\mathcal{A}(\gamma) = \left\{ \mathbf{x} \in \mathcal{X} : \frac{\sum_{y \in \mathcal{Y}} 1[y \neq f_{\theta}(\mathbf{x})] \cdot \mathcal{N}(\mathbf{x}, y\mu, \sigma^2I)}{\sum_{y \in \mathcal{Y}} 1[y = f_{\theta}(\mathbf{x})] \cdot \mathcal{N}(\mathbf{x}, y\mu, \sigma^2I)} > \gamma \right\}. \quad (A.17)$$

We are now able to state the optimal discriminator for this setting.

**Definition 4** (Optimal discriminator for the logistic regression and the Gaussian model). For any $0 < \gamma < \infty$ and $\mathbf{x} \in \mathcal{X}$, the optimal discriminator follows as:

$$D^*(\mathbf{x}, \gamma) \stackrel{\text{def}}{=} 1\left[\sum_{y \in \mathcal{Y}} 1[y \neq f_{\theta}(\mathbf{x})] \cdot \mathcal{N}(\mathbf{x}, y\mu, \sigma^2I) > \gamma \cdot \sum_{y \in \mathcal{Y}} 1[y = f_{\theta}(\mathbf{x})] \cdot \mathcal{N}(\mathbf{x}, y\mu, \sigma^2I)\right]. \quad (A.18)$$

Since we cannot analytically evaluate Proposition 1, we proceed numerically in the next experiment.
## A.2.2 Experiments

In this section, we will numerically evaluate Proposition 1 via empirical estimates of Type-I and Type-II errors in expressions Eq. (3.2). Note that unlike Section 3.4, in this case, all the involved distributions are known, and hence it is also possible to compute the true posterior distribution $p_{Y|X}$.

We adopt the same notation as in Section 3.1.2 for DOCTOR, i.e., $D_\alpha$, and $D_\beta$ according to according to expressions Eq. (3.11). $D^*$, as in Definition 4, denotes the optimal discriminator.

### Experimental setup and evaluation metrics

**Dataset.** We create a synthetic dataset that consists of 5000 data points drawn from $N_0 \stackrel{\text{def}}{=} N(\mu_0, \sigma^2 I)$ and 5000 data points drawn from $N_1 \stackrel{\text{def}}{=} N(\mu_1, \sigma^2 I)$, where $\mu_0 = [-1 \ -1]$, $\mu_1 = [1 \ 1]$. We consider two values for $\sigma$, namely $\sigma = 2$ and $\sigma = 4$. These values produce two different distributions which will let

us showcase the advantages of DOCTOR. To each data point $\mathbf{x}$ is assigned as class 0 or 1 depending on whether $\mathbf{x} \sim N_0$ or $\mathbf{x} \sim N_1$, respectively. The aforementioned dataset is divided into a training set, i.e. $D_n = \{(\mathbf{x}_1, y_1), \dots, (\mathbf{x}_n, y_n)\}$ where $n = 6700$, and a testing set, i.e. $T_m = \{(\mathbf{x}_{n+1}, y_{n+1}), \dots, (\mathbf{x}_{n+m}, y_{n+m})\}$ where $m = 3300$.

**Training configuration.** We use a linear classifier, with one hidden layer, sigmoid activation function and binary cross entropy loss. The neural network is trained with gradient descent considering learning rate $r = 0.1$. Specifically, we train our network for 5 epochs. We randomly split our dataset 8 times, each time keeping $n$ samples to train, and $m$ to test. We consider the same model

<table><caption>**Table A.1: Accuracy on the test set:** $f_{\theta_i}$ for $i = 1, \dots, 8$ represents the $i$-th model in $\mathcal{F}$, $f_{\text{avg}}$ is the arithmetic mean of the accuracy over each $f_{\theta_i} \in \mathcal{F}$. The value $f_{\text{avg}}^*$ represents the accuracy Bayesian classifier averaged on the test set corresponding to the 8 splits. We show results for both standard deviations, namely $\sigma = 2$ and $\sigma = 4$.</caption><thead><tr><th rowspan="2">CLASSIFIER</th><th colspan="2">ACCURACY%</th></tr><tr><th>σ = 2</th><th>σ = 4</th></tr></thead><tbody><tr><td>f<sub>θ<sub>1</sub></sub></td><td>82</td><td>65</td></tr><tr><td>f<sub>θ<sub>2</sub></sub></td><td>83</td><td>77</td></tr><tr><td>f<sub>θ<sub>3</sub></sub></td><td>82</td><td>77</td></tr><tr><td>f<sub>θ<sub>4</sub></sub></td><td>82</td><td>76</td></tr><tr><td>f<sub>θ<sub>5</sub></sub></td><td>83</td><td>76</td></tr><tr><td>f<sub>θ<sub>6</sub></sub></td><td>81</td><td>66</td></tr><tr><td>f<sub>θ<sub>7</sub></sub></td><td>82</td><td>76</td></tr><tr><td>f<sub>θ<sub>8</sub></sub></td><td>83</td><td>83</td></tr><tr><td>f<sub>avg</sub></td><td>82</td><td>74</td></tr><tr><td>f<sub>avg</sub><sup>*</sup></td><td>83</td><td>78</td></tr></tbody></table>
architecture (described above) for each split and we come up with 8 different binary discriminators $\mathcal{F} = \{f_{\theta_1}, \dots, f_{\theta_8}\}$.

Since in this example all the involved distributions are known, we compute the optimal predictor, i.e., the Bayes classifier, and we denote it with $f^*$. The value $f_{\text{avg}}^*$ reported in Table A.1, represents its accuracy averaged on the test set corresponding to the 8 splits.

**Accuracy of trained networks.** In Table A.1 the accuracy of $f^*$ and the models in $\mathcal{F}$ on the test set.

**Evaluation metric.** We consider the same metric as in Section 3.4.2.

## Numerical evaluation of Proposition 1

To evaluate Proposition 1 we proceed in a Monte Carlo fashion by computing Type-I and Type-II errors for each of the networks in $\mathcal{F}$ and then averaging over the results. Schematically, consider any $f_{\theta_i} \in \mathcal{F}$ and $\gamma = 1$, we compute:

1. $\mathcal{A}_i \stackrel{\text{def}}{=} \mathcal{A}_i(1)$ as defined in Eq. (A.17) and its complement $\mathcal{A}_i^c$.

2. For each classifier $f_{\theta_i} \in \mathcal{F}$, $\mathcal{T}_{E=1;\theta_i} \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_m | y \neq f_{\theta_i}(\mathbf{x})\}$ represents the set of mis-classified test samples, and $\mathcal{T}_{E=0;\theta_i} \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_m | y = f_{\theta_i}(\mathbf{x})\}$ is the set of correctly classified test samples.

3. $\mathcal{FR}_i \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_{E=0;\theta_i} : \mathbf{x} \in \mathcal{A}_i\}$, $\mathcal{TR}_i \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_{E=1;\theta_i} : \mathbf{x} \in \mathcal{A}_i\}$, $\mathcal{FA}_i \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_{E=1;\theta_i} : \mathbf{x} \in \mathcal{A}_i^c\}$ and $\mathcal{TA}_i \stackrel{\text{def}}{=} \{(\mathbf{x}, y) \in \mathcal{T}_{E=0;\theta_i} : \mathbf{x} \in \mathcal{A}_i^c\}$, i.e. the set of false rejections, true rejections, false acceptances and true acceptance, respectively.

4. $\epsilon_0(\mathcal{A}_i) \stackrel{\text{def}}{=} \frac{|\mathcal{FR}_i|}{|\mathcal{T}_{E=0;\theta_i}|}$ and $\epsilon_1(\mathcal{A}_i^c) \stackrel{\text{def}}{=} \frac{|\mathcal{FA}_i|}{|\mathcal{T}_{E=1;\theta_i}|}$, i.e. Type-I and Type-II errors.

At the end of $|\mathcal{F}|$ iterations, we empirically estimate Type-I and Type-II errors of Proposition 1 as follows

$$ \epsilon_0(\mathcal{A}) \approx \frac{1}{|\mathcal{F}|} \sum_{i=1}^{|\mathcal{F}|} \epsilon_0(\mathcal{A}_i) = 0.0607 \quad \text{and} \quad \epsilon_1(\mathcal{A}^c) \approx \frac{1}{|\mathcal{F}|} \sum_{i=1}^{|\mathcal{F}|} \epsilon_1(\mathcal{A}_i^c) = 0.7389. $$

## FRR versus TRR

We present the experimental results obtained by running experiments similar to those described in Section 3.4 considering the experimental setup in A.2.2 in TBB.
<table><caption>**Table A.2: AUROCs:** the values for $D_\alpha$, $D_\beta$, SR, and ODIN correspond to the results for the thick lines in Fig. A.1. $D^*$ and $ODIN^* \equiv SR^*$ are obtained using $p_{Y|X}$.</caption><thead><tr><th rowspan="2">σ</th><th colspan="5">AUROC %</th></tr><tr><th>D<sup>*</sup></th><th>D<sub>α</sub></th><th>D<sub>β</sub></th><th>SR ≡ ODIN</th><th>SR<sup>*</sup> ≡ ODIN<sup>*</sup></th></tr></thead><tbody><tr><td>2</td><td><b>76</b></td><td>70</td><td>70</td><td>70</td><td>76</td></tr><tr><td>4</td><td><b>79</b></td><td>78</td><td>78</td><td>70</td><td>76</td></tr></tbody></table>

In addition to the usual discriminators, we will consider the optimal discriminator $D^*$, as in Definition 4.

**DOCTOR: comparison between $D^*$, $D_\alpha$ and $D_\beta$.** Let us present the result obtained with DOCTOR showing how $D^*$, Eq. (A.18), works compared to $D_\alpha$ and $D_\beta$ in Eq. (3.11) when they have to decide whether to trust or not the decision made by a classifier. We test the discriminators on the dataset constructed as in Appendix A.2.2 by considering $\sigma = 2$. Let us analyze Fig. A.1a: we apply each discriminator to all the classifiers in $\mathcal{F}$. The colored areas represent the obtained ROCs. Inside each area, the mean ROC is represented by the thick line. $D_\alpha$ and $D_\beta$ reach the same results as the colored areas, and the thick lines are overlapped. For a given $\mathbf{x} \in \mathcal{X}$, we recall that $D^*$ uses $\text{Pe}(\mathbf{x})$ Eq. (2.1) whilst $D_\alpha$ and $D_\beta$ uses $1 - \hat{\text{g}}(\mathbf{x})$ Eq. (3.8) and $\hat{\text{Pe}}(\mathbf{x})$ Eq. (2.2), respectively. $D^*$ always outperforms both $D_\alpha$ and $D_\beta$ since it relies on the probability of classification error based on $p_{Y|X}$ while $D_\alpha$ and $D_\beta$ use $p_{\hat{Y}|X}$.

**Comparison between $D^*$, $D_\alpha$, ODIN and SR.** We conclude this section by investigating how our competitors, namely ODIN and SR, work in this setting.

From now on, we will put $ODIN \equiv SR$ to mean that the two methods coincide (remember we set $T = 1$ and $\epsilon = 0$ for all the simulations). We show the results of the comparison in Fig. A.1: Fig. A.1b considers data points from $\mathcal{N}(y\mu, 2^2I)$ whilst Fig. A.1c consider data points from $\mathcal{N}(y\mu, 4^2I)$. If in Fig. A.1b we cannot see an advantage in using $D_\alpha$ in place of SR, the situation is totally different in Fig. A.1c, where $D^*$ and $D_\alpha$ clearly outperform the competitors. We would like to recall that DOCTOR uses all the softmax output while SR only uses the maximum value of the softmax output.
<figure><img src="image_19.png" /><figcaption>**Figure A.1:** ROC curves for $D^*$, $D_\alpha$ and $D_\beta$, respectively. We denote by SR\* the softmax response method based on $p_{Y|X}$. Since in this case $T = 1$ and $\epsilon = 0$, SR $\equiv$ ODIN as well as SR\* $\equiv$ ODIN\*. (a) We apply each discriminator to all the classifiers in $\mathcal{F}$. The obtained ROCs are represented by the colored areas. Inside each area the mean ROC is represented by the thick line. Orange and red areas completely overlap as well as the mean ROC. $D^*$ always outperforms both $D_\alpha$ and $D_\beta$ as expected. In (b) $D^*$ and SR\* overlap (as also $D_\alpha$ and SR), instead in (c) where $\sigma = 4$ SR discards useful information and indeed both $D^*$ and $D_\alpha$ outperform SR.</figcaption></figure>

# A.3 Supplementary Results of Section 3.4

## A.3.1 Experimental environment

We run each experiment on a machine equipped with an Intel(R) Xeon(R) CPU E5-2623 v4, 2.60GHz clock frequency, and a GeForce GTX 1080 Ti GPU. The execution time for the execution the tests are the following (interval size 10000):

TBB. $D_\alpha$: 12.5 s. $D_\beta$: 13.6 s. SR: 15.9 s. MHLNB: 15.9 s.

PBB: $D_\alpha$: 13 s. $D_\beta$: 25.7 s. ODIN: 14.7 s. MHLNB: 32.22 s.

## A.3.2 On the input pre-processing in DOCTOR

In the following we further study DOCTOR-specific input pre-processing techniques allowed under PBB. We focus on $D_\beta$ since for $D_\alpha$ the reasoning is the same. Formally, let $\mathbf{x}_0 \in \mathcal{X}$ be a testing sample. We are looking for the minimum way to perturb the input such that the discriminator value at $\mathbf{x}_0$ is increased:

$$r^* = \min_{r \text{ s.t. } \|r\|_\infty \le \epsilon} -\log \left( \frac{\hat{\mathrm{Pe}}(\mathbf{x}_0 + r)}{1 - \hat{\mathrm{Pe}}(\mathbf{x}_0 + r)} \right),$$
or equivalently, we are looking to the sample $\tilde{\mathbf{x}}_0^\beta$ in the $\epsilon$-ball around $\mathbf{x}_0$ which
maximize the discriminator value at $\tilde{\mathbf{x}}_0^\beta$:

$$
\tilde{\mathbf{x}}_0^\beta = \mathbf{x}_0 - \epsilon \times \mathrm{sign} \left[ -\nabla_{\mathbf{x}_0} \log \left( \frac{\hat{\mathrm{Pe}}(\mathbf{x}_0)}{1 - \hat{\mathrm{Pe}}(\mathbf{x}_0)} \right) \right].
$$

Note that, because of Eq. (2.1)

$$
\begin{align*}
- \log \left( \frac{\hat{\mathrm{Pe}}(\mathbf{x}_0)}{1 - \hat{\mathrm{Pe}}(\mathbf{x}_0)} \right) &= - \log \left( \frac{1 - p_{\hat{Y}|X}(g_{\theta}(\mathbf{x}_0) | \mathbf{x}_0; \theta)}{p_{\hat{Y}|X}(g_{\theta}(\mathbf{x}_0) | \mathbf{x}_0; \theta)} \right) \\
&= - \log(1 - p_{\hat{Y}|X}(g_{\theta}(\mathbf{x}_0) | \mathbf{x}_0; \theta)) + \log(p_{\hat{Y}|X}(g_{\theta}(\mathbf{x}_0) | \mathbf{x}_0; \theta)) \\
&= - \log(1 - p_{\hat{Y}|X}(g_{\theta}(\mathbf{x}_0) | \mathbf{x}_0; \theta)) - \log \mathrm{SODIN}(\mathbf{x}_0).
\end{align*}
$$

A.3.3 On the effect the intervals considered for γ, δ and ζ have on the
AUROC computation

Let us consider the AUROC as a performance measure for the discriminators. The computation of the AUROC of $D_\alpha$, as well as those of ODIN and SR, heavily depend on the choice of the range values for the decision region thresholds. In the following paragraph, we will discuss how we chose these ranges, namely $\gamma \in \Gamma_{D_\alpha \text{ or } D_\beta} \subseteq \mathbb{R}$, $\delta \in \Delta_{\text{ODIN or SR}} \subseteq [0, 1]$ and $\zeta \in Z_{\text{MHLNB}} \subseteq \mathbb{R}$. In the experiments of Section 3.4, we therefore proceed by fixing the aforementioned ranges as follows:

$$
\Gamma_{D_{\alpha}} \stackrel{\text{def}}{=} \left[ \min_{(\mathbf{x},y) \in \mathcal{T}_m} \frac{1 - \hat{g}(\mathbf{x})}{\hat{g}(\mathbf{x})}, \max_{(\mathbf{x},y) \in \mathcal{T}_m} \frac{1 - \hat{g}(\mathbf{x})}{\hat{g}(\mathbf{x})} \right], \quad (A.19)
$$

$$
\Gamma_{D_{\beta}} \stackrel{\text{def}}{=} \left[ \min_{(\mathbf{x},y) \in \mathcal{T}_m} \frac{\hat{\mathrm{Pe}}(\mathbf{x})}{1 - \hat{\mathrm{Pe}}(\mathbf{x})}, \max_{(\mathbf{x},y) \in \mathcal{T}_m} \frac{\hat{\mathrm{Pe}}(\mathbf{x})}{1 - \hat{\mathrm{Pe}}(\mathbf{x})} \right], \quad (A.20)
$$

$$
\Delta_{\text{ODIN}} \stackrel{\text{def}}{=} \left[ \min_{(\mathbf{x},y) \in \mathcal{T}_m} \text{SODIN}(\mathbf{x}), \max_{(\mathbf{x},y) \in \mathcal{T}_m} \text{SODIN}(\mathbf{x}) \right], \quad (A.21)
$$

$$
\Delta_{\text{SR}} \stackrel{\text{def}}{=} \left[ \min_{(\mathbf{x},y) \in \mathcal{T}_m} \text{SR}(\mathbf{x}), \max_{(\mathbf{x},y) \in \mathcal{T}_m} \text{SR}(\mathbf{x}) \right], \quad (A.22)
$$

$$
Z_{\text{MHLNB}} \stackrel{\text{def}}{=} \left[ \min_{(\mathbf{x},y) \in \mathcal{T}_m} \text{M}(\mathbf{x}), \max_{(\mathbf{x},y) \in \mathcal{T}_m} \text{M}(\mathbf{x}) \right]. \quad (A.23)
$$

Secondly, we fix the number of values to consider in $\Gamma_{D_\alpha}$ or $D_\beta$, $\Delta_{\text{ODIN or SR}}$ and $Z_{\text{MHLNB}}$: we test the AUROCs for CIFAR10 for different values of the size of
<table><caption>**Table A.3:** The effects of varying the number of thresholds. AUROCs and FRR at 95% TRR obtained via $D_\alpha$, $D_\beta$, ODIN, SR and MHLNB for CIFAR10 considering different size for $\Gamma_{D_\alpha}$ or $D_\beta$, $\Delta_{ODIN}$ or SR and $Z_{MHLNB}$ in both TBB and PBB. The column INTERVAL SIZE represents the number of equidistant values considered in the sets defined in (A.19), (A.20), (A.21), (A.22) and in (A.23), respectively.</caption><thead><tr><th rowspan="2">INTERVAL SIZE</th><th rowspan="2">METHOD</th><th colspan="2">TBB</th><th colspan="2">PBB</th></tr><tr><th>AUROC</th><th>FRR (95% TRR)</th><th>AUROC</th><th>FRR (95% TRR)</th></tr></thead><tbody><tr><td rowspan="5">10</td><td>$D_\alpha$</td><td>69.8</td><td>91.6</td><td>77.4</td><td>88.4</td></tr><tr><td>$D_\beta$</td><td>50</td><td>69.7</td><td>79.8</td><td>86.2</td></tr><tr><td>ODIN</td><td>75.7</td><td>89.3</td><td>81.4</td><td>85.4</td></tr><tr><td>SR</td><td>75.7</td><td>89.3</td><td>-</td><td>-</td></tr><tr><td>MHLNB</td><td>76.6</td><td>88.8</td><td>83.2</td><td>47.1</td></tr><tr><td rowspan="5">100</td><td>$D_\alpha$</td><td>85.1</td><td>80.6</td><td>92.5</td><td>42.6</td></tr><tr><td>$D_\beta$</td><td>61.8</td><td>63.4</td><td>94.1</td><td>13.8</td></tr><tr><td>ODIN</td><td>88</td><td>73.5</td><td>91.5</td><td>49.9</td></tr><tr><td>SR</td><td>88</td><td>73.5</td><td>-</td><td>-</td></tr><tr><td>MHLNB</td><td>88.3</td><td>72.6</td><td>84.4</td><td>44.6</td></tr><tr><td rowspan="5">1000</td><td>$D_\alpha$</td><td>91.3</td><td>53.1</td><td>94.7</td><td>13.8</td></tr><tr><td>$D_\beta$</td><td>66.5</td><td>48.3</td><td>94.8</td><td>13.4</td></tr><tr><td>ODIN</td><td>92.5</td><td>28.9</td><td>94</td><td>18.3</td></tr><tr><td>SR</td><td>92.5</td><td>28.9</td><td>-</td><td>-</td></tr><tr><td>MHLNB</td><td>92.2</td><td>35.3</td><td>84.4</td><td>44.5</td></tr><tr><td rowspan="5">10000</td><td>$D_\alpha$</td><td>93.7</td><td>18.4</td><td>95.2</td><td>13.9</td></tr><tr><td>$D_\beta$</td><td>68.5</td><td>18.6</td><td>94.8</td><td>13.4</td></tr><tr><td>ODIN</td><td>93.9</td><td>18</td><td>94.2</td><td>18.4</td></tr><tr><td>SR</td><td>93.9</td><td>18</td><td>-</td><td>-</td></tr><tr><td>MHLNB</td><td>92.1</td><td>31</td><td>84.4</td><td>44.6</td></tr></tbody></table>

$\Gamma_{D_\alpha}$ or $D_\beta$, $\Delta_{ODIN}$ or SR and $Z_{MHLNB}$ in both TBB and PBB scenarios. The results are collected in Table A.3. Let us denote by $I$ a generic interval between the ones of Eq. (A.19), Eq. (A.20), Eq. (A.21), Eq. (A.22) and Eq. (A.23), throughout the experiments we set the size of $I$ to $(\max I - \min I) * 10000$.

### A.3.4 Additional plots and results

In the next sections, we show graphically the set of results obtained from the experiments in Section 3.4.3. We first specify the range of values for the parameters $T$ and $\epsilon$ considered throughout the experiments. For temperature scaling, $T$ is selected among $\{1, 1.1, 1.2, 1.3, 1.4, 1.5, 2, 2.5, 3, 100, 1000\}$, whilst for input pre-processing, $\epsilon$ is selected among $\{0, .0002, .00025, .0003, .00035, .0004, .0006, .0008, .001, .0012, .0014, .0016, .0018, .002, .0022, .0024, .0026, .0028, .003, .0032, .0034, .0036, .0038, .004\}$.
<figure><img src="image_20.png" /><figcaption>**Figure A.2: The effect of varying T and ϵ.** Comparison of AUROCs obtained via $D_{\alpha}$ (in green) and via $D_{\beta}$ (in orange) for different values of T and ϵ.</figcaption></figure>

## Comparison $D_{\alpha}$ and $D_{\beta}$

We include the plots for DOCTOR: comparison between $D_{\alpha}$ and $D_{\beta}$ (Section 3.4.3). In Fig. A.2a, Fig. A.2d, Fig. A.2g and Fig. A.2j, we set $\epsilon$ at its best value which is found to coincide in the case of $D_{\alpha}$ and $D_{\beta}$. In Fig. A.2b, Fig. A.2e, Fig. A.2h and Fig. A.2k we do the opposite and we set T to its best value w.r.t. $D_{\alpha}$ whilst in Fig. A.2c, Fig. A.2f, Fig. A.2i and Fig. A.2l, the value of T is chosen w.r.t. the best value for $D_{\beta}$.

## Comparison $D_{\alpha}$, $D_{\beta}$, ODIN and MHLNB

We conclude by showing in Fig. A.3 the test results obtained by varying T and $\epsilon$ in PBB for all the methods. We present 4 groups of plots (one for each image dataset) and in each plot we pick T from {1, 1.3, 1.5, 1000} (the values selected for $D_{\alpha}$, $D_{\beta}$, ODIN and MHLNB Table 3.1) and we let $\epsilon$ vary.
<figure><img src="image_21.png" /><figcaption>Figure A.3: Overall results when varying *T* and *ϵ*.</figcaption></figure>

## Misclassification detection in presence of out-of-distribution samples

We include in Table A.7 the results of all the simulations carried out for detecting misclassification detection in presence of out-of-distribution samples. The experimental setting is reported in Section 3.4.2.

### A.3.5 DOCTOR for pure OOD detection

It is worth emphasizing that DOCTOR is not targeting OOD detection, which is a rather different problem from the one investigated in this paper. So we did not optimize an ad-hoc input perturbation for DOCTOR within the OOD detection setup, i.e. we kept the same input perturbation proposed for the misclassification
detection task. The baseline results reported in Table A.4 show that DOCTOR is competitive for OOD detection as well since it can reach similar scores or even outperform the baseline (e.g., the simulations with LSUN (CROP) show an improvement of the results of 3.3% in terms of FRR %). We indicate the methods together with their parameter setting. ODINOOD denotes the same parameter setting as in [LLS18].

<table><caption>**Table A.4: DOCTOR for pure OOD detection.** We set : $\epsilon_\alpha = 0$ and $T_\alpha = 15$, $\epsilon_\beta = 0$ and $T_\beta = 1000$, as in [LLS18] for ODINOOD. The baseline results reported below show that DOCTOR is competitive for OOD detection as well since it can reach similar scores or even outperform the baseline.</caption><thead><tr><th rowspan="2">DATASET-<br>IN</th><th rowspan="2">DATASET-<br>OUT</th><th colspan="3">AUROC %</th><th colspan="3">FRR % (95 % TRR)</th></tr><tr><th>D<sub>α</sub></th><th>D<sub>β</sub></th><th>ODIN<sub>OOD</sub></th><th>D<sub>α</sub></th><th>D<sub>β</sub></th><th>ODIN<sub>OOD</sub></th></tr></thead><tbody><tr><td rowspan="4">CIFAR10</td><td>LSUN</td><td>98.1</td><td>97.9</td><td><strong>98.8</strong></td><td>8</td><td>9.1</td><td><strong>6.3</strong></td></tr><tr><td>TINY (RES)</td><td>97.6</td><td>97.3</td><td><strong>98.5</strong></td><td>9.9</td><td>11.2</td><td><strong>7.2</strong></td></tr><tr><td>LSUN (CROP)</td><td><strong>98.6</strong></td><td>98.2</td><td>98.2</td><td><strong>5.4</strong></td><td>6.9</td><td>8.7</td></tr><tr><td>TINY (CROP)</td><td>98.9</td><td>98.5</td><td><strong>99.1</strong></td><td>4.6</td><td>6.4</td><td><strong>4.3</strong></td></tr></tbody></table>

### DOCTOR in presence of OOD samples that are similar to in-distribution ones

We tested DOCTOR in pure OOD setting, considering CIFAR100 as in-distribution and CIFAR10 as out-distribution. The results below show that DOCTOR optimized as in the following paper outperforms ODIN (optimized as described in [LLS18]) and ENERGY. This is particularly promising as it shows that DOCTOR, without performing any training and without been particularly optimized for OOD detection, can perform well on a wider variety of problems.

### A.3.6 Some observations on the white-box scenario (WB)

It is worth clarifying the results in Table A.6 to motivate the performance obtained using the Mahalanobis-based discriminator (MHLNB - WB) for the misclassification detection problem and the issues it raises. First of all, we emphasize that given a network and an input sample DOCTOR only needs to access the logits
<table><caption>**Table A.5: DOCTOR for OOD detection of samples similar to the in-distribution ones.** Comparison of $D_\alpha$ with ENERGY and ODIN (parameter setting as in [LLS18]).</caption><thead><tr><th>DATASET-IN</th><th>DATASET-OUT</th><th>METHODS</th><th>AUROC %</th><th>FRR % (95 % TRR)</th></tr></thead><tbody><tr><td rowspan="3">CIFAR100</td><td rowspan="3">CIFAR10</td><td>$D_\alpha$ (PBB)</td><td>76.8</td><td>64.2</td></tr><tr><td>ENERGY</td><td>73.3</td><td>76.4</td></tr><tr><td>ODIN (OOD)</td><td>70.5</td><td>79.5</td></tr></tbody></table>

<table><caption>**Table A.6: White-box setting.** Comparison of MHLNB (WB) and $D_\alpha$ (PBB).</caption><thead><tr><th>DATASET-IN</th><th>METHODS</th><th>AUROC %</th><th>FRR % (95 % TRR)</th></tr></thead><tbody><tr><td rowspan="2">CIFAR10</td><td>$D_\alpha$ (PBB)</td><td>95.2</td><td>13.9</td></tr><tr><td>MHLNB (WB)</td><td>49.5</td><td>97.3</td></tr><tr><td rowspan="2">CIFAR100</td><td>$D_\alpha$ (PBB)</td><td>88.2</td><td>35.7</td></tr><tr><td>MHLNB (WB)</td><td>51.6</td><td>94.9</td></tr></tbody></table>

output of the network in order to perform the detection. On the contrary, the detector based on Mahalanobis distance consists of 3 steps:

* Estimation of the class mean and covariance matrix;

* Features extraction according to the Mahalanobis score function;

* Aggregation of the scores obtained layer by layer in order to obtain a decision a rule for the discriminator.

Clearly, the Mahalanobis distance-based method requires additional samples compared to DOCTOR. Although estimating the mean and the covariance matrix is possible by exploiting samples from the benchmark training set (e.g. CIFAR10, CIFAR100, ...), this method still needs additional (different from training) samples for learning the linear regressor intended to distinguish between correctly (positive) and incorrectly (negative) classified samples. In order to generate the negative samples, we consider the use of adversarial examples generated through Projected Gradient Descent Attack (magnitude of the perturbation 0.0031), which does not assume any knowledge about the test set.
<table><caption>Table A.7: Misclassification detection in presence of OOD samples: overall results. In PBB we set $\epsilon_\alpha = 0.00035$ and $T_\alpha = 1$, $\epsilon_\beta = 0.00035$ and $T_\beta = 1.5$, $\epsilon_{ODIN} = 0$ and $T_{ODIN} = 1.3$. By ODIN<sub>ood</sub>, we mean ODIN with the parameter setting as in [LLS18]. Since we proceed in a Monte Carlo fashion, the results are reported in terms of mean / standard deviation. In TBB for by ODIN we report the results of SR, since both methods coincide when $T = 1$ and $\epsilon = 0$.</caption><thead><tr><th rowspan="2">DATASET (IN)</th><th rowspan="2">DATASET (OUT)</th><th rowspan="2">SCENARIO</th><th colspan="4">AUROC %</th><th colspan="4">FRR % (95 % TRR)</th></tr><tr><th>D<sub>a</sub></th><th>D<sub>b</sub></th><th>ODIN</th><th>ODIN<sub>ood</sub></th><th>D<sub>a</sub></th><th>D<sub>b</sub></th><th>ODIN</th><th>ODIN<sub>ood</sub></th></tr></thead><tbody><tr><td rowspan="10">CIFAR10<br>♠</td><td rowspan="5">iSUN</td><td>PBB</td><td>95.4 / 0.1</td><td>95.1 / 0.1</td><td>94.6 / 0.1</td><td>89.6 / 0</td><td>14 / 0.5</td><td>13.5 / 0.4</td><td>17.2 / 0.3</td><td>38.9 / 0</td></tr><tr><td>TBB</td><td>94.6 / 0</td><td>69.3 / 0.1</td><td>94.5 / 0.1</td><td>-</td><td>17.7 / 0.1</td><td>17.7 / 0.1</td><td>17.7 / 0</td><td>-</td></tr><tr><td>LSUN</td><td>95.5 / 0.1</td><td>95.1 / 0</td><td>94.7 / 0</td><td>92.6 / 0</td><td>13.1 / 0.5</td><td>13 / 0.2</td><td>17.3 / 0</td><td>31.9 / 0.1</td></tr><tr><td>(CROP)</td><td>94.4 / 0.1</td><td>69.2 / 0.1</td><td>94.4 / 0</td><td>-</td><td>17.6 / 0.2</td><td>17.6 / 0.2</td><td>17.7 / 0.2</td><td>-</td></tr><tr><td>(RESIZE)</td><td>95.4 / 0.1</td><td>95.1 / 0</td><td>94.8 / 0</td><td>89.6 / 0</td><td>13.4 / 0.6</td><td>13.2 / 0.3</td><td>17 / 0.3</td><td>38.9 / 0</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>94.6 / 0</td><td>69.4 / 0.1</td><td>94.6 / 0</td><td>-</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>-</td></tr><tr><td>TBB</td><td>95.4 / 0</td><td>95.1 / 0.1</td><td>94.7 / 0</td><td>89.6 / 0</td><td>13.4 / 0.4</td><td>13 / 0.2</td><td>17.2 / 0.3</td><td>38.9 / 0</td></tr><tr><td>(CROP)</td><td>94.6 / 0</td><td>69.4 / 0.1</td><td>94.6 / 0</td><td>-</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>-</td></tr><tr><td>TBB</td><td>95.2 / 0.1</td><td>94.9 / 0</td><td>94.6 / 0.1</td><td>89.6 / 0</td><td>14 / 0.4</td><td>14 / 0.5</td><td>17.8 / 0.4</td><td>38.9 / 0</td></tr><tr><td>(RES)</td><td>94.4 / 0.1</td><td>69.2 / 0</td><td>94.4 / 0</td><td>-</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>17.8 / 0.1</td><td>-</td></tr><tr><td rowspan="10">CIFAR100<br>♠</td><td rowspan="5">iSUN</td><td>PBB</td><td>86.5 / 0.2</td><td>85.8 / 0</td><td>85.6 / 0.2</td><td>79 / 0.1</td><td>45.3 / 1</td><td>46.1 / 0.5</td><td>46.8 / 1</td><td>65.9 / 0.4</td></tr><tr><td>TBB</td><td>85.6 / 0.1</td><td>82.7 / 0.1</td><td>85.5 / 0.1</td><td>-</td><td>46.9 / 0.4</td><td>46.8 / 0.4</td><td>46.8 / 0.4</td><td>-</td></tr><tr><td>LSUN</td><td>89.1 / 0</td><td>88.5 / 0.1</td><td>88 / 0.1</td><td>80.6 / 0</td><td>35.6 / 0.4</td><td>35.7 / 0.2</td><td>39.9 / 0.3</td><td>65.1 / 0</td></tr><tr><td>(CROP)</td><td>87.9 / 0.1</td><td>84.9 / 0.1</td><td>87.7 / 0.1</td><td>-</td><td>39.8 / 0.6</td><td>39.8 / 0.6</td><td>39.8 / 0.6</td><td>-</td></tr><tr><td>(RESIZE)</td><td>86.8 / 0.1</td><td>86.2 / 0.1</td><td>86 / 0.1</td><td>79.1 / 0.1</td><td>44.4 / 0.9</td><td>44.4 / 0.6</td><td>45.3 / 0.3</td><td>65.4 / 0.3</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>85.8 / 0.1</td><td>82.9 / 0.1</td><td>85.7 / 0.1</td><td>-</td><td>45.9 / 0.5</td><td>45.8 / 0.5</td><td>45.8 / 0.5</td><td>-</td></tr><tr><td>TBB</td><td>88.4 / 0.1</td><td>87.8 / 0.1</td><td>87.6 / 0.1</td><td>81.8 / 0.1</td><td>38.2 / 0.4</td><td>37.8 / 0.9</td><td>40.6 / 0.5</td><td>63.4 / 0.1</td></tr><tr><td>(CROP)</td><td>87.2 / 0.1</td><td>84.2 / 0.1</td><td>87 / 0.1</td><td>-</td><td>42 / 0.6</td><td>42 / 0.6</td><td>42 / 0.6</td><td>-</td></tr><tr><td>TBB</td><td>86.8 / 0.1</td><td>86.3 / 0.1</td><td>85.9 / 0.1</td><td>79.2 / 0.1</td><td>44 / 0.1</td><td>43.6 / 0.2</td><td>45.9 / 1.2</td><td>65.8 / 0.3</td></tr><tr><td>(RES)</td><td>85.9 / 0.2</td><td>83 / 0.2</td><td>85.8 / 0.2</td><td>85.8 / 0.2</td><td>45.7 / 1.3</td><td>45.7 / 1.3</td><td>45.7 / 1.3</td><td>-</td></tr><tr><td rowspan="10">CIFAR100<br>◇</td><td rowspan="5">iSUN</td><td>PBB</td><td>95.5 / 0.1</td><td>95.3 / 0</td><td>94.9 / 0</td><td>91.5 / 0</td><td>14.4 / 0.6</td><td>13.4 / 0.2</td><td>16.8 / 0.5</td><td>34 / 0.1</td></tr><tr><td>TBB</td><td>95 / 0</td><td>69.6 / 0</td><td>94.9 / 0.1</td><td>-</td><td>16.4 / 0.2</td><td>16.4 / 0.2</td><td>16.4 / 0.2</td><td>-</td></tr><tr><td>LSUN</td><td>95.8 / 0.1</td><td>95.5 / 0.1</td><td>95 / 0.1</td><td>93.9 / 0.1</td><td>12.4 / 0.2</td><td>12.6 / 0.1</td><td>16.1 / 0.4</td><td>24.8 / 0.1</td></tr><tr><td>(CROP)</td><td>94.8 / 0.1</td><td>69.6 / 0.1</td><td>94.8 / 0.1</td><td>-</td><td>16.7 / 0.4</td><td>16.8 / 0.4</td><td>16.6 / 0.4</td><td>-</td></tr><tr><td>(RESIZE)</td><td>95.8 / 0</td><td>95.6 / 0</td><td>95.2 / 0</td><td>91.6 / 0</td><td>12.9 / 0.5</td><td>12.9 / 0.3</td><td>15.8 / 0.2</td><td>33.9 / 0</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>95.8 / 0.1</td><td>95.5 / 0.1</td><td>95.2 / 0.1</td><td>91.5 / 0</td><td>16.4 / 0.2</td><td>16.4 / 0.3</td><td>16.4 / 0.2</td><td>-</td></tr><tr><td>TBB</td><td>95 / 0.2</td><td>69.8 / 0.1</td><td>95 / 0.1</td><td>-</td><td>16.4 / 0.2</td><td>12.8 / 0.7</td><td>12.9 / 0.5</td><td>16 / 0</td><td>33.9 / 0</td></tr><tr><td>(CROP)</td><td>95.4 / 0.1</td><td>95 / 0.1</td><td>94.8 / 0.1</td><td>91.4 / 0</td><td>15 / 0.1</td><td>14.8 / 0.7</td><td>17 / 0.5</td><td>34.5 / 0.9</td></tr><tr><td>TBB</td><td>94.6 / 0.2</td><td>69.3 / 0.2</td><td>94.6 / 0.2</td><td>-</td><td>18.1 / 1</td><td>18.1 / 1.1</td><td>18 / 1</td><td>-</td></tr><tr><td>(RES)</td><td>84.8 / 0.1</td><td>84.4 / 0.2</td><td>84.6 / 0.1</td><td>80.8 / 0.2</td><td>53.6 / 1</td><td>51.2 / 0.2</td><td>51.3 / 0.1</td><td>63.5 / 0.3</td></tr><tr><td rowspan="10">CIFAR100<br>◇</td><td rowspan="5">iSUN</td><td>PBB</td><td>84.1 / 0.1</td><td>81.2 / 0.1</td><td>84 / 0.1</td><td>-</td><td>52.5 / 0.5</td><td>52.5 / 0.5</td><td>52.5 / 0.5</td><td>-</td></tr><tr><td>TBB</td><td>89.9 / 0.1</td><td>89.6 / 0</td><td>89 / 0</td><td>84.1 / 0</td><td>35.2 / 0.7</td><td>35.4 / 0.2</td><td>39.3 / 0.1</td><td>62.2 / 0</td></tr><tr><td>LSUN</td><td>88.7 / 0.1</td><td>85.7 / 0</td><td>88.5 / 0.1</td><td>-</td><td>38.8 / 0.5</td><td>38.8 / 0.5</td><td>38.8 / 0.4</td><td>-</td></tr><tr><td>(CROP)</td><td>85.3 / 0.3</td><td>85.1 / 0.2</td><td>84.9 / 0.1</td><td>81.1 / 0</td><td>51.6 / 0.9</td><td>48.8 / 1</td><td>49.2 / 0.7</td><td>63.3 / 0.1</td></tr><tr><td>(RESIZE)</td><td>84.6 / 0.2</td><td>81.8 / 0.2</td><td>84.6 / 0.1</td><td>-</td><td>50.6 / 0.8</td><td>50.7 / 0.8</td><td>50.6 / 0.8</td><td>-</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>88.2 / 0</td><td>88.1 / 0.2</td><td>87.7 / 0.1</td><td>84.8 / 0.1</td><td>41.2 / 0.3</td><td>40.2 / 0.6</td><td>42.3 / 0.4</td><td>59 / 0.2</td></tr><tr><td>TBB</td><td>87.7 / 0.1</td><td>84.7 / 0.1</td><td>87.5 / 0.1</td><td>-</td><td>41.8 / 0.5</td><td>41.8 / 0.5</td><td>41.8 / 0.5</td><td>-</td></tr><tr><td>TBB</td><td>85.4 / 0.2</td><td>84.8 / 0.2</td><td>85.1 / 0.3</td><td>81.2 / 0.1</td><td>51.8 / 1.6</td><td>52 / 0.8</td><td>50.4 / 0.9</td><td>63.3 / 0.2</td></tr><tr><td>TBB</td><td>84.8 / 0.1</td><td>81.9 / 0.1</td><td>84.7 / 0.1</td><td>-</td><td>51.4 / 0.5</td><td>51.4 / 0.5</td><td>51.4 / 0.5</td><td>-</td></tr><tr><td>(RES)</td><td>95.6 / 0.1</td><td>95.6 / 0</td><td>95.4 / 0</td><td>93.5 / 0</td><td>15.1 / 0.1</td><td>13.6 / 0.5</td><td>16.1 / 0.2</td><td>30.6 / 0.4</td></tr><tr><td rowspan="10">CIFAR10<br>♠</td><td rowspan="5">iSUN</td><td>PBB</td><td>95.4 / 0.1</td><td>70 / 0.1</td><td>95.2 / 0.1</td><td>-</td><td>16.1 / 0.4</td><td>16 / 0.5</td><td>16 / 0.4</td><td>-</td></tr><tr><td>TBB</td><td>96.1 / 0.1</td><td>95.9 / 0.1</td><td>95.5 / 0.2</td><td>95.2 / 0.1</td><td>12.6 / 0.5</td><td>12.4 / 0.3</td><td>15.3 / 0.7</td><td>20.8 / 0.4</td></tr><tr><td>LSUN</td><td>95.2 / 0.1</td><td>70 / 0.1</td><td>95.2 / 0.1</td><td>-</td><td>15.8 / 0.7</td><td>15.8 / 0.7</td><td>15.7 / 0.7</td><td>-</td></tr><tr><td>(CROP)</td><td>96 / 0</td><td>95.8 / 0</td><td>95.7 / 0</td><td>93.6 / 0</td><td>13.2 / 0.5</td><td>13 / 0.2</td><td>15.2 / 0.4</td><td>30.3 / 0.4</td></tr><tr><td>(RESIZE)</td><td>95.5 / 0.1</td><td>70.2 / 0.1</td><td>95.5 / 0.1</td><td>-</td><td>15.2 / 0.5</td><td>15.2 / 0.5</td><td>15.1 / 0.5</td><td>-</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>96 / 0.1</td><td>95.9 / 0.1</td><td>95.7 / 0</td><td>93.6 / 0</td><td>13.5 / 0.9</td><td>12.7 / 0.4</td><td>15.2 / 0.4</td><td>30.3 / 0.4</td></tr><tr><td>TBB</td><td>95.5 / 0.1</td><td>70.3 / 0</td><td>95.6 / 0</td><td>-</td><td>15.1 / 0.2</td><td>15 / 0.3</td><td>15 / 0.2</td><td>-</td></tr><tr><td>TBB</td><td>95.5 / 0.1</td><td>95.2 / 0.1</td><td>95.1 / 0.1</td><td>93.2</td><td>14.7 / 0.3</td><td>14.8 / 0.5</td><td>17.1 / 0.4</td><td>31 / 0</td></tr><tr><td>TBB</td><td>94.9 / 0.1</td><td>69.7 / 0.1</td><td>94.9 / 0.1</td><td>-</td><td>16.8 / 0.3</td><td>16.9 / 0.2</td><td>16.7 / 0.2</td><td>-</td></tr><tr><td>(RES)</td><td>83.3 / 0.1</td><td>83.1 / 0.1</td><td>83 / 0.2</td><td>82.6 / 0.2</td><td>57.8 / 0.3</td><td>57.1 / 1</td><td>56.8 / 0.8</td><td>60 / 0.4</td></tr><tr><td rowspan="10">CIFAR100<br>♠</td><td rowspan="5">iSUN</td><td>PBB</td><td>82.6 / 0.2</td><td>79.7 / 0.2</td><td>82.5 / 0.2</td><td>-</td><td>58.3 / 1</td><td>58.4 / 1.1</td><td>58.4 / 1</td><td>-</td></tr><tr><td>TBB</td><td>90.6 / 0</td><td>90.7 / 0</td><td>89.9 / 0.1</td><td>87.5 / 0</td><td>35.9 / 0.2</td><td>34.6 / 0.2</td><td>38.5 / 0.4</td><td>56.1 / 0.2</td></tr><tr><td>LSUN</td><td>89.4 / 0.1</td><td>86.2 / 0</td><td>89 / 0</td><td>-</td><td>39.4 / 0.1</td><td>39.4 / 0.1</td><td>39.4 / 0.1</td><td>-</td></tr><tr><td>(CROP)</td><td>83.6 / 0.2</td><td>83.8 / 0.1</td><td>83.6 / 0.2</td><td>83.2 / 0.1</td><td>55.8 / 0.4</td><td>54.2 / 0.7</td><td>54.1 / 0.6</td><td>59.6 / 0.8</td></tr><tr><td>(RESIZE)</td><td>83.2 / 0.1</td><td>80.4 / 0.1</td><td>83.2 / 0.1</td><td>-</td><td>55 / 0.6</td><td>55 / 0.7</td><td>55 / 0.6</td><td>-</td></tr><tr><td rowspan="5">TINY</td><td>PBB</td><td>88.3 / 0.1</td><td>88.5 / 0.1</td><td>88.1 / 0.1</td><td>87.7 / 0.1</td><td>43.2 / 0.5</td><td>41.5 / 0.7</td><td>42.9 / 0.4</td><td>54.3 / 0.1</td></tr><tr><td>TBB</td><td>87.8 / 0</td><td>84.7 / 0.1</td><td>87.5 / 0.1</td><td>-</td><td>43.7 / 0.2</td><td>43.7 / 0.2</td><td>43.7 / 0.2</td><td>-</td></tr><tr><td>TBB</td><td>83.8 / 0.1</td><td>83.8 / 0.1</td><td>83.9 / 0.2</td><td>83 / 0.2</td><td>57.9 / 0.5</td><td>56.6 / 0.9</td><td>55.6 / 1</td><td>61 / 0.6</td></tr><tr><td>TBB</td><td>83.6 / 0.1</td><td>80.7 / 0.1</td><td>83.5 / 0.1</td><td>-</td><td>55.5 / 0.8</td><td>55.5 / 0.8</td><td>55.5 / 0.8</td><td>-</td></tr></tbody></table>
# Appendix to Chapter 4

## B.1 Additional results

In the following sections, we include results that, due to space limitations, were not included in Section 4.4.2.

### B.1.1 Additional Results on CIFAR10

#### Attack Rate

In Table B.1, we report the average number of successful attacks per natural sample considered in MEAD and in the single-armed settings.

As explained in Section 4.4.2, the attacks generated thanks to the Adversarial Cross-Entropy seem to be the most harmful ones for the underlying classifier. It is not surprising given that the Cross-Entropy was used as the loss to train the classifier. Attacks generated through the maximization of the Kullback-Leibler divergence, the Gini Impurity score, and the Fisher-Rao distance all seem to be equally damaging.

#### NSS

In Table B.2, we report the performances of the NSS detector in CIFAR10.

NSS is, by far, the best performing method to detect adversarial examples under the MEAD framework that we consider in this paper. The decrease in performances due to the worst-case scenario that we consider is up to 5.0 percentage points in terms of AUROC↑%. Under the single-armed setting, NSS is the most
<table><caption>Table B.1: Average number of successful attacks per natural sample considered in the single-armed setting and MEAD (CIFAR10). The results are reported in the table together with the total number of attacks performed per natural sample (Avg. / Tot.). No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th colspan="6">Avg. Num. of Successful Attack / Tot. Num. of Attack</th></tr><tr><th>Norm L<sub>1</sub></th><th>MEAD</th><th>ACE</th><th>KL</th><th>Gini</th><th>FR</th></tr></thead><tbody><tr><td><strong>PGD1</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>1.28 / 4</td><td>0.45 / 1</td><td>0.31 / 1</td><td>0.27 / 1</td><td>0.25 / 1</td></tr><tr><td>ε = 10</td><td>2.24 / 4</td><td>0.81 / 1</td><td>0.53 / 1</td><td>0.47 / 1</td><td>0.43 / 1</td></tr><tr><td>ε = 15</td><td>2.60 / 4</td><td>0.92 / 1</td><td>0.60 / 1</td><td>0.59 / 1</td><td>0.50 / 1</td></tr><tr><td>ε = 20</td><td>2.72 / 4</td><td>0.95 / 1</td><td>0.61 / 1</td><td>0.64 / 1</td><td>0.52 / 1</td></tr><tr><td>ε = 25</td><td>2.76 / 4</td><td>0.95 / 1</td><td>0.61 / 1</td><td>0.67 / 1</td><td>0.53 / 1</td></tr><tr><td>ε = 30</td><td>2.80 / 4</td><td>0.95 / 1</td><td>0.62 / 1</td><td>0.68 / 1</td><td>0.54 / 1</td></tr><tr><td>ε = 40</td><td>2.80 / 4</td><td>0.95 / 1</td><td>0.62 / 1</td><td>0.70 / 1</td><td>0.54 / 1</td></tr><tr><td><strong>Norm L<sub>2</sub></strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><strong>PGD2</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>1.12 / 4</td><td>0.39 / 1</td><td>0.27 / 1</td><td>0.24 / 1</td><td>0.22 / 1</td></tr><tr><td>ε = 0.25</td><td>2.16 / 4</td><td>0.78 / 1</td><td>0.51 / 1</td><td>0.45 / 1</td><td>0.40 / 1</td></tr><tr><td>ε = 0.3125</td><td>2.40 / 4</td><td>0.86 / 1</td><td>0.56 / 1</td><td>0.54 / 1</td><td>0.45 / 1</td></tr><tr><td>ε = 0.5</td><td>2.68 / 4</td><td>0.93 / 1</td><td>0.60 / 1</td><td>0.64 / 1</td><td>0.50 / 1</td></tr><tr><td>ε = 1</td><td>2.76 / 4</td><td>0.94 / 1</td><td>0.61 / 1</td><td>0.70 / 1</td><td>0.52 / 1</td></tr><tr><td>ε = 1.5</td><td>2.76 / 4</td><td>0.94 / 1</td><td>0.61 / 1</td><td>0.70 / 1</td><td>0.52 / 1</td></tr><tr><td>ε = 2</td><td>2.76 / 4</td><td>0.94 / 1</td><td>0.61 / 1</td><td>0.70 / 1</td><td>0.52 / 1</td></tr><tr><td><strong>DeepFool</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>0.48 / 1</td><td>0.48 / 1</td><td>0.48 / 1</td><td>0.48 / 1</td><td>0.48 / 1</td></tr><tr><td><strong>CW2</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>0.95 / 1</td><td>0.95 / 1</td><td>0.95 / 1</td><td>0.95 / 1</td><td>0.95 / 1</td></tr><tr><td><strong>HOP</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>0.41 / 1</td><td>0.41 / 1</td><td>0.41 / 1</td><td>0.41 / 1</td><td>0.41 / 1</td></tr><tr><td><strong>Norm L<sub>∞</sub></strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><strong>PGDi, FGSM, BIM</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>8.28 / 12</td><td>2.76 / 3</td><td>1.86 / 3</td><td>2.13 / 3</td><td>1.53 / 3</td></tr><tr><td>ε = 0.0625</td><td>8.52 / 12</td><td>2.85 / 3</td><td>1.89 / 3</td><td>2.22 / 3</td><td>1.56 / 3</td></tr><tr><td>ε = 0.25</td><td>8.88 / 12</td><td>2.85 / 3</td><td>1.98 / 3</td><td>2.31 / 3</td><td>1.71 / 3</td></tr><tr><td>ε = 0.5</td><td>9.24 / 12</td><td>2.85 / 3</td><td>2.13 / 3</td><td>2.31 / 3</td><td>1.92 / 3</td></tr><tr><td><strong>PGDi, FGSM, BIM, SA</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>9.00 / 13</td><td>3.21 / 4</td><td>2.26 / 4</td><td>2.61 / 4</td><td>1.95 / 4</td></tr><tr><td><strong>PGDi, FGSM, BIM, CWi</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>9.88 / 13</td><td>3.79 / 4</td><td>2.99 / 4</td><td>3.25 / 4</td><td>2.73 / 4</td></tr><tr><td><strong>No norm</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><strong>STA</strong></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>0.24 / 1</td><td>0.24 / 1</td><td>0.24 / 1</td><td>0.24 / 1</td><td>0.24 / 1</td></tr></tbody></table>

sensitive to the Kullback-Leibler divergence, even though the results are quite similar amongst the different attack objectives.
## B.1. Additional results

<table><caption>**Table B.2: Performances on NSS per objective and in MEAD on CIFAR10.**
The worst results among all the settings is in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>NSS</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>48.5</td><td>94.2</td><td>49.9</td><td>93.5</td><td>49.6</td><td>93.0</td><td>50.3</td><td>93.2</td><td>49.9</td><td>93.3</td></tr><tr><td>ε = 10</td><td>54.0</td><td>90.3</td><td>56.9</td><td>88.4</td><td>56.6</td><td>88.3</td><td>57.1</td><td>88.8</td><td>57.0</td><td>88.1</td></tr><tr><td>ε = 15</td><td>58.8</td><td>86.8</td><td>63.1</td><td>83.0</td><td>62.8</td><td>83.1</td><td>63.5</td><td>84.0</td><td>63.2</td><td>82.5</td></tr><tr><td>ε = 20</td><td>63.5</td><td>82.3</td><td>68.5</td><td>77.1</td><td>68.1</td><td>77.3</td><td>69.9</td><td>77.6</td><td>68.7</td><td>76.4</td></tr><tr><td>ε = 25</td><td>67.7</td><td>77.2</td><td>73.1</td><td>71.1</td><td>72.7</td><td>71.8</td><td>75.0</td><td>71.4</td><td>73.4</td><td>70.9</td></tr><tr><td>ε = 30</td><td>71.4</td><td>73.4</td><td>77.1</td><td>64.5</td><td>76.8</td><td>65.1</td><td>78.6</td><td>67.3</td><td>77.4</td><td>65.2</td></tr><tr><td>ε = 40</td><td>76.1</td><td>67.3</td><td>83.5</td><td>52.7</td><td>83.3</td><td>53.5</td><td>80.1</td><td>64.9</td><td>83.6</td><td>52.7</td></tr><tr><td>L<sub>1</sub> Average</td><td>62.9</td><td>81.6</td><td>67.4</td><td>75.7</td><td>67.1</td><td>76.0</td><td>67.8</td><td>78.2</td><td>67.6</td><td>75.6</td></tr><tr><td>Norm L<sub>2</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>48.3</td><td>94.3</td><td>49.5</td><td>93.8</td><td>49.1</td><td>93.5</td><td>49.5</td><td>94.3</td><td>49.6</td><td>93.5</td></tr><tr><td>ε = 0.25</td><td>53.2</td><td>91.2</td><td>55.9</td><td>89.1</td><td>55.6</td><td>89.2</td><td>55.9</td><td>89.8</td><td>55.8</td><td>89.4</td></tr><tr><td>ε = 0.3125</td><td>55.8</td><td>89.2</td><td>59.4</td><td>86.5</td><td>59.0</td><td>86.6</td><td>59.3</td><td>87.7</td><td>59.3</td><td>86.6</td></tr><tr><td>ε = 0.5</td><td>63.3</td><td>82.6</td><td>68.3</td><td>77.4</td><td>68.0</td><td>77.4</td><td>69.0</td><td>78.7</td><td>68.4</td><td>77.2</td></tr><tr><td>ε = 1</td><td>76.4</td><td>67.5</td><td>84.4</td><td>50.6</td><td>84.3</td><td>50.5</td><td>79.3</td><td>66.8</td><td>84.7</td><td>50.7</td></tr><tr><td>ε = 1.5</td><td>81.0</td><td>63.0</td><td>92.8</td><td>28.7</td><td>92.7</td><td>28.9</td><td>79.5</td><td>66.5</td><td>93.0</td><td>27.3</td></tr><tr><td>ε = 2</td><td>82.6</td><td>62.3</td><td>96.8</td><td>13.9</td><td>96.9</td><td>13.1</td><td>79.5</td><td>66.5</td><td>95.9</td><td>17.2</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>57.0</td><td>91.7</td><td>57.0</td><td>91.7</td><td>57.0</td><td>91.7</td><td>57.0</td><td>91.7</td><td>57.0</td><td>91.7</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>56.4</td><td>90.8</td><td>56.4</td><td>90.8</td><td>56.4</td><td>90.8</td><td>56.4</td><td>90.8</td><td>56.4</td><td>90.8</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>66.1</td><td>87.0</td><td>66.1</td><td>87.0</td><td>66.1</td><td>87.0</td><td>66.1</td><td>87.0</td><td>66.1</td><td>87.0</td></tr><tr><td>L<sub>2</sub> Average</td><td>64.0</td><td>82.0</td><td>68.7</td><td>71.0</td><td>68.5</td><td>70.9</td><td>65.1</td><td>82.0</td><td>68.6</td><td>71.1</td></tr><tr><td>Norm L<sub>∞</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>83.0</td><td>55.3</td><td>88.5</td><td>42.3</td><td>89.6</td><td>39.9</td><td>87.5</td><td>47.8</td><td>89.3</td><td>39.8</td></tr><tr><td>ε = 0.0625</td><td>96.0</td><td>17.2</td><td>98.1</td><td>7.9</td><td>98.4</td><td>6.8</td><td>97.1</td><td>13.2</td><td>98.4</td><td>6.8</td></tr><tr><td>ε = 0.25</td><td>97.3</td><td>0.6</td><td>99.7</td><td>0.6</td><td>99.7</td><td>0.6</td><td>97.8</td><td>0.6</td><td>98.0</td><td>0.6</td></tr><tr><td>ε = 0.5</td><td>82.5</td><td>100.0</td><td>99.7</td><td>0.6</td><td>99.7</td><td>0.6</td><td>86.2</td><td>100.0</td><td>85.7</td><td>100.0</td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>9.4</td><td>99.9</td><td>9.4</td><td>99.9</td><td>9.4</td><td>99.9</td><td>9.4</td><td>99.9</td><td>9.4</td><td>99.9</td></tr><tr><td>PGDi, FGSM, BIM, CWi</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>63.2</td><td>99.1</td><td>66.1</td><td>89.4</td><td>66.1</td><td>89.4</td><td>63.9</td><td>96.2</td><td>63.9</td><td>95.8</td></tr><tr><td>L<sub>∞</sub> Average</td><td>71.9</td><td>62.0</td><td>76.9</td><td>40.1</td><td>77.2</td><td>39.5</td><td>73.7</td><td>59.6</td><td>74.1</td><td>57.2</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td></tr><tr><td>No norm Average</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td><td>88.5</td><td>38.8</td></tr></tbody></table>

## KD-BU

In Table B.3, we show the result of our MEAD framework as well as the single-armed settings on CIFAR10, evaluated on *KD-BU*.

*KD-BU* seems to work poorly on MEAD as well as on the single-armed setting. For most settings, *KD-BU* is worst than a random detector. The decrease in AUROC↑% between the worst single-armed setting and MEAD is up to 24.9 percentage points.
<table><caption>**Table B.3: Performances on KD-BU per objective and in MEAD on CIFAR10.** The worst results among all the settings are shown in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>KD-BU</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr><tr><th>Norm L<sub>1</sub></th><th>AUROC↑%</th><th>FPR↓90%%</th><th>AUROC↑%</th><th>FPR↓90%%</th><th>AUROC↑%</th><th>FPR↓90%%</th><th>AUROC↑%</th><th>FPR↓90%%</th><th>AUROC↑%</th><th>FPR↓90%%</th></tr></thead><tbody><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>41.3</td><td>96.6</td><td>58.0</td><td>94.7</td><td>57.1</td><td>94.8</td><td>67.9</td><td>93.0</td><td>56.5</td><td>94.8</td></tr><tr><td>ε = 10</td><td>36.9</td><td>97.2</td><td>55.1</td><td>94.7</td><td>54.0</td><td>94.7</td><td>72.4</td><td>91.9</td><td>54.6</td><td>94.8</td></tr><tr><td>ε = 15</td><td>39.9</td><td>96.7</td><td>57.9</td><td>94.5</td><td>57.9</td><td>94.5</td><td>73.2</td><td>92.9</td><td>58.2</td><td>94.5</td></tr><tr><td>ε = 20</td><td>47.3</td><td>96.3</td><td>66.7</td><td>93.2</td><td>66.9</td><td>93.2</td><td>75.9</td><td>92.3</td><td>65.9</td><td>93.4</td></tr><tr><td>ε = 25</td><td>55.5</td><td>95.6</td><td>75.5</td><td>91.0</td><td>76.2</td><td>90.8</td><td>76.5</td><td>92.0</td><td>75.7</td><td>91.0</td></tr><tr><td>ε = 30</td><td>62.6</td><td>94.7</td><td>83.5</td><td>86.9</td><td>84.3</td><td>86.3</td><td>77.2</td><td>91.8</td><td>84.1</td><td>86.4</td></tr><tr><td>ε = 40</td><td>72.6</td><td>92.6</td><td>93.5</td><td>65.4</td><td>93.5</td><td>64.5</td><td>77.0</td><td>91.9</td><td>93.7</td><td>63.9</td></tr><tr><td>L<sub>1</sub> Average</td><td>50.9</td><td>95.7</td><td>70.0</td><td>88.6</td><td>70.0</td><td>88.4</td><td>74.3</td><td>92.3</td><td>69.8</td><td>88.4</td></tr><tr><td>Norm L<sub>2</sub></td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>42.0</td><td>96.6</td><td>59.0</td><td>94.6</td><td>58.2</td><td>94.6</td><td>68.2</td><td>92.6</td><td>57.8</td><td>94.6</td></tr><tr><td>ε = 0.25</td><td>38.4</td><td>96.8</td><td>54.2</td><td>95.0</td><td>53.9</td><td>95.0</td><td>70.5</td><td>92.5</td><td>55.0</td><td>94.8</td></tr><tr><td>ε = 0.3125</td><td>38.6</td><td>96.8</td><td>55.1</td><td>94.7</td><td>55.8</td><td>94.6</td><td>72.9</td><td>92.0</td><td>55.6</td><td>94.6</td></tr><tr><td>ε = 0.5</td><td>47.9</td><td>96.2</td><td>66.8</td><td>93.2</td><td>67.8</td><td>92.9</td><td>75.4</td><td>92.4</td><td>67.0</td><td>93.1</td></tr><tr><td>ε = 1</td><td>74.2</td><td>92.1</td><td>94.4</td><td>58.1</td><td>94.6</td><td>55.7</td><td>77.1</td><td>91.8</td><td>94.7</td><td>57.3</td></tr><tr><td>ε = 1.5</td><td>80.1</td><td>90.1</td><td>99.0</td><td>0.0</td><td>99.2</td><td>0.0</td><td>77.1</td><td>91.9</td><td>99.3</td><td>0.0</td></tr><tr><td>ε = 2</td><td>81.3</td><td>89.7</td><td>99.8</td><td>0.0</td><td>99.9</td><td>0.0</td><td>77.1</td><td>91.9</td><td>99.8</td><td>0.0</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>67.1</td><td>94.0</td><td>67.1</td><td>94.0</td><td>67.1</td><td>94.0</td><td>67.1</td><td>94.0</td><td>67.1</td><td>94.0</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>53.0</td><td>95.1</td><td>53.0</td><td>95.1</td><td>53.0</td><td>95.1</td><td>53.0</td><td>95.1</td><td>53.0</td><td>95.1</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>67.3</td><td>94.0</td><td>67.3</td><td>94.0</td><td>67.3</td><td>94.0</td><td>67.3</td><td>94.0</td><td>67.3</td><td>94.0</td></tr><tr><td>L<sub>2</sub> Average</td><td>59.0</td><td>94.1</td><td>71.6</td><td>71.9</td><td>71.7</td><td>71.6</td><td>70.6</td><td>92.8</td><td>71.7</td><td>71.8</td></tr><tr><td>Norm L<sub>ε</sub></td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td><td>AUROC↑%</td><td>FPR↓90%%</td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>29.2</td><td>97.3</td><td>52.8</td><td>94.7</td><td>62.4</td><td>92.7</td><td>46.5</td><td>96.2</td><td>58.2</td><td>93.8</td></tr><tr><td>ε = 0.0625</td><td>35.2</td><td>96.9</td><td>67.1</td><td>91.7</td><td>74.8</td><td>88.7</td><td>52.3</td><td>95.7</td><td>75.0</td><td>89.0</td></tr><tr><td>ε = 0.25</td><td>45.1</td><td>96.4</td><td>84.4</td><td>84.8</td><td>83.5</td><td>86.6</td><td>65.0</td><td>94.5</td><td>81.8</td><td>88.5</td></tr><tr><td>ε = 0.5</td><td>43.1</td><td>96.6</td><td>77.4</td><td>90.7</td><td>79.5</td><td>89.2</td><td>68.0</td><td>94.1</td><td>83.4</td><td>88.3</td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>34.9</td><td>97.0</td><td>59.2</td><td>94.9</td><td>60.5</td><td>94.9</td><td>46.5</td><td>96.4</td><td>60.6</td><td>94.9</td></tr><tr><td>PGDi, FGSM, BIM, CW1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>33.2</td><td>97.1</td><td>47.8</td><td>95.8</td><td>47.7</td><td>95.8</td><td>43.8</td><td>96.4</td><td>47.7</td><td>95.9</td></tr><tr><td>L<sub>2</sub> Average</td><td>36.8</td><td>96.9</td><td>64.8</td><td>92.1</td><td>68.1</td><td>91.3</td><td>53.7</td><td>95.6</td><td>67.8</td><td>91.7</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td></tr><tr><td>No norm Average</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td><td>65.4</td><td>94.2</td></tr></tbody></table>

## LID

In Table B.4, we report the detection performances of the *LID* method under the MEAD framework and the different single-armed settings.

*LID* is quite sensitive to all the attacker's objectives. Depending on the norm-constraint and on the $ε$ value, each one of the four objectives can be the most harmful one. Moreover, this detection method is quite affected by the MEAD setting. Indeed, the decrease of performances in terms of AUROC↑% due to the use of the worst-case scenario is up to 28.9 percentage points compared to the worst single-armed setting (value obtained under the $L_1$-norm constraint for $ε = 40$).
## B.1. Additional results

<table><caption>**Table B.4: Performances on LID per objective and in MEAD on CIFAR10.**
The worst results among all the settings is in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>LID</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>57.5</td><td>93.5</td><td>66.2</td><td>86.9</td><td>65.5</td><td>88.0</td><td>77.9</td><td>77.0</td><td>64.4</td><td>88.7</td></tr><tr><td>ε = 10</td><td>48.3</td><td>96.4</td><td>62.3</td><td>89.6</td><td>60.6</td><td>92.0</td><td>84.3</td><td>70.7</td><td>61.9</td><td>90.2</td></tr><tr><td>ε = 15</td><td>53.1</td><td>95.4</td><td>61.6</td><td>90.7</td><td>61.8</td><td>90.9</td><td>89.1</td><td>55.6</td><td>61.8</td><td>91.1</td></tr><tr><td>ε = 20</td><td>37.5</td><td>99.0</td><td>65.7</td><td>89.2</td><td>65.4</td><td>90.2</td><td>91.4</td><td>40.8</td><td>66.3</td><td>87.1</td></tr><tr><td>ε = 25</td><td>47.7</td><td>96.3</td><td>70.7</td><td>84.0</td><td>70.9</td><td>84.7</td><td>92.8</td><td>37.1</td><td>70.3</td><td>83.3</td></tr><tr><td>ε = 30</td><td>56.4</td><td>95.0</td><td>76.1</td><td>75.7</td><td>76.5</td><td>79.8</td><td>93.2</td><td>35.2</td><td>75.5</td><td>81.9</td></tr><tr><td>ε = 40</td><td>54.9</td><td>92.5</td><td>84.6</td><td>58.5</td><td>85.0</td><td>54.7</td><td>93.3</td><td>32.6</td><td>83.8</td><td>63.3</td></tr><tr><td>L<sub>1</sub> Average</td><td>50.8</td><td>95.4</td><td>69.6</td><td>82.1</td><td>69.4</td><td>82.9</td><td>88.9</td><td>49.9</td><td>69.1</td><td>83.7</td></tr><tr><td>Norm L<sub>2</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>61.3</td><td>90.6</td><td>67.5</td><td>86.3</td><td>66.2</td><td>88.7</td><td>77.8</td><td>76.3</td><td>64.6</td><td>88.8</td></tr><tr><td>ε = 0.25</td><td>47.9</td><td>96.5</td><td>62.0</td><td>90.3</td><td>60.8</td><td>91.5</td><td>84.1</td><td>68.3</td><td>61.4</td><td>90.6</td></tr><tr><td>ε = 0.3125</td><td>49.7</td><td>95.8</td><td>60.8</td><td>91.5</td><td>60.5</td><td>91.5</td><td>87.4</td><td>60.3</td><td>61.9</td><td>88.8</td></tr><tr><td>ε = 0.5</td><td>47.6</td><td>97.9</td><td>66.1</td><td>87.7</td><td>65.6</td><td>91.2</td><td>91.0</td><td>49.2</td><td>65.9</td><td>88.9</td></tr><tr><td>ε = 1</td><td>65.2</td><td>84.1</td><td>86.0</td><td>50.6</td><td>86.3</td><td>48.9</td><td>93.4</td><td>32.5</td><td>85.2</td><td>55.9</td></tr><tr><td>ε = 1.5</td><td>77.0</td><td>56.2</td><td>94.0</td><td>20.0</td><td>93.9</td><td>19.8</td><td>93.5</td><td>31.5</td><td>93.1</td><td>21.7</td></tr><tr><td>ε = 2</td><td>81.5</td><td>46.4</td><td>96.3</td><td>11.9</td><td>96.3</td><td>12.2</td><td>93.4</td><td>31.8</td><td>95.0</td><td>15.2</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>70.9</td><td>86.9</td><td>70.9</td><td>86.9</td><td>70.9</td><td>86.9</td><td>70.9</td><td>86.9</td><td>70.9</td><td>86.9</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>61.6</td><td>92.5</td><td>61.6</td><td>92.5</td><td>61.6</td><td>92.5</td><td>61.6</td><td>92.5</td><td>61.6</td><td>92.5</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>72.2</td><td>83.6</td><td>72.2</td><td>83.6</td><td>72.2</td><td>83.6</td><td>72.2</td><td>83.6</td><td>72.2</td><td>83.6</td></tr><tr><td>L<sub>2</sub> Average</td><td>63.5</td><td>83.1</td><td>73.7</td><td>70.1</td><td>73.4</td><td>70.7</td><td>82.5</td><td>61.3</td><td>73.2</td><td>71.3</td></tr><tr><td>Norm L<sub>∞</sub></td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>90%</sub>%</td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>41.4</td><td>96.5</td><td>55.5</td><td>89.9</td><td>60.5</td><td>88.9</td><td>69.7</td><td>86.7</td><td>65.5</td><td>82.5</td></tr><tr><td>ε = 0.0625</td><td>58.4</td><td>83.9</td><td>76.7</td><td>59.0</td><td>78.6</td><td>57.0</td><td>83.6</td><td>59.2</td><td>87.1</td><td>44.8</td></tr><tr><td>ε = 0.25</td><td>58.0</td><td>89.5</td><td>88.4</td><td>27.0</td><td>92.1</td><td>41.7</td><td>77.7</td><td>70.9</td><td>93.0</td><td>20.6</td></tr><tr><td>ε = 0.5</td><td>58.6</td><td>86.7</td><td>90.3</td><td>25.7</td><td>93.6</td><td>19.2</td><td>76.3</td><td>74.3</td><td>91.8</td><td>23.9</td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>56.7</td><td>91.8</td><td>82.5</td><td>48.6</td><td>85.6</td><td>49.8</td><td>64.6</td><td>91.0</td><td>85.5</td><td>48.8</td></tr><tr><td>PGDi, FGSM, BIM, CWi</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>49.5</td><td>96.1</td><td>60.5</td><td>90.7</td><td>68.7</td><td>88.8</td><td>56.0</td><td>96.0</td><td>68.8</td><td>87.9</td></tr><tr><td>L<sub>∞</sub> Average</td><td>53.8</td><td>90.8</td><td>75.7</td><td>56.8</td><td>79.9</td><td>57.6</td><td>71.3</td><td>79.7</td><td>82.0</td><td>51.4</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td></tr><tr><td>No norm Average</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td><td>88.0</td><td>58.1</td></tr></tbody></table>

## FS

In Table B.5, we present the summary of the FS detection method.

FS is not quite affected by the MEAD framework under the L₁ and L₂-norm constraints. The reason why is explained in Section 4.4.2 in the remark of the paragraph called **MEAD and the single-armed setting**. However, under the L∞-norm constraint, our MEAD framework is quite damaging, creating a decrease in terms of AUROC↑% up to 6.5 percentage points and a maximal increase in FPR↓95% of 5.3 percentage points. Under the single-armed setting, FS is extremely sensitive to the attacks generated by maximizing the Gini Impurity score.
<table><caption>Table B.5: Performances on FS per objective and in MEAD on CIFAR10. The worst results among all the settings is in bold; the ones in the single-armed setting is underlined. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>FS</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>69.1</td><td>76.1</td><td>76.5</td><td>66.5</td><td>76.8</td><td>65.8</td><td><b>68.2</b></td><td><b>77.9</b></td><td>76.5</td><td>66.4</td></tr><tr><td>ε = 10</td><td>76.6</td><td>65.9</td><td>88.3</td><td>42.2</td><td>88.4</td><td>42.5</td><td><b>74.8</b></td><td><b>68.4</b></td><td>88.6</td><td>42.1</td></tr><tr><td>ε = 15</td><td>77.2</td><td>61.9</td><td>93.6</td><td>26.3</td><td>93.8</td><td>25.6</td><td><b>76.7</b></td><td><b>63.8</b></td><td>94.0</td><td>25.0</td></tr><tr><td>ε = 20</td><td>78.1</td><td>60.0</td><td>96.3</td><td>16.5</td><td>96.4</td><td>16.1</td><td><b>76.3</b></td><td><b>63.2</b></td><td>96.5</td><td>15.3</td></tr><tr><td>ε = 25</td><td>76.9</td><td>61.7</td><td>97.6</td><td>11.5</td><td>97.7</td><td>11.3</td><td><b>74.7</b></td><td><b>64.9</b></td><td>97.7</td><td>10.9</td></tr><tr><td>ε = 30</td><td>75.5</td><td>63.4</td><td>98.3</td><td>8.1</td><td>98.4</td><td>8.0</td><td><b>72.6</b></td><td><b>66.8</b></td><td>98.4</td><td>7.9</td></tr><tr><td>ε = 40</td><td>74.6</td><td>64.9</td><td>99.0</td><td>5.0</td><td>99.0</td><td>4.8</td><td><b>71.4</b></td><td><b>68.1</b></td><td>99.0</td><td>5.0</td></tr><tr><td>L<sub>1</sub> Average</td><td>75.4</td><td>64.8</td><td>92.8</td><td>25.1</td><td>92.9</td><td>24.9</td><td><b>73.5</b></td><td><b>67.6</b></td><td>92.9</td><td>24.6</td></tr><tr><td>Norm L<sub>2</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td><b>67.5</b></td><td><b>77.4</b></td><td>74.6</td><td>68.9</td><td>75.1</td><td>67.6</td><td>68.9</td><td>76.9</td><td>74.8</td><td>69.2</td></tr><tr><td>ε = 0.25</td><td>75.9</td><td>66.1</td><td>87.3</td><td>45.0</td><td>87.4</td><td>45.0</td><td><b>74.7</b></td><td><b>67.7</b></td><td>87.4</td><td>45.4</td></tr><tr><td>ε = 0.3125</td><td>77.0</td><td>64.1</td><td>90.7</td><td>35.5</td><td>90.9</td><td>34.8</td><td><b>76.1</b></td><td><b>65.7</b></td><td>90.9</td><td>35.3</td></tr><tr><td>ε = 0.5</td><td>77.6</td><td>61.4</td><td>96.2</td><td>17.0</td><td>96.3</td><td>16.6</td><td><b>75.7</b></td><td><b>64.6</b></td><td>96.3</td><td>16.5</td></tr><tr><td>ε = 1</td><td>71.7</td><td>65.0</td><td>99.0</td><td>4.8</td><td>99.0</td><td>4.6</td><td><b>71.2</b></td><td><b>67.9</b></td><td>98.9</td><td>5.0</td></tr><tr><td>ε = 1.5</td><td>74.5</td><td>65.1</td><td>99.3</td><td>3.4</td><td>99.3</td><td>3.5</td><td><b>71.1</b></td><td><b>68.0</b></td><td>98.9</td><td>4.9</td></tr><tr><td>ε = 2</td><td>73.7</td><td>65.2</td><td>99.3</td><td>3.6</td><td>99.3</td><td>3.6</td><td><b>71.1</b></td><td><b>68.0</b></td><td>98.7</td><td>5.7</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td><b>66.0</b></td><td><b>78.2</b></td><td><b>66.0</b></td><td><b>78.2</b></td><td><b>66.0</b></td><td><b>78.2</b></td><td><b>66.0</b></td><td><b>78.2</b></td><td><b>66.0</b></td><td><b>78.2</b></td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td><b>86.7</b></td><td><b>46.3</b></td><td><b>86.7</b></td><td><b>46.3</b></td><td><b>86.7</b></td><td><b>46.3</b></td><td><b>86.7</b></td><td><b>46.3</b></td><td><b>86.7</b></td><td><b>46.3</b></td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td><b>75.7</b></td><td><b>69.0</b></td><td><b>75.7</b></td><td><b>69.0</b></td><td><b>75.7</b></td><td><b>69.0</b></td><td><b>75.7</b></td><td><b>69.0</b></td><td><b>75.7</b></td><td><b>69.0</b></td></tr><tr><td>L<sub>2</sub> Average</td><td>74.9</td><td>65.8</td><td>87.4</td><td>31.2</td><td>87.6</td><td>36.9</td><td><b>73.7</b></td><td><b>67.2</b></td><td>87.4</td><td>37.5</td></tr><tr><td>Norm L<sub>∞</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGD1, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td><b>59.6</b></td><td><b>79.0</b></td><td>75.2</td><td>63.1</td><td>78.5</td><td>57.9</td><td><b>66.1</b></td><td><b>73.6</b></td><td>77.4</td><td>61.3</td></tr><tr><td>ε = 0.0625</td><td><b>53.7</b></td><td><b>80.3</b></td><td>71.9</td><td>63.8</td><td>76.3</td><td>59.5</td><td><b>60.2</b></td><td><b>77.1</b></td><td>77.2</td><td>57.6</td></tr><tr><td>ε = 0.25</td><td><b>49.4</b></td><td><b>83.2</b></td><td>72.8</td><td>60.0</td><td>78.2</td><td>53.9</td><td><b>55.2</b></td><td><b>81.6</b></td><td>76.8</td><td>53.8</td></tr><tr><td>ε = 0.5</td><td><b>54.1</b></td><td><b>78.8</b></td><td>82.7</td><td>39.9</td><td>86.4</td><td>36.5</td><td><b>57.2</b></td><td><b>78.2</b></td><td>78.6</td><td>52.3</td></tr><tr><td>PGD1, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td><b>46.5</b></td><td><b>86.3</b></td><td>64.3</td><td>71.6</td><td>69.7</td><td>68.1</td><td><b>51.5</b></td><td><b>85.2</b></td><td>70.8</td><td>66.3</td></tr><tr><td>PGD1, FGSM, BIM, CWi</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td><b>52.7</b></td><td><b>79.3</b></td><td>71.1</td><td>62.2</td><td>75.7</td><td>58.2</td><td><b>58.9</b></td><td><b>77.2</b></td><td>73.4</td><td>59.9</td></tr><tr><td>L<sub>∞</sub> Average</td><td><b>52.7</b></td><td><b>81.1</b></td><td>73.0</td><td>60.1</td><td>77.5</td><td>55.7</td><td><b>58.2</b></td><td><b>78.8</b></td><td>75.7</td><td>58.5</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td></tr><tr><td>No norm Average</td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td><td><b>62.7</b></td><td><b>82.5</b></td></tr></tbody></table>

## MagNet

In Table B.6, we show the result of our MEAD framework on CIFAR10, evaluated on MagNet.

MagNet is an unsupervised detection method. In most cases, on CIFAR10, the results using MEAD are close to the worst results for the single-armed settings. In other words, it seems that if an example generated using the worst loss is detected (usually the Fisher-Rao objective), then the samples generated using all the others are detected. The decrease in AUROC↑% between the worst single-armed setting and MEAD is up to 1.8 percentage points.
## B.1. Additional results

<table><caption>Table B.6: Performances on MagNet per objective and in MEAD on CIFAR10. The worst results among all the settings are shown in bold; the ones in the single-armed setting is underlined. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>MagNet</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><th>Norm L<sub>1</sub></th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th></tr><tr><th>PGD1</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 5</th><td>43.9</td><td>96.6</td><td>43.6</td><td>96.6</td><td>43.7</td><td>96.5</td><td><strong>43.3</strong></td><td><strong>97.1</strong></td><td>43.6</td><td>96.7</td></tr><tr><th>ε = 10</th><td>47.8</td><td>95.2</td><td>47.9</td><td>95.1</td><td>47.6</td><td>94.9</td><td><strong>46.7</strong></td><td><strong>95.6</strong></td><td><strong>46.7</strong></td><td><strong>95.6</strong></td></tr><tr><th>ε = 15</th><td>49.8</td><td>94.3</td><td>50.0</td><td>94.3</td><td>49.8</td><td>94.1</td><td><strong>49.1</strong></td><td>94.5</td><td><strong>49.1</strong></td><td><strong>94.7</strong></td></tr><tr><th>ε = 20</th><td>50.6</td><td>93.8</td><td>50.8</td><td>93.7</td><td>50.6</td><td>93.5</td><td>50.7</td><td>93.3</td><td><strong>49.8</strong></td><td><strong>94.1</strong></td></tr><tr><th>ε = 25</th><td>51.1</td><td>93.1</td><td>51.4</td><td>93.0</td><td>51.1</td><td>92.8</td><td>52.5</td><td>91.7</td><td><strong>50.6</strong></td><td><strong>93.3</strong></td></tr><tr><th>ε = 30</th><td>51.6</td><td>92.4</td><td>51.9</td><td>92.1</td><td>51.7</td><td>91.8</td><td>53.7</td><td>90.2</td><td><strong>51.2</strong></td><td><strong>92.5</strong></td></tr><tr><th>ε = 40</th><td><strong>52.7</strong></td><td><strong>90.6</strong></td><td>53.3</td><td>89.6</td><td>53.1</td><td>89.2</td><td>54.5</td><td>89.7</td><td><strong>52.7</strong></td><td>89.8</td></tr><tr><th>L<sub>1</sub> Average</th><td>49.6</td><td>93.7</td><td>49.8</td><td>93.5</td><td>49.7</td><td>93.3</td><td>50.1</td><td>93.2</td><td><strong>49.1</strong></td><td><strong>93.8</strong></td></tr><tr><th>Norm L<sub>2</sub></th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th></tr><tr><th>PGD2</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.125</th><td>43.1</td><td>96.9</td><td><strong>42.6</strong></td><td>96.9</td><td>43.2</td><td>96.8</td><td>43.8</td><td>96.7</td><td>43.2</td><td><strong>97.0</strong></td></tr><tr><th>ε = 0.25</th><td>47.3</td><td>95.4</td><td>47.3</td><td>95.4</td><td>47.1</td><td>95.1</td><td><strong>45.6</strong></td><td><strong>95.7</strong></td><td>46.4</td><td><strong>95.7</strong></td></tr><tr><th>ε = 0.3125</th><td>48.7</td><td>94.8</td><td>48.8</td><td>94.7</td><td>48.7</td><td>94.5</td><td><strong>47.4</strong></td><td>95.0</td><td>48.0</td><td><strong>95.1</strong></td></tr><tr><th>ε = 0.5</th><td>50.6</td><td>93.8</td><td>50.7</td><td>93.6</td><td>50.5</td><td>93.4</td><td>50.5</td><td>93.3</td><td><strong>49.9</strong></td><td><strong>94.2</strong></td></tr><tr><th>ε = 1</th><td><strong>53.0</strong></td><td><strong>90.1</strong></td><td>53.7</td><td>88.7</td><td>53.6</td><td>88.4</td><td>54.4</td><td><strong>89.6</strong></td><td><strong>53.3</strong></td><td>88.8</td></tr><tr><th>ε = 1.5</th><td>55.3</td><td>88.3</td><td>59.3</td><td>79.2</td><td>59.1</td><td>78.8</td><td><strong>54.5</strong></td><td><strong>89.5</strong></td><td>59.2</td><td>80.9</td></tr><tr><th>ε = 2</th><td>56.9</td><td>88.2</td><td>67.2</td><td>64.4</td><td>67.2</td><td>64.0</td><td><strong>54.5</strong></td><td><strong>89.5</strong></td><td>63.7</td><td>79.3</td></tr><tr><th>DeepFool</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>No ε</th><td><strong>51.1</strong></td><td><strong>94.7</strong></td><td><strong>51.1</strong></td><td><strong>94.7</strong></td><td><strong>51.1</strong></td><td><strong>94.7</strong></td><td><strong>51.1</strong></td><td><strong>94.7</strong></td><td><strong>51.1</strong></td><td><strong>94.7</strong></td></tr><tr><th>CW2</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.01</th><td><strong>50.5</strong></td><td><strong>94.7</strong></td><td><strong>50.5</strong></td><td><strong>94.7</strong></td><td><strong>50.5</strong></td><td><strong>94.7</strong></td><td><strong>50.5</strong></td><td><strong>94.7</strong></td><td><strong>50.5</strong></td><td><strong>94.7</strong></td></tr><tr><th>HOP</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.1</th><td><strong>52.2</strong></td><td><strong>93.8</strong></td><td><strong>52.2</strong></td><td><strong>93.8</strong></td><td><strong>52.2</strong></td><td><strong>93.8</strong></td><td><strong>52.2</strong></td><td><strong>93.8</strong></td><td><strong>52.2</strong></td><td><strong>93.8</strong></td></tr><tr><th>L<sub>2</sub> Average</th><td>50.9</td><td>93.1</td><td>52.3</td><td>89.6</td><td>52.3</td><td>89.4</td><td><strong>50.5</strong></td><td><strong>93.3</strong></td><td>51.8</td><td>91.4</td></tr><tr><th>Norm L<sub>∞</sub></th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th></tr><tr><th>PGDi, FGSM, BIM</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.03125</th><td><strong>58.6</strong></td><td><strong>82.0</strong></td><td>60.0</td><td>80.0</td><td>60.4</td><td>79.0</td><td>60.4</td><td>80.8</td><td><strong>59.0</strong></td><td><strong>81.0</strong></td></tr><tr><th>ε = 0.0625</th><td><strong>74.6</strong></td><td><strong>51.2</strong></td><td><strong>76.8</strong></td><td>48.0</td><td>79.4</td><td>46.2</td><td>77.1</td><td><strong>48.2</strong></td><td>78.8</td><td>47.0</td></tr><tr><th>ε = 0.25</th><td><strong>97.0</strong></td><td><strong>5.2</strong></td><td>98.2</td><td>3.6</td><td>98.7</td><td>3.4</td><td><strong>97.7</strong></td><td><strong>4.1</strong></td><td>98.7</td><td>3.4</td></tr><tr><th>ε = 0.5</th><td><strong>98.0</strong></td><td><strong>3.5</strong></td><td>99.0</td><td>2.2</td><td>99.2</td><td>2.0</td><td><strong>98.6</strong></td><td><strong>2.6</strong></td><td>99.2</td><td>2.1</td></tr><tr><th>PGDi, FGSM, BIM, SA</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.125</th><td><strong>87.0</strong></td><td><strong>40.0</strong></td><td><strong>88.8</strong></td><td><strong>39.3</strong></td><td>90.9</td><td><strong>39.3</strong></td><td>88.9</td><td>37.3</td><td>91.4</td><td><strong>39.3</strong></td></tr><tr><th>PGDi, FGSM, BIM, CWi</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.3125</th><td>52.6</td><td><strong>94.5</strong></td><td><strong>52.5</strong></td><td><strong>94.5</strong></td><td><strong>52.5</strong></td><td><strong>94.5</strong></td><td>52.6</td><td><strong>94.5</strong></td><td>52.6</td><td><strong>94.5</strong></td></tr><tr><th>L<sub>∞</sub> Average</th><td><strong>78.0</strong></td><td><strong>46.1</strong></td><td>79.2</td><td>44.6</td><td>80.2</td><td>44.1</td><td>79.2</td><td>44.6</td><td>80.0</td><td>44.6</td></tr><tr><th>No norm</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th><th>AUROC†%</th><th>FPR<sub>90%</sub>%</th></tr><tr><th>STA</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>No ε</th><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td></tr><tr><th>No norm Average</th><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td><td><strong>79.9</strong></td><td><strong>45.7</strong></td></tr></tbody></table>

## B.1.2 Additional Results on MNIST

### Success of attacks

In Table B.7, we show the average and total numbers of successful attack per settings (MEAD, Adversarial Cross-Entropy, KL divergence, Gini Impurity score and Fisher-Rao loss) on the MNIST dataset. We can observe the same behavior in MNIST as in CIFAR10. The most harmful attacks for the classifier are the ones generated according to the Adversarial Cross-Entropy. The attacks generated thanks to the three other objectives have a similar strength.
<table><caption>Table B.7: Average number of successful attacks per natural sample considered in the single-armed setting and MEAD (MNIST). The results are reported in the table together with the total number of attacks performed per natural sample (Avg. / Tot.). No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th colspan="6">Avg. Num. of Successful Attack / Tot. Num. of Attack</th></tr><tr><th>Norm L<sub>1</sub></th><th>MEAD</th><th>ACE</th><th>KL</th><th>Gini</th><th>FR</th></tr></thead><tbody><tr><td><u>PGD1</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>0.06 / 4</td><td>0.02 / 1</td><td>0.02 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td></tr><tr><td>ε = 10</td><td>0.23 / 4</td><td>0.09 / 1</td><td>0.06 / 1</td><td>0.03 / 1</td><td>0.05 / 1</td></tr><tr><td>ε = 15</td><td>0.77 / 4</td><td>0.31 / 1</td><td>0.20 / 1</td><td>0.10 / 1</td><td>0.16 / 1</td></tr><tr><td>ε = 20</td><td>1.50 / 4</td><td>0.58 / 1</td><td>0.38 / 1</td><td>0.22 / 1</td><td>0.33 / 1</td></tr><tr><td>ε = 25</td><td>2.03 / 4</td><td>0.73 / 1</td><td>0.48 / 1</td><td>0.33 / 1</td><td>0.48 / 1</td></tr><tr><td>ε = 30</td><td>2.35 / 4</td><td>0.80 / 1</td><td>0.54 / 1</td><td>0.42 / 1</td><td>0.59 / 1</td></tr><tr><td>ε = 40</td><td>2.67 / 4</td><td>0.85 / 1</td><td>0.58 / 1</td><td>0.54 / 1</td><td>0.70 / 1</td></tr><tr><td><u>Norm L<sub>2</sub></u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><u>PGD2</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>0.04 / 4</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td></tr><tr><td>ε = 0.25</td><td>0.04 / 4</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td></tr><tr><td>ε = 0.3125</td><td>0.05 / 4</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td><td>0.01 / 1</td></tr><tr><td>ε = 0.5</td><td>0.07 / 4</td><td>0.02 / 1</td><td>0.02 / 1</td><td>0.01 / 1</td><td>0.02 / 1</td></tr><tr><td>ε = 1</td><td>0.29 / 4</td><td>0.12 / 1</td><td>0.08 / 1</td><td>0.04 / 1</td><td>0.06 / 1</td></tr><tr><td>ε = 1.5</td><td>0.99 / 4</td><td>0.40 / 1</td><td>0.26 / 1</td><td>0.13 / 1</td><td>0.21 / 1</td></tr><tr><td>ε = 2</td><td>1.75 / 4</td><td>0.63 / 1</td><td>0.44 / 1</td><td>0.28 / 1</td><td>0.40 / 1</td></tr><tr><td><u>DeepFool</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>0.97 / 1</td><td>0.97 / 1</td><td>0.97 / 1</td><td>0.97 / 1</td><td>0.97 / 1</td></tr><tr><td><u>CW2</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>0.74 / 1</td><td>0.74 / 1</td><td>0.74 / 1</td><td>0.74 / 1</td><td>0.74 / 1</td></tr><tr><td><u>HOP</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>0.99 / 1</td><td>0.99 / 1</td><td>0.99 / 1</td><td>0.99 / 1</td><td>0.99 / 1</td></tr><tr><td><u>Norm L<sub>∞</sub></u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><u>PGDi, FGSM, BIM</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>0.14 / 12</td><td>0.04 / 3</td><td>0.03 / 3</td><td>0.04 / 3</td><td>0.03 / 3</td></tr><tr><td>ε = 0.0625</td><td>0.38 / 12</td><td>0.13 / 2</td><td>0.08 / 3</td><td>0.09 / 3</td><td>0.07 / 3</td></tr><tr><td>ε = 0.125</td><td>2.07 / 12</td><td>0.79 / 3</td><td>0.46 / 3</td><td>0.45 / 3</td><td>0.37 / 3</td></tr><tr><td>ε = 0.25</td><td>7.41 / 12</td><td>2.62 / 3</td><td>1.50 / 3</td><td>1.70 / 3</td><td>1.60 / 3</td></tr><tr><td>ε = 0.5</td><td>8.85 / 12</td><td>2.90 / 3</td><td>1.76 / 3</td><td>2.20 / 3</td><td>1.99 / 3</td></tr><tr><td><u>PGDi, FGSM, BIM, CWi, SA</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>9.73 / 14</td><td>4.34 / 5</td><td>3.17 / 5</td><td>3.51 / 5</td><td>3.34 / 5</td></tr><tr><td><u>No norm</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td><u>STA</u></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>0.85 / 1</td><td>0.85 / 1</td><td>0.85 / 1</td><td>0.85 / 1</td><td>0.85 / 1</td></tr></tbody></table>

## NSS

In Table B.8, we show the result of our MEAD framework on MNIST, evaluated on NSS. NSS is effective on MNIST, in particular when considering $L_∞$ threats. However, in this case, when $ε = 0.3125$, the performances decrease. This is not surprising as CWi and SA have different attack schemes from the ones in PGD/FGSM/BIM. NSS also loses some of its effectiveness with $L_1$ and $L_2$
## B.1. Additional results

<table><caption>**Table B.8: Performances on NSS per objective and in MEAD on MNIST.**
The worst results among all the settings is in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>NSS</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>91.4</td><td>30.5</td><td>92.1</td><td>24.6</td><td>92.3</td><td>27.2</td><td>93.0</td><td>24.2</td><td>92.0</td><td>26.9</td></tr><tr><td>ε = 10</td><td>96.4</td><td>11.7</td><td>96.6</td><td>10.8</td><td>96.7</td><td>10.7</td><td>97.3</td><td>8.0</td><td>97.1</td><td>8.5</td></tr><tr><td>ε = 15</td><td>97.3</td><td>8.6</td><td>97.5</td><td>8.0</td><td>97.5</td><td>8.0</td><td>98.0</td><td>4.2</td><td>97.5</td><td>7.7</td></tr><tr><td>ε = 20</td><td>97.9</td><td>5.3</td><td>98.0</td><td>4.7</td><td>98.0</td><td>4.6</td><td>98.2</td><td>3.3</td><td>98.1</td><td>3.9</td></tr><tr><td>ε = 25</td><td>98.2</td><td>3.2</td><td>98.3</td><td>3.2</td><td>98.3</td><td>3.2</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.2</td></tr><tr><td>ε = 30</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td></tr><tr><td>ε = 40</td><td>98.4</td><td>3.1</td><td>98.4</td><td>3.1</td><td>98.4</td><td>3.1</td><td>98.4</td><td>3.1</td><td>98.4</td><td>3.1</td></tr><tr><td>L<sub>1</sub> Average</td><td>96.8</td><td>9.4</td><td>97.0</td><td>8.2</td><td>97.1</td><td>8.6</td><td>97.4</td><td>7.0</td><td>97.1</td><td>8.1</td></tr><tr><td>Norm L<sub>2</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>80.4</td><td>55.3</td><td>81.3</td><td>55.2</td><td>81.3</td><td>49.7</td><td>82.3</td><td>51.4</td><td>81.2</td><td>56.2</td></tr><tr><td>ε = 0.25</td><td>86.4</td><td>42.0</td><td>87.6</td><td>38.4</td><td>87.9</td><td>39.7</td><td>89.0</td><td>40.3</td><td>86.9</td><td>41.8</td></tr><tr><td>ε = 0.3125</td><td>88.7</td><td>33.8</td><td>89.8</td><td>33.1</td><td>90.1</td><td>32.5</td><td>90.9</td><td>32.7</td><td>89.1</td><td>37.6</td></tr><tr><td>ε = 0.5</td><td>92.6</td><td>21.7</td><td>92.9</td><td>20.6</td><td>93.1</td><td>22.2</td><td>94.7</td><td>17.5</td><td>93.2</td><td>20.9</td></tr><tr><td>ε = 1</td><td>96.8</td><td>10.0</td><td>96.9</td><td>9.2</td><td>97.0</td><td>9.0</td><td>97.5</td><td>7.0</td><td>97.2</td><td>8.1</td></tr><tr><td>ε = 1.5</td><td>97.5</td><td>8.1</td><td>97.6</td><td>7.5</td><td>97.6</td><td>7.1</td><td>98.0</td><td>4.5</td><td>97.6</td><td>7.3</td></tr><tr><td>ε = 2</td><td>98.0</td><td>4.6</td><td>98.1</td><td>4.1</td><td>98.1</td><td>3.5</td><td>98.1</td><td>3.7</td><td>98.1</td><td>3.3</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>97.8</td><td>4.8</td><td>97.8</td><td>4.8</td><td>97.8</td><td>4.8</td><td>97.8</td><td>4.8</td><td>97.8</td><td>4.8</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>66.9</td><td>81.9</td><td>66.9</td><td>81.9</td><td>66.9</td><td>81.9</td><td>66.9</td><td>81.9</td><td>66.9</td><td>81.9</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td><td>98.3</td><td>3.1</td></tr><tr><td>L<sub>2</sub> Average</td><td>90.3</td><td>26.5</td><td>90.7</td><td>25.8</td><td>90.8</td><td>25.4</td><td>91.4</td><td>23.7</td><td>90.6</td><td>26.5</td></tr><tr><td>Norm L<sub>∞</sub></td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>93.4</td><td>9.6</td><td>94.5</td><td>9.5</td><td>94.7</td><td>9.5</td><td>95.3</td><td>9.5</td><td>94.5</td><td>9.5</td></tr><tr><td>ε = 0.0625</td><td>92.5</td><td>9.6</td><td>93.2</td><td>9.6</td><td>93.6</td><td>9.6</td><td>93.5</td><td>9.6</td><td>93.3</td><td>9.6</td></tr><tr><td>ε = 0.25</td><td>92.2</td><td>9.6</td><td>93.1</td><td>9.6</td><td>93.2</td><td>9.6</td><td>93.7</td><td>9.6</td><td>93.5</td><td>9.6</td></tr><tr><td>ε = 0.5</td><td>91.5</td><td>9.6</td><td>92.5</td><td>9.6</td><td>92.3</td><td>9.6</td><td>93.8</td><td>9.6</td><td>93.0</td><td>9.6</td></tr><tr><td>PGDi, FGSM, BIM, CWi, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>73.9</td><td>79.0</td><td>74.2</td><td>79.1</td><td>73.5</td><td>79.6</td><td>73.7</td><td>79.4</td><td>74.3</td><td>79.2</td></tr><tr><td>L<sub>∞</sub> Average</td><td>88.7</td><td>23.5</td><td>89.5</td><td>23.5</td><td>89.5</td><td>23.6</td><td>90.0</td><td>23.6</td><td>89.8</td><td>23.5</td></tr><tr><td>No norm</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td><td>AUROC↑%</td><td>FPR<sub>95%</sub>%</td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td></tr><tr><td>No norm Average</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td><td>87.1</td><td>57.8</td></tr></tbody></table>

threats. Note that all the single-armed settings behave quite similarly: this is probably due to the computation of the *Natural Scene Statistics*, which are not meaningful for perturbed images. Therefore, it is not surprising that the decrease in AUROC↑% considering MEAD is less than one percentage point compared to the worst single-armed setting.
KD-BU

In Table B.9, we show the result of our MEAD framework on MNIST, evaluated on KD-BU.

<table><caption>Table B.9: Performances on KD-BU per objective and in MEAD on MNIST. The worst results among all the settings are shown in bold; the ones in the single-armed setting is underlined. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th colspan="2">KD-BU</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><th colspan="2">Norm L<sub>1</sub></th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th></tr><tr><th colspan="2">PGD1</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>5</td><td>45.2</td><td>95.7</td><td>60.9</td><td>92.5</td><td>56.6</td><td>93.8</td><td>61.5</td><td>92.4</td><td>52.8</td><td>94.6</td></tr><tr><th>ε</th><td>10</td><td>46.4</td><td>95.6</td><td>58.3</td><td>93.3</td><td>59.9</td><td>92.9</td><td>59.2</td><td>93.2</td><td>59.4</td><td>93.0</td></tr><tr><th>ε</th><td>15</td><td>45.5</td><td>95.7</td><td>58.3</td><td>93.4</td><td>59.3</td><td>93.0</td><td>59.7</td><td>93.0</td><td>58.2</td><td>93.4</td></tr><tr><th>ε</th><td>20</td><td>45.5</td><td>95.7</td><td>59.7</td><td>93.1</td><td>58.7</td><td>93.3</td><td>61.3</td><td>92.7</td><td>59.6</td><td>93.1</td></tr><tr><th>ε</th><td>25</td><td>45.8</td><td>95.7</td><td>60.3</td><td>93.0</td><td>60.2</td><td>92.9</td><td>61.7</td><td>92.7</td><td>60.5</td><td>92.9</td></tr><tr><th>ε</th><td>30</td><td>45.7</td><td>95.7</td><td>60.8</td><td>92.9</td><td>60.4</td><td>92.9</td><td>62.9</td><td>92.3</td><td>60.3</td><td>93.0</td></tr><tr><th>ε</th><td>40</td><td>44.8</td><td>95.8</td><td>61.2</td><td>92.8</td><td>60.2</td><td>93.0</td><td>63.5</td><td>92.3</td><td>61.2</td><td>92.8</td></tr><tr><th colspan="2">L<sub>1</sub> Average</th><td>45.6</td><td>95.7</td><td>59.9</td><td>93.0</td><td>59.3</td><td>93.1</td><td>61.4</td><td>92.7</td><td>58.9</td><td>93.3</td></tr><tr><th colspan="2">Norm L<sub>2</sub></th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th></tr><tr><th colspan="2">PGD2</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>0.125</td><td>43.0</td><td>96.0</td><td>59.8</td><td>92.8</td><td>58.1</td><td>93.4</td><td>55.8</td><td>94.0</td><td>56.0</td><td>94.0</td></tr><tr><th>ε</th><td>0.25</td><td>44.1</td><td>95.9</td><td>60.4</td><td>92.6</td><td>57.7</td><td>93.5</td><td>56.0</td><td>94.0</td><td>60.6</td><td>92.6</td></tr><tr><th>ε</th><td>0.3125</td><td>45.3</td><td>95.7</td><td>55.6</td><td>94.0</td><td>59.2</td><td>93.0</td><td>55.7</td><td>94.0</td><td>59.3</td><td>93.0</td></tr><tr><th>ε</th><td>0.5</td><td>43.9</td><td>95.9</td><td>57.0</td><td>93.7</td><td>55.8</td><td>94.0</td><td>58.3</td><td>93.4</td><td>55.5</td><td>94.0</td></tr><tr><th>ε</th><td>1</td><td>46.6</td><td>95.6</td><td>59.2</td><td>93.1</td><td>58.1</td><td>93.4</td><td>59.4</td><td>93.0</td><td>58.4</td><td>93.3</td></tr><tr><th>ε</th><td>1.5</td><td>45.8</td><td>95.7</td><td>58.8</td><td>93.3</td><td>60.0</td><td>92.9</td><td>58.9</td><td>93.3</td><td>58.8</td><td>93.2</td></tr><tr><th>ε</th><td>2</td><td>46.7</td><td>95.6</td><td>60.0</td><td>93.0</td><td>59.5</td><td>93.1</td><td>61.0</td><td>92.8</td><td>60.9</td><td>92.7</td></tr><tr><th colspan="2">DeepFool</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>No ε</th><td></td><td>62.9</td><td>92.4</td><td>62.9</td><td>92.4</td><td>62.9</td><td>92.4</td><td>62.9</td><td>92.4</td><td>62.9</td><td>92.4</td></tr><tr><th>CW2</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>0.01</td><td>62.5</td><td>92.5</td><td>62.5</td><td>92.5</td><td>62.5</td><td>92.5</td><td>62.5</td><td>92.5</td><td>62.5</td><td>92.5</td></tr><tr><th>HOP</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>0.1</td><td>62.6</td><td>92.5</td><td>62.6</td><td>92.5</td><td>62.6</td><td>92.5</td><td>62.6</td><td>92.5</td><td>62.6</td><td>92.5</td></tr><tr><th colspan="2">L<sub>2</sub> Average</th><td>50.3</td><td>94.8</td><td>59.9</td><td>93.0</td><td>59.7</td><td>93.1</td><td>59.3</td><td>93.2</td><td>59.8</td><td>93.0</td></tr><tr><th colspan="2">Norm L<sub>∞</sub></th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th></tr><tr><th colspan="2">PGDi, FGSM, BIM</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>0.03125</td><td>34.5</td><td>96.7</td><td>42.0</td><td>96.1</td><td>44.0</td><td>95.9</td><td>48.1</td><td>95.4</td><td>42.9</td><td>96.0</td></tr><tr><th>ε</th><td>0.0625</td><td>33.6</td><td>96.8</td><td>41.0</td><td>96.2</td><td>44.2</td><td>95.9</td><td>47.6</td><td>95.5</td><td>44.1</td><td>95.9</td></tr><tr><th>ε</th><td>0.25</td><td>34.2</td><td>96.7</td><td>44.6</td><td>95.8</td><td>44.5</td><td>95.8</td><td>52.2</td><td>94.8</td><td>45.9</td><td>95.6</td></tr><tr><th>ε</th><td>0.5</td><td>34.0</td><td>96.6</td><td>44.5</td><td>95.7</td><td>44.8</td><td>95.7</td><td>51.2</td><td>94.9</td><td>46.0</td><td>95.6</td></tr><tr><th colspan="2">PGDi, FGSM, BIM, CWi, SA</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>ε</th><td>0.3125</td><td>34.2</td><td>96.7</td><td>41.7</td><td>96.1</td><td>45.8</td><td>95.7</td><td>44.0</td><td>95.8</td><td>45.6</td><td>95.7</td></tr><tr><th colspan="2">L<sub>∞</sub> Average</th><td>34.1</td><td>96.7</td><td>42.8</td><td>96.0</td><td>44.7</td><td>95.8</td><td>48.6</td><td>95.3</td><td>44.9</td><td>95.8</td></tr><tr><th colspan="2">No norm</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th></tr><tr><th colspan="2">STA</th><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><th>No ε</th><td></td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td></tr><tr><th colspan="2">No norm Average</th><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td><td>76.0</td><td>88.2</td></tr></tbody></table>

The KD-BU method is the least effective one at detecting the adversarial samples under the MEAD framework. The decrease of AUROC↑% can go up to 23 percentage points. Fisher-Rao and Adversarial Cross-Entropy-based attacks seem to be the toughest to detect for KD-BU detectors.
LID

In Table B.10, we show the result of our MEAD framework on MNIST, evaluated on LID.

<table><caption>Table B.10: Performances on LID per objective and in MEAD on MNIST. The worst results among all the settings are shown in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th colspan="2">LID</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr></thead><tbody><tr><td colspan="2">Norm L<sub>1</sub></td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td></tr><tr><td colspan="2">PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 5</td><td>88.1</td><td>41.5</td><td>89.6</td><td>36.1</td><td>88.6</td><td>41.7</td><td>88.4</td><td>39.3</td><td><strong>87.5</strong></td><td><strong>46.9</strong></td></tr><tr><td colspan="2">ε = 10</td><td><strong>83.2</strong></td><td><strong>48.8</strong></td><td>86.8</td><td>41.9</td><td>87.1</td><td>41.3</td><td>89.4</td><td>35.7</td><td>86.9</td><td>12.1</td></tr><tr><td colspan="2">ε = 15</td><td><strong>83.1</strong></td><td>48.8</td><td>84.3</td><td>41.9</td><td>84.2</td><td>46.5</td><td>87.1</td><td>42.3</td><td>83.7</td><td><strong>49.8</strong></td></tr><tr><td colspan="2">ε = 20</td><td><strong>77.7</strong></td><td><strong>57.7</strong></td><td>83.8</td><td>47.2</td><td>84.6</td><td>46.6</td><td>90.1</td><td>35.5</td><td>84.5</td><td><strong>47.8</strong></td></tr><tr><td colspan="2">ε = 25</td><td><strong>78.5</strong></td><td><strong>58.7</strong></td><td><strong>83.0</strong></td><td>51.9</td><td>83.5</td><td><strong>56.8</strong></td><td>91.4</td><td>32.4</td><td>83.6</td><td>51.2</td></tr><tr><td colspan="2">ε = 30</td><td><strong>74.3</strong></td><td><strong>65.6</strong></td><td>80.8</td><td><strong>57.4</strong></td><td>81.8</td><td>56.8</td><td>92.7</td><td>29.1</td><td>82.7</td><td>54.9</td></tr><tr><td colspan="2">ε = 40</td><td><strong>74.5</strong></td><td><strong>63.5</strong></td><td>77.5</td><td>60.8</td><td>78.4</td><td>60.1</td><td>93.8</td><td>26.5</td><td>80.1</td><td>58.9</td></tr><tr><td colspan="2">L<sub>1</sub> Average</td><td><strong>79.9</strong></td><td><strong>54.9</strong></td><td>83.7</td><td>48.2</td><td>84.0</td><td>50.0</td><td>90.4</td><td>52.1</td><td>84.1</td><td>50.2</td></tr><tr><td colspan="2">Norm L<sub>2</sub></td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td></tr><tr><td colspan="2">PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 0.125</td><td>87.7</td><td>47.7</td><td>88.0</td><td>47.5</td><td>87.6</td><td>47.4</td><td><strong>86.8</strong></td><td>46.7</td><td><strong>86.8</strong></td><td><strong>49.1</strong></td></tr><tr><td colspan="2">ε = 0.25</td><td>88.0</td><td>40.5</td><td>89.1</td><td>45.2</td><td><strong>87.9</strong></td><td><strong>49.2</strong></td><td>88.1</td><td>45.2</td><td>88.0</td><td>44.6</td></tr><tr><td colspan="2">ε = 0.3125</td><td>88.4</td><td>39.7</td><td>89.6</td><td>44.0</td><td>87.9</td><td>46.0</td><td><strong>87.6</strong></td><td><strong>53.1</strong></td><td>88.1</td><td>45.4</td></tr><tr><td colspan="2">ε = 0.5</td><td><strong>88.0</strong></td><td>38.1</td><td>90.0</td><td>33.8</td><td>88.9</td><td>35.6</td><td><strong>88.1</strong></td><td><strong>44.5</strong></td><td><strong>88.1</strong></td><td>41.1</td></tr><tr><td colspan="2">ε = 1</td><td><strong>80.1</strong></td><td><strong>55.3</strong></td><td>86.8</td><td>42.3</td><td>87.0</td><td>41.8</td><td>88.0</td><td>39.1</td><td><strong>86.7</strong></td><td><strong>43.2</strong></td></tr><tr><td colspan="2">ε = 1.5</td><td><strong>81.9</strong></td><td><strong>51.3</strong></td><td>84.8</td><td>46.0</td><td>84.5</td><td>47.2</td><td>87.4</td><td>42.0</td><td><strong>84.0</strong></td><td><strong>48.7</strong></td></tr><tr><td colspan="2">ε = 2</td><td><strong>81.1</strong></td><td><strong>53.6</strong></td><td>85.2</td><td>46.4</td><td><strong>84.8</strong></td><td><strong>47.2</strong></td><td>89.2</td><td>38.1</td><td>85.6</td><td>46.2</td></tr><tr><td colspan="2">DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">No ε</td><td><strong>87.9</strong></td><td><strong>42.1</strong></td><td><strong>87.9</strong></td><td><strong>42.1</strong></td><td><strong>87.9</strong></td><td><strong>42.1</strong></td><td><strong>87.9</strong></td><td><strong>42.1</strong></td><td><strong>87.9</strong></td><td><strong>42.1</strong></td></tr><tr><td colspan="2">CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 0.01</td><td>83.6</td><td>52.6</td><td><strong>83.6</strong></td><td><strong>52.6</strong></td><td><strong>83.6</strong></td><td><strong>52.6</strong></td><td><strong>83.6</strong></td><td><strong>52.6</strong></td><td><strong>83.6</strong></td><td><strong>52.6</strong></td></tr><tr><td colspan="2">HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 0.1</td><td><strong>89.3</strong></td><td><strong>41.0</strong></td><td><strong>89.3</strong></td><td><strong>41.0</strong></td><td><strong>89.3</strong></td><td><strong>41.0</strong></td><td><strong>89.3</strong></td><td><strong>41.0</strong></td><td><strong>89.3</strong></td><td><strong>41.0</strong></td></tr><tr><td colspan="2">L<sub>2</sub> Average</td><td><strong>85.6</strong></td><td><strong>46.2</strong></td><td>87.4</td><td>44.1</td><td>87.0</td><td>45.1</td><td>87.6</td><td>44.4</td><td><strong>86.1</strong></td><td><strong>45.4</strong></td></tr><tr><td colspan="2">Norm L<sub>∞</sub></td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td></tr><tr><td colspan="2">PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 0.03125</td><td>87.5</td><td>44.1</td><td>89.8</td><td>34.5</td><td>87.6</td><td>45.3</td><td>89.5</td><td>40.0</td><td><strong>86.9</strong></td><td><strong>46.7</strong></td></tr><tr><td colspan="2">ε = 0.0625</td><td><strong>84.7</strong></td><td><strong>45.5</strong></td><td>88.3</td><td>37.6</td><td>88.1</td><td>36.7</td><td>88.3</td><td>38.0</td><td><strong>87.7</strong></td><td><strong>42.4</strong></td></tr><tr><td colspan="2">ε = 0.125</td><td><strong>80.6</strong></td><td><strong>52.1</strong></td><td>85.3</td><td>43.1</td><td>85.6</td><td>43.9</td><td><strong>84.2</strong></td><td>45.3</td><td>84.4</td><td><strong>46.7</strong></td></tr><tr><td colspan="2">ε = 0.25</td><td><strong>74.1</strong></td><td><strong>63.0</strong></td><td>83.7</td><td>48.9</td><td>83.7</td><td>49.5</td><td>91.5</td><td>32.9</td><td>85.6</td><td>47.6</td></tr><tr><td colspan="2">ε = 0.5</td><td><strong>65.4</strong></td><td><strong>66.8</strong></td><td>74.4</td><td>58.8</td><td>75.2</td><td>58.8</td><td>92.3</td><td>32.9</td><td><strong>72.3</strong></td><td><strong>61.4</strong></td></tr><tr><td colspan="2">PGDi, FGSM, BIM, CWi, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">ε = 0.3125</td><td><strong>74.8</strong></td><td><strong>59.1</strong></td><td>78.0</td><td>55.1</td><td>81.3</td><td>52.5</td><td>86.2</td><td>43.9</td><td>80.9</td><td>52.4</td></tr><tr><td colspan="2">L<sub>∞</sub> Average</td><td><strong>77.9</strong></td><td><strong>55.1</strong></td><td>83.3</td><td>46.3</td><td>83.6</td><td>47.8</td><td>88.7</td><td>38.8</td><td>83.0</td><td>49.5</td></tr><tr><td colspan="2">No norm</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td><td>AUROC↑%%</td><td>FPR<sub>99%</sub>%%</td></tr><tr><td colspan="2">STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="2">No ε</td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td></tr><tr><td colspan="2">No norm Average</td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td><td><strong>98.1</strong></td><td><strong>8.2</strong></td></tr></tbody></table>

LID is quite effective in detecting STA. Contrary to the other methods, LID has more difficulty detecting attacks with significant perturbations. The maximum decrease in AUROC↑% considering MEAD is slightly higher than 8 percentage points. Even if the results seem to be quite similar among the single-armed, the LID-based detector trained on MNIST seems more vulnerable to the attacks generated thanks to the Kullback-Leibler divergence on L₁-norm-based attacks and sensitive to the Fisher-Rao distance under L₂ threats.
FS

In Table B.11, we show the result of our MEAD framework on MNIST, evaluated on FS.

<table><caption>**Table B.11: Performances on FS per objective and in MEAD on MNIST.**
The worst results among all the settings is in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th>FS</th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr><tr><th>Norm L<sub>1</sub></th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th><th>AUROC↑%</th><th>FPR<sub>95%</sub>%</th></tr></thead><tbody><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>59.2</td><td>88.1</td><td>63.3</td><td>85.4</td><td>62.6</td><td>87.1</td><td>59.2</td><td>84.7</td><td>59.8</td><td>89.5</td></tr><tr><td>ε = 10</td><td>72.0</td><td>76.3</td><td>76.8</td><td>68.6</td><td>76.9</td><td>67.8</td><td>73.0</td><td>70.0</td><td>75.6</td><td>69.8</td></tr><tr><td>ε = 15</td><td>86.5</td><td>56.4</td><td>90.7</td><td>45.2</td><td>90.9</td><td>44.3</td><td>84.9</td><td>54.2</td><td>90.7</td><td>44.5</td></tr><tr><td>ε = 20</td><td>87.9</td><td>54.1</td><td>92.3</td><td>41.3</td><td>92.5</td><td>40.0</td><td>90.8</td><td>42.3</td><td>92.5</td><td>40.5</td></tr><tr><td>ε = 25</td><td>86.6</td><td>56.0</td><td>90.4</td><td>46.1</td><td>90.5</td><td>45.9</td><td>92.0</td><td>39.0</td><td>90.9</td><td>46.5</td></tr><tr><td>ε = 30</td><td>83.9</td><td>60.4</td><td>88.0</td><td>53.0</td><td>88.3</td><td>50.9</td><td>92.0</td><td>39.3</td><td>89.5</td><td>49.9</td></tr><tr><td>ε = 40</td><td>72.3</td><td>76.0</td><td>82.5</td><td>63.8</td><td>82.7</td><td>63.8</td><td>90.8</td><td>41.8</td><td>84.6</td><td>60.8</td></tr><tr><td>L<sub>1</sub> Average</td><td>79.8</td><td>66.8</td><td>83.4</td><td>57.6</td><td>83.5</td><td>57.1</td><td>83.2</td><td>53.0</td><td>83.4</td><td>57.4</td></tr><tr><td>Norm L<sub>2</sub></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>56.6</td><td>90.5</td><td>58.3</td><td>89.2</td><td>57.7</td><td>91.4</td><td>57.0</td><td>89.4</td><td>57.4</td><td>87.9</td></tr><tr><td>ε = 0.25</td><td>56.2</td><td>90.3</td><td>58.3</td><td>85.4</td><td>58.5</td><td>85.8</td><td>58.0</td><td>89.3</td><td>55.9</td><td>89.1</td></tr><tr><td>ε = 0.3125</td><td>57.1</td><td>88.1</td><td>60.3</td><td>85.6</td><td>60.1</td><td>86.6</td><td>60.8</td><td>86.2</td><td>57.7</td><td>91.3</td></tr><tr><td>ε = 0.5</td><td>59.5</td><td>85.4</td><td>62.9</td><td>82.7</td><td>62.4</td><td>85.4</td><td>64.0</td><td>81.7</td><td>60.5</td><td>85.9</td></tr><tr><td>ε = 1</td><td>76.9</td><td>67.1</td><td>80.2</td><td>62.8</td><td>80.2</td><td>62.5</td><td>76.4</td><td>64.5</td><td>79.6</td><td>61.0</td></tr><tr><td>ε = 1.5</td><td>89.2</td><td>47.0</td><td>92.9</td><td>33.3</td><td>93.1</td><td>33.2</td><td>86.9</td><td>47.2</td><td>92.8</td><td>35.5</td></tr><tr><td>ε = 2</td><td>88.8</td><td>50.7</td><td>92.4</td><td>40.5</td><td>92.7</td><td>39.1</td><td>91.2</td><td>41.7</td><td>93.2</td><td>36.3</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>88.3</td><td>52.0</td><td>88.3</td><td>52.0</td><td>88.3</td><td>52.0</td><td>88.3</td><td>52.0</td><td>88.3</td><td>52.0</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>68.6</td><td>81.7</td><td>68.6</td><td>81.7</td><td>68.6</td><td>81.7</td><td>68.6</td><td>81.7</td><td>68.6</td><td>81.7</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>93.4</td><td>36.6</td><td>93.4</td><td>36.6</td><td>93.4</td><td>36.6</td><td>93.4</td><td>36.6</td><td>93.4</td><td>36.6</td></tr><tr><td>L<sub>2</sub> Average</td><td>73.5</td><td>69.0</td><td>75.6</td><td>65.0</td><td>75.5</td><td>65.4</td><td>74.5</td><td>67.0</td><td>74.7</td><td>65.7</td></tr><tr><td>Norm L<sub>∞</sub></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>55.0</td><td>90.4</td><td>59.6</td><td>87.8</td><td>58.1</td><td>88.7</td><td>58.9</td><td>85.6</td><td>57.0</td><td>88.4</td></tr><tr><td>ε = 0.0625</td><td>62.8</td><td>83.5</td><td>68.4</td><td>76.0</td><td>67.4</td><td>75.9</td><td>64.3</td><td>80.5</td><td>67.2</td><td>76.0</td></tr><tr><td>ε = 0.25</td><td>96.7</td><td>17.9</td><td>98.6</td><td>6.7</td><td>98.7</td><td>5.7</td><td>96.7</td><td>17.4</td><td>99.2</td><td>3.4</td></tr><tr><td>ε = 0.5</td><td>82.2</td><td>60.0</td><td>91.9</td><td>37.7</td><td>91.9</td><td>37.1</td><td>90.2</td><td>43.9</td><td>93.0</td><td>34.4</td></tr><tr><td>PGDi, FGSM, BIM, CWi, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>85.1</td><td>65.8</td><td>85.7</td><td>64.8</td><td>85.0</td><td>65.7</td><td>84.9</td><td>66.1</td><td>85.7</td><td>64.9</td></tr><tr><td>L<sub>∞</sub> Average</td><td>76.4</td><td>63.5</td><td>80.8</td><td>54.6</td><td>80.2</td><td>54.6</td><td>79.0</td><td>58.7</td><td>80.4</td><td>58.2</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td></tr><tr><td>No norm Average</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td><td>61.5</td><td>85.9</td></tr></tbody></table>

Despite having trouble detecting attacks with a small maximal perturbation $\epsilon$, FS detectors are not that bad at detecting adversarial examples. The attacks based on the Gini Impurity Score are the least detected ones among all the single-armed settings. The decrease in terms of AUROC↑% is, in that case, 8 percentage points at most.
MagNet

In Table B.12, we show the result of our MEAD framework on MNIST, evaluated on MagNet.

<table><caption>**Table B.12: Performances on MagNet per objective and in MEAD on MNIST.** The worst results among all the settings are shown in **bold**; the ones in the single-armed setting is **underlined**. No norm denotes the group of attacks that do not depend on the norm constraint.</caption><thead><tr><th></th><th colspan="2">MEAD</th><th colspan="2">ACE</th><th colspan="2">KL</th><th colspan="2">Gini</th><th colspan="2">FR</th></tr><tr><th></th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><td colspan="11"><strong>MagNet</strong></td></tr><tr><td colspan="11"><strong>Norm L<sub>1</sub></strong></td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>87.6</td><td>37.1</td><td>88.5</td><td>35.1</td><td>88.8</td><td>36.8</td><td>88.7</td><td>34.6</td><td>87.7</td><td>36.6</td></tr><tr><td>ε = 10</td><td>99.2</td><td>2.7</td><td>99.3</td><td>2.3</td><td>99.2</td><td>2.5</td><td>99.4</td><td>1.9</td><td>99.2</td><td>2.3</td></tr><tr><td>ε = 15</td><td>99.9</td><td>0.2</td><td>99.9</td><td>0.1</td><td>99.9</td><td>0.2</td><td>100.0</td><td>0.1</td><td>99.9</td><td>0.1</td></tr><tr><td>ε = 20</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>ε = 25</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>ε = 40</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>L<sub>1</sub> Average</td><td>98.1</td><td>5.7</td><td>98.2</td><td>5.4</td><td>98.3</td><td>5.6</td><td>98.3</td><td>5.2</td><td>98.1</td><td>5.6</td></tr><tr><td colspan="11"><strong>Norm L<sub>2</sub></strong></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>64.3</td><td>82.4</td><td>65.6</td><td>80.4</td><td>65.5</td><td>82.5</td><td>65.7</td><td>80.1</td><td>63.0</td><td>84.0</td></tr><tr><td>ε = 0.25</td><td>74.4</td><td>68.3</td><td>75.5</td><td>66.8</td><td>76.6</td><td>66.4</td><td>77.2</td><td>68.0</td><td>73.4</td><td>67.0</td></tr><tr><td>ε = 0.3125</td><td>79.7</td><td>61.1</td><td>81.0</td><td>56.7</td><td>82.0</td><td>56.5</td><td>81.9</td><td>61.3</td><td>78.4</td><td>57.1</td></tr><tr><td>ε = 0.5</td><td>90.8</td><td>32.2</td><td>91.9</td><td>30.8</td><td>91.9</td><td>31.0</td><td>91.7</td><td>32.2</td><td>91.0</td><td>31.1</td></tr><tr><td>ε = 1</td><td>99.1</td><td>3.1</td><td>99.6</td><td>1.6</td><td>99.5</td><td>1.7</td><td>98.2</td><td>8.4</td><td>99.5</td><td>1.8</td></tr><tr><td>ε = 1.5</td><td>99.8</td><td>0.3</td><td>100.0</td><td>0.1</td><td>100.0</td><td>0.1</td><td>99.5</td><td>1.6</td><td>100.0</td><td>0.1</td></tr><tr><td>ε = 2</td><td>99.9</td><td>0.1</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>99.7</td><td>0.4</td><td>100.0</td><td>0.0</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>99.4</td><td>1.1</td><td>99.4</td><td>1.1</td><td>99.4</td><td>1.1</td><td>99.4</td><td>1.1</td><td>99.4</td><td>1.1</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>92.8</td><td>38.3</td><td>92.8</td><td>38.3</td><td>92.8</td><td>38.3</td><td>92.8</td><td>38.3</td><td>92.8</td><td>38.3</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>99.9</td><td>0.0</td><td>99.9</td><td>0.0</td><td>99.9</td><td>0.0</td><td>99.9</td><td>0.0</td><td>99.9</td><td>0.0</td></tr><tr><td>L<sub>2</sub> Average</td><td>90.0</td><td>28.7</td><td>90.6</td><td>27.6</td><td>90.8</td><td>27.8</td><td>90.6</td><td>29.1</td><td>89.7</td><td>28.1</td></tr><tr><td colspan="11"><strong>Norm L<sub>∞</sub></strong></td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>100.0</td><td>0.1</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.1</td><td>100.0</td><td>0.0</td></tr><tr><td>ε = 0.0625</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>ε = 0.25</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>ε = 0.5</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td><td>100.0</td><td>0.0</td></tr><tr><td>PGDi, FGSM, BIM, CWi, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>92.6</td><td>51.4</td><td>92.6</td><td>51.4</td><td>92.2</td><td>53.1</td><td>92.3</td><td>52.5</td><td>92.5</td><td>51.8</td></tr><tr><td>L<sub>∞</sub> Average</td><td>98.5</td><td>10.3</td><td>98.5</td><td>10.3</td><td>98.4</td><td>10.6</td><td>98.5</td><td>10.5</td><td>98.5</td><td>10.4</td></tr><tr><td colspan="11"><strong>No norm</strong></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td></tr><tr><td>No norm Average</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td><td>86.9</td><td>74.3</td></tr></tbody></table>

MagNet is effective on MNIST. It is pretty close to the perfect detector for $L_\infty$ and $L_1$ attacks. Anyway, the Fisher-Rao-based attacks are the most disruptive ones for such detectors. Similar to the CIFAR10 case, the results using MEAD are quite close to the worst single-armed setting case. The decrease in AUROC↑% between MEAD and the worst single-armed setting is at most 0.5 percentage points.
<figure><img src="image_22.png" /></figure>
# Appendix to Chapter 5

## C.1 On the optimization of Eq. (5.5)

The maximization problem in Eq. (5.5) is well-posed given that the mutual information is a concave function of $\omega \in \Omega$. Although from the theoretical point of view, Eq. (5.5) guarantees the optimal solution for the average regret minimization problem, in practice, we have to deal with some technical limitations. For the optimization of Eq. (5.5), we rely on the SciPy [VGO$^{+}$20] library, package `optimize`, function `minimize`<fnref n="1" /> which uses the *Sequential Least Squares Programming* (SLSQP) algorithm to find the optimum. This algorithm relies on local optimization and is particularly straightforward when dealing with non-linear equations and equality and inequality constraints, as in our case. Overall, we obtained the satisfactory results provided in the paper by assigning default values to all the parameters and by setting a uniform distribution $[\omega_1, \omega_2, \omega_3, \omega_4] = [.25, .25, .25, .25]$ as the initial point in the solutions space.

Although these results are satisfactory and confirm the value of the sound theoretical framework, we propose in Section 5.1. We are well aware that, in some cases, as in Fig. 5.2a, the proposed aggregation slightly underperforms in terms of accuracy w.r.t. the best detector in the set of allowed detectors. In this regard, we would like to raise a couple of points that are interesting for practitioners and possible future research:

1. For each input sample, we solve one different optimization problem: although the algorithm above always reaches the end with a success state,

<footnote n="1">¹Therefore we invert the sign of the objective function.</footnote>
given the finite amount of iterations and the tolerance which decides the stopping criterion, further sample-by-sample parameter optimization may be required. At this time, we have not delved into the problem, and we leave this for future research.

2. The hard decisions made by the single detectors only depend on the argmax of their soft-probabilities. On the contrary, the optimization in Eq. (5.5) considers the complete soft-probability distributions output by every single detector. Indeed, although the hard decision on two randomly considered samples can be right for both, often, the confidence in these decisions can be very different (i.e., two correctly classified samples may have utterly different associated soft probabilities). Further research on how differently accurate detectors influence the optimization in Eq. (5.5) is left for future work.

## C.2 Supplementary Results of Section 5.2

In the following, we provide further discussions on the experiments in Section 5.2 that have not been included in the main chapter.

### Experimental environment

We run each experiment on a machine equipped with an Intel(R) Xeon(R) Gold 6226 CPU, 2.70GHz clock frequency, and a Tesla V100-SXM2-32GB GPU.

### Time measurements

<table><tr><td>Training 1 single detector in our method</td><td>1h45m10s</td></tr><tr><td>Evaluating the optimization in our method</td><td>1m35s (for one attack)</td></tr><tr><td>Training NSS</td><td>3m30s</td></tr><tr><td>Evaluating NSS</td><td>20s (for one attack)</td></tr><tr><td colspan="2">On the largest set of simultaneous attacks (13 attacks):</td></tr><tr><td>Ours</td><td>1m35s * 13 ~ 21m</td></tr><tr><td>NSS</td><td>20s * 13 ~ 4m</td></tr></table>
<figure><img src="image_23.png" /><figcaption>**Figure C.1:** The *shallow* detectors are named after the loss function used to craft the attacks they are trained to detect. Overall, the SOTA methods NSS and FS outperform all the individual shallow detectors. The aggregation we propose allows using the shallow models to attain a detector whose performance is consistently comparable and, in many cases, better than SOTA.</figcaption></figure>

## C.2.1 On the MEAD framework

### State-of-the-art detectors

Chapter 4 suggests NSS [KFHD20] and FS [XEQ18] as the most robust methods in the simultaneous attacks detection scheme (i.e., MEAD). We remind that NSS is a supervised method that extracts the *natural scene statistics* of the natural and adversarial examples to train a SVM. On the contrary, FS is an unsupervised method that uses *feature squeezing* (i.e., reducing the color depth of images and using smoothing to reduce the variation among the pixels) to compare the model's predictions.

In particular, we choose NSS as a method to compare for multiple reasons:

1. NSS achieves the best overall score in terms of AUROC↑% and FPR↓$_{95\%}$% among the SOTA against simultaneous attacks (cf. Table 4.3).

2. NSS achieves the best score in terms of AUROC↑% and FPR↓$_{95\%}$% under the $L_\infty$ norm where the biggest group of simultaneous attacks are evaluated (see Table 5.1). This is stressed in the plots in Fig. C.1. Moreover, FS reaches better performance w.r.t. the proposed method only with PGD1 and PGD2 when the perturbation magnitude is small and in CW2.
<table><caption>**Table C.1: Comparison between Ours and Ours+FS on CIFAR10.** The * symbol means the perturbation mechanism is executed in parallel four times starting from the same original clean sample, each time using one of the objective losses between ACE Eq. (4.2), KL Eq. (4.3), FR Eq. (4.4), Gini Eq. (4.5). We focus only on the cases in which the proposed method is outperformed by the corresponding competitors.</caption><thead><tr><th rowspan="3"></th><th colspan="4">CIFAR10</th></tr><tr><th colspan="2">Ours</th><th colspan="2">Ours+FS</th></tr><tr><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><th colspan="5">Norm L<sub>1</sub></th></tr><tr><th>PGD1*</th><td></td><td></td><td></td><td></td></tr><tr><th>ε = 5</th><td>62.1</td><td>87.1</td><td>69.4</td><td>74.5</td></tr><tr><th>ε = 10</th><td>56.8</td><td>90.6</td><td>76.8</td><td>64.5</td></tr><tr><th>ε = 15</th><td>69.3</td><td>84.4</td><td>77.6</td><td>60.3</td></tr><tr><th colspan="5">Norm L<sub>2</sub></th></tr><tr><th>PGD2*</th><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.125</th><td>63.9</td><td>85.4</td><td>67.9</td><td>76.4</td></tr><tr><th>ε = 0.25</th><td>57.1</td><td>90.5</td><td>76.0</td><td>64.7</td></tr><tr><th>ε = 0.3125</th><td>61.0</td><td>88.9</td><td>77.2</td><td>62.9</td></tr><tr><th>CW2</th><td></td><td></td><td></td><td></td></tr><tr><th>ε = 0.01</th><td>53.4</td><td>92.2</td><td>86.4</td><td>46.8</td></tr></tbody></table>

3. The case study for our aggregator in the experimental section is based on supervised detectors as a consequence the comparison with a supervised detector was a natural choice.

For the sake of completeness, the performances of NSS and FS under MEAD are given in Fig. C.1. As shown before for Ours+NSS, in Table C.1 we propose an analysis of the performance of our method before and after adding the FS unsupervised detection mechanism to the pull of available detectors, showing a stark improvement in the latter case.

## Attacks

We want to emphasize that, differently from the literature, we are the first to consider a defense mechanism against the simultaneous attack setting in which we detect attacks based on four different losses. More specifically, for each ‘clean dataset’ (in our case CIFAR10 and SVHN):

* No. of adversarial examples generated with:
<table><caption>**Table C.2: Simultaneous attacks detection: NSS on CIFAR10.** We train NSS on natural and adversarial examples created with PGD algorithm and $L_\infty$ norm constraint. The perturbation magnitude $\epsilon$ is shown in the columns. We indicate in **bold** the best result.</caption><thead><tr><th rowspan="3"></th><th colspan="12">NSS</th></tr><tr><th colspan="2">0.03125</th><th colspan="2">0.0625</th><th colspan="2">0.125</th><th colspan="2">0.25</th><th colspan="2">0.3125</th><th colspan="2">0.5</th></tr><tr><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><td colspan="14"><strong>Norm L<sub>1</sub></strong></td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>48.5</td><td>94.2</td><td>47.7</td><td>94.7</td><td>46.6</td><td>95.6</td><td>46.8</td><td>95.5</td><td>47.0</td><td>95.4</td><td>46.5</td><td>95.6</td></tr><tr><td>ε = 10</td><td>54.0</td><td>90.3</td><td>53.4</td><td>90.8</td><td>51.6</td><td>94.3</td><td>50.4</td><td>94.9</td><td>50.4</td><td>94.9</td><td>50.9</td><td>94.7</td></tr><tr><td>ε = 15</td><td>58.8</td><td>86.8</td><td>58.1</td><td>87.4</td><td>55.8</td><td>92.8</td><td>53.8</td><td>94.2</td><td>53.2</td><td>94.4</td><td>54.5</td><td>93.7</td></tr><tr><td>ε = 20</td><td>63.5</td><td>82.3</td><td>62.7</td><td>82.7</td><td>60.1</td><td>90.7</td><td>57.4</td><td>93.2</td><td>56.7</td><td>93.6</td><td>58.2</td><td>92.3</td></tr><tr><td>ε = 25</td><td>67.7</td><td>77.2</td><td>66.8</td><td>78.4</td><td>64.0</td><td>87.8</td><td>61.0</td><td>92.0</td><td>60.1</td><td>92.6</td><td>61.9</td><td>90.6</td></tr><tr><td>ε = 30</td><td>71.4</td><td>73.4</td><td>70.5</td><td>73.5</td><td>67.6</td><td>83.7</td><td>64.4</td><td>90.4</td><td>63.4</td><td>91.4</td><td>65.4</td><td>88.2</td></tr><tr><td>ε = 40</td><td>76.1</td><td>67.3</td><td>75.3</td><td>68.0</td><td>72.6</td><td>75.4</td><td>69.4</td><td>87.2</td><td>68.5</td><td>88.9</td><td>70.4</td><td>83.4</td></tr><tr><td colspan="14"><strong>Norm L<sub>2</sub></strong></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>48.3</td><td>94.3</td><td>47.5</td><td>94.8</td><td>46.6</td><td>95.6</td><td>46.7</td><td>95.5</td><td>47.1</td><td>95.4</td><td>46.5</td><td>95.6</td></tr><tr><td>ε = 0.25</td><td>53.2</td><td>91.2</td><td>52.6</td><td>91.6</td><td>50.9</td><td>94.6</td><td>50.0</td><td>95.0</td><td>50.0</td><td>95.0</td><td>50.3</td><td>94.8</td></tr><tr><td>ε = 0.3125</td><td>55.8</td><td>89.2</td><td>55.2</td><td>89.9</td><td>53.3</td><td>93.7</td><td>51.7</td><td>94.6</td><td>51.5</td><td>94.7</td><td>52.3</td><td>94.3</td></tr><tr><td>ε = 0.5</td><td>63.3</td><td>82.6</td><td>62.6</td><td>83.0</td><td>60.0</td><td>90.7</td><td>57.4</td><td>93.2</td><td>56.7</td><td>93.5</td><td>58.2</td><td>92.4</td></tr><tr><td>ε = 1</td><td>76.4</td><td>67.5</td><td>75.7</td><td>67.8</td><td>73.1</td><td>75.0</td><td>70.1</td><td>86.7</td><td>69.2</td><td>88.5</td><td>71.0</td><td>83.0</td></tr><tr><td>ε = 1.5</td><td>81.0</td><td>63.0</td><td>80.5</td><td>62.7</td><td>78.5</td><td>63.5</td><td>76.2</td><td>80.7</td><td>75.6</td><td>83.2</td><td>76.9</td><td>74.4</td></tr><tr><td>ε = 2</td><td>82.6</td><td>62.3</td><td>82.1</td><td>61.6</td><td>80.6</td><td>62.5</td><td>78.6</td><td>78.5</td><td>78.1</td><td>81.2</td><td>79.1</td><td>72.1</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>57.0</td><td>91.7</td><td>56.7</td><td>91.7</td><td>55.6</td><td>93.6</td><td>54.6</td><td>94.1</td><td>54.2</td><td>94.3</td><td>54.7</td><td>94.0</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>56.4</td><td>90.8</td><td>55.9</td><td>90.9</td><td>54.5</td><td>93.7</td><td>53.4</td><td>94.3</td><td>53.0</td><td>94.5</td><td>53.6</td><td>94.1</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>66.1</td><td>87.0</td><td>65.1</td><td>88.2</td><td>63.0</td><td>91.3</td><td>61.2</td><td>92.6</td><td>60.8</td><td>92.9</td><td>61.6</td><td>92.1</td></tr><tr><td colspan="14"><strong>Norm L<sub>∞</sub></strong></td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>83.0</td><td>55.3</td><td>82.1</td><td>55.2</td><td>80.3</td><td>57.8</td><td>77.4</td><td>77.0</td><td>76.8</td><td>81.3</td><td>78.3</td><td>65.4</td></tr><tr><td>ε = 0.0625</td><td>96.0</td><td>17.2</td><td>94.6</td><td>17.4</td><td>94.9</td><td>19.2</td><td>94.3</td><td>21.6</td><td>94.4</td><td>21.1</td><td>94.4</td><td>21.1</td></tr><tr><td>ε = 0.25</td><td>97.3</td><td>0.6</td><td>94.7</td><td>5.9</td><td>96.5</td><td>2.5</td><td>96.9</td><td>1.7</td><td>97.2</td><td>1.1</td><td>96.7</td><td>2.1</td></tr><tr><td>ε = 0.5</td><td>82.5</td><td>100.0</td><td>80.4</td><td>100.0</td><td>81.9</td><td>100.0</td><td>82.2</td><td>100.0</td><td>82.4</td><td>100.0</td><td>82.0</td><td>100.0</td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>9.4</td><td>99.9</td><td>10.4</td><td>100.0</td><td>26.2</td><td>99.9</td><td>30.9</td><td>100.0</td><td>33.8</td><td>100.0</td><td>27.3</td><td>100.0</td></tr><tr><td>PGDi, FGSM, BIM, CW1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>63.2</td><td>99.1</td><td>62.7</td><td>99.0</td><td>61.9</td><td>99.3</td><td>60.9</td><td>99.5</td><td>60.5</td><td>99.5</td><td>61.2</td><td>99.4</td></tr><tr><td colspan="14"><strong>No norm</strong></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>88.5</td><td>38.8</td><td>92.0</td><td>25.1</td><td>92.1</td><td>22.4</td><td>93.3</td><td>18.3</td><td>92.7</td><td>19.6</td><td>92.7</td><td>19.7</td></tr></tbody></table>

- L₁ norm: 7 (no. of $\epsilon$) * 1 (PGD algorithm) * 4 (no. of losses) = 28 ('adversarial datasets')

- L₂ norm: 7 (no. of $\epsilon$) * 1 (PGD algorithm) * 4 (no. of losses) + 3 (CW2, HOP, DeepFool) = 31 ('adversarial datasets')

- L_∞ norm: 6 (no. of $\epsilon$) * 3 (PGD, FGSM, BIM algorithms) * 4 (no. of losses) + 2 = 74 ('adversarial datasets')

- No norm: 1 ('adversarial dataset')

=> For a total of 28 + 31 + 74 + 1 = 134 'adversarial datasets' for each 'clean dataset'.

Moreover, it is interesting to notice that the experiments on CIFAR10 and SVHN represent a satisfying choice to show that state-of-the-art detection mechanisms struggle to maintain good performance when faced with the framework of simultaneous attacks. That said, we leave the evaluation of larger datasets as future
<table><caption>**Table C.3:** Simultaneous attacks detection: the proposed method on CIFAR10. We train NSS on natural and adversarial examples created with PGD algorithm and $L_\infty$ norm constraint. The perturbation magnitude $\epsilon$ is shown in the columns. We indicate in **bold** the best result.</caption><thead><tr><th rowspan="3"></th><th colspan="12">Ours</th></tr><tr><th colspan="2">0.03125</th><th colspan="2">0.0625</th><th colspan="2">0.125</th><th colspan="2">0.25</th><th colspan="2">0.3125</th><th colspan="2">0.5</th></tr><tr><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th><th>AUROC†%</th><th>FPR<sub>100%</sub>%</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>69.7</td><td>82.5</td><td>65.5</td><td>81.5</td><td>62.1</td><td>87.1</td><td>56.3</td><td>93.8</td><td>53.2</td><td>94.8</td><td>48.5</td><td>95.5</td></tr><tr><td>ε = 10</td><td>62.3</td><td>83.3</td><td>86.3</td><td>73.9</td><td>56.8</td><td>90.6</td><td>52.1</td><td>94.7</td><td>52.9</td><td>94.6</td><td>50.9</td><td>95.0</td></tr><tr><td>ε = 15</td><td>66.6</td><td>72.7</td><td>77.9</td><td>73.7</td><td>69.3</td><td>84.4</td><td>65.5</td><td>89.0</td><td>64.3</td><td>91.0</td><td>60.4</td><td>93.1</td></tr><tr><td>ε = 20</td><td>72.8</td><td>58.0</td><td>59.3</td><td>78.7</td><td>73.1</td><td>73.8</td><td>82.5</td><td>73.5</td><td>85.4</td><td>69.2</td><td>90.3</td><td>90.3</td></tr><tr><td>ε = 25</td><td>76.8</td><td>42.4</td><td>89.4</td><td>35.9</td><td>87.1</td><td>50.8</td><td>81.3</td><td>68.6</td><td>79.3</td><td>78.0</td><td>74.8</td><td>87.2</td></tr><tr><td>ε = 30</td><td>79.1</td><td>31.1</td><td>91.7</td><td>21.4</td><td>90.3</td><td>35.4</td><td>84.3</td><td>61.2</td><td>81.9</td><td>73.5</td><td>77.5</td><td>85.3</td></tr><tr><td>ε = 40</td><td>80.8</td><td>22.2</td><td>93.0</td><td>15.0</td><td>92.1</td><td>26.4</td><td>85.9</td><td>56.8</td><td>83.1</td><td>71.4</td><td>78.8</td><td>84.5</td></tr><tr><td>Norm L<sub>2</sub></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>71.3</td><td>80.8</td><td>67.0</td><td>80.2</td><td>63.9</td><td>85.4</td><td>56.2</td><td>93.8</td><td>53.8</td><td>94.7</td><td>48.6</td><td>95.5</td></tr><tr><td>ε = 0.25</td><td>63.1</td><td>83.4</td><td>62.8</td><td>86.7</td><td>57.1</td><td>90.5</td><td>52.3</td><td>94.6</td><td>52.6</td><td>94.7</td><td>49.9</td><td>95.2</td></tr><tr><td>ε = 0.3125</td><td>64.1</td><td>79.3</td><td>67.3</td><td>83.1</td><td>61.0</td><td>88.9</td><td>58.0</td><td>92.8</td><td>57.7</td><td>93.3</td><td>54.5</td><td>94.4</td></tr><tr><td>ε = 0.5</td><td>72.9</td><td>58.9</td><td>83.7</td><td>60.7</td><td>79.4</td><td>73.2</td><td>74.6</td><td>81.4</td><td>73.4</td><td>85.4</td><td>68.8</td><td>90.5</td></tr><tr><td>ε = 1</td><td>81.0</td><td>21.7</td><td>92.9</td><td>15.5</td><td>91.4</td><td>26.4</td><td>85.5</td><td>57.2</td><td>82.9</td><td>72.2</td><td>78.7</td><td>84.7</td></tr><tr><td>ε = 1.5</td><td>81.5</td><td>19.2</td><td>93.2</td><td>14.2</td><td>91.9</td><td>24.2</td><td>85.9</td><td>56.3</td><td>83.2</td><td>71.9</td><td>79.2</td><td>84.4</td></tr><tr><td>ε = 2</td><td>81.6</td><td>19.0</td><td>93.2</td><td>14.1</td><td>91.9</td><td>24.1</td><td>85.9</td><td>56.3</td><td>83.3</td><td>71.8</td><td>79.2</td><td>84.4</td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>91.1</td><td>22.0</td><td>87.4</td><td>33.9</td><td>81.9</td><td>54.8</td><td>70.0</td><td>84.4</td><td>64.2</td><td>91.5</td><td>56.3</td><td>94.4</td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>52.9</td><td>90.5</td><td>50.7</td><td>90.6</td><td>53.4</td><td>92.2</td><td>53.1</td><td>94.4</td><td>52.0</td><td>94.8</td><td>50.9</td><td>95.0</td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>91.3</td><td>20.9</td><td>89.0</td><td>31.0</td><td>86.1</td><td>49.1</td><td>77.0</td><td>80.7</td><td>72.4</td><td>88.1</td><td>64.3</td><td>92.8</td></tr><tr><td>Norm L<sub>∞</sub></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>67.2</td><td>77.3</td><td>77.8</td><td>65.2</td><td>82.3</td><td>59.7</td><td>78.0</td><td>72.1</td><td>73.7</td><td>83.8</td><td>64.1</td><td>92.2</td></tr><tr><td>ε = 0.0625</td><td>69.0</td><td>83.6</td><td>85.3</td><td>47.4</td><td>92.0</td><td>29.6</td><td>90.7</td><td>35.7</td><td>88.0</td><td>45.6</td><td>81.3</td><td>78.3</td></tr><tr><td>ε = 0.25</td><td>72.0</td><td>67.4</td><td>91.8</td><td>23.2</td><td>95.9</td><td>8.8</td><td>94.1</td><td>15.4</td><td>92.6</td><td>19.5</td><td>91.6</td><td>26.5</td></tr><tr><td>ε = 0.5</td><td>58.3</td><td>84.8</td><td>84.2</td><td>44.1</td><td>94.6</td><td>9.7</td><td>91.2</td><td>16.5</td><td>90.5</td><td>18.8</td><td>91.3</td><td>22.3</td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>69.0</td><td>79.1</td><td>84.1</td><td>41.9</td><td>88.9</td><td>40.8</td><td>86.6</td><td>52.3</td><td>85.4</td><td>60.4</td><td>80.7</td><td>79.0</td></tr><tr><td>PGDi, FGSM, BIM, CW1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>66.6</td><td>75.0</td><td>80.6</td><td>51.5</td><td>80.0</td><td>61.1</td><td>72.0</td><td>84.0</td><td>67.2</td><td>90.0</td><td>60.0</td><td>93.6</td></tr><tr><td>No norm</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>84.8</td><td>33.8</td><td>85.0</td><td>41.5</td><td>82.7</td><td>52.4</td><td>72.9</td><td>77.7</td><td>70.2</td><td>81.7</td><td>63.1</td><td>92.1</td></tr></tbody></table>

work.

## Simulations adversarial attack according to different $\epsilon$

As discussed in Section 3.4, both NSS and the *shallow* detectors aggregated via the proposed method are trained on natural and adversarial examples created with PGD algorithm and $L_\infty$ norm constraint. We show in Tables C.2 to C.5 the results of the two methods according to $\epsilon \in \{.03125, .0625, .125, .25, .3125, .5\}$.

## C.2.2 The proposed aggregator against the adaptive-attacks in the MEAD scenario

We present a new experimental setting to address the case in which also the detectors are attacked at the same time as the target classifier, taking the cue from [BHP+21, CW17a, TCBM20, CW17b]. It is important to note that, in the spirit of the MEAD framework, we are not simply considering a scenario in which
<table><caption>**Table C.4: Simultaneous attacks detection: NSS on SVHN.** We train NSS on natural and adversarial examples created with PGD algorithm and $L_\infty$ norm constraint. The perturbation magnitude $\epsilon$ is shown in the columns. We indicate in **bold** the best result.</caption><thead><tr><th rowspan="3"></th><th colspan="12">NSS</th></tr><tr><th colspan="2">0.03125</th><th colspan="2">0.0625</th><th colspan="2">0.125</th><th colspan="2">0.25</th><th colspan="2">0.3125</th><th colspan="2">0.5</th></tr><tr><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><td colspan="14"><strong>Norm L<sub>1</sub></strong></td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>37.9</td><td>89.3</td><td><strong>40.2</strong></td><td>91.3</td><td>37.2</td><td>89.2</td><td>4.9</td><td>35.5</td><td>0.3</td><td>8.5</td><td>0.0</td><td><strong>3.1</strong></td></tr><tr><td>ε = 10</td><td>33.7</td><td>89.3</td><td><strong>36.9</strong></td><td>91.3</td><td>34.6</td><td>89.2</td><td>6.0</td><td>35.5</td><td>0.4</td><td>8.5</td><td>0.0</td><td><strong>3.1</strong></td></tr><tr><td>ε = 15</td><td>31.9</td><td>89.3</td><td><strong>35.6</strong></td><td>91.3</td><td>34.4</td><td>89.2</td><td>7.6</td><td>35.5</td><td>0.5</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>ε = 20</td><td>31.5</td><td>89.3</td><td><strong>36.1</strong></td><td>91.3</td><td>35.7</td><td>89.2</td><td>9.5</td><td>35.5</td><td>0.6</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>ε = 25</td><td>32.8</td><td>89.3</td><td>37.8</td><td>91.3</td><td><strong>38.2</strong></td><td>89.2</td><td>11.7</td><td>35.5</td><td>0.9</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>ε = 30</td><td>34.5</td><td>89.3</td><td>39.8</td><td>91.3</td><td><strong>40.6</strong></td><td>89.2</td><td>14.1</td><td>35.5</td><td>1.2</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>ε = 40</td><td>37.9</td><td>89.3</td><td>43.1</td><td>91.3</td><td><strong>43.4</strong></td><td>89.0</td><td>16.4</td><td>35.5</td><td>2.2</td><td>8.5</td><td>0.3</td><td><strong>3.1</strong></td></tr><tr><td colspan="14"><strong>Norm L<sub>2</sub></strong></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>38.7</td><td>89.3</td><td><strong>40.8</strong></td><td>91.3</td><td>37.6</td><td>89.2</td><td>4.7</td><td>35.5</td><td>0.3</td><td>8.5</td><td>0.0</td><td><strong>3.1</strong></td></tr><tr><td>ε = 0.25</td><td>34.0</td><td>89.3</td><td><strong>37.2</strong></td><td>91.3</td><td>34.6</td><td>89.2</td><td>5.4</td><td>35.5</td><td>0.3</td><td>8.5</td><td>0.0</td><td><strong>3.1</strong></td></tr><tr><td>ε = 0.3125</td><td>32.6</td><td>89.3</td><td><strong>36.1</strong></td><td>91.3</td><td>34.1</td><td>89.2</td><td>6.1</td><td>35.5</td><td>0.4</td><td>8.5</td><td>0.0</td><td><strong>3.1</strong></td></tr><tr><td>ε = 0.5</td><td>31.4</td><td>89.3</td><td><strong>35.9</strong></td><td>91.3</td><td>35.4</td><td>89.2</td><td>8.9</td><td>35.5</td><td>0.5</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>ε = 1</td><td>37.4</td><td>89.3</td><td>42.5</td><td>91.3</td><td><strong>42.9</strong></td><td>89.2</td><td>16.0</td><td>35.5</td><td>2.1</td><td>8.5</td><td>0.3</td><td><strong>3.1</strong></td></tr><tr><td>ε = 1.5</td><td>40.0</td><td>89.3</td><td>46.3</td><td>91.3</td><td><strong>46.5</strong></td><td>88.4</td><td>17.2</td><td>35.5</td><td>2.8</td><td>8.5</td><td>0.6</td><td><strong>3.1</strong></td></tr><tr><td>ε = 2</td><td>42.1</td><td>89.3</td><td>49.8</td><td>91.3</td><td><strong>50.5</strong></td><td>88.0</td><td>18.7</td><td>35.5</td><td>3.2</td><td>8.5</td><td>0.8</td><td><strong>3.1</strong></td></tr><tr><td>DeepFool</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>38.1</td><td>89.3</td><td><strong>41.3</strong></td><td>91.3</td><td>39.7</td><td>89.2</td><td>9.2</td><td>35.5</td><td>0.8</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>37.9</td><td>89.3</td><td><strong>41.0</strong></td><td>91.3</td><td>39.5</td><td>89.2</td><td>9.3</td><td>35.5</td><td>0.8</td><td>8.5</td><td>0.1</td><td><strong>3.1</strong></td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>66.8</td><td>82.3</td><td><strong>67.6</strong></td><td>84.2</td><td>60.3</td><td>84.6</td><td>16.4</td><td>35.5</td><td>2.7</td><td>8.5</td><td>0.7</td><td><strong>3.1</strong></td></tr><tr><td colspan="14"><strong>Norm L<sub>∞</sub></strong></td></tr><tr><td>PGD1, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>84.1</td><td>49.7</td><td><strong>86.3</strong></td><td>46.9</td><td>77.5</td><td>72.1</td><td>22.2</td><td>33.2</td><td>4.3</td><td>8.5</td><td>1.2</td><td><strong>3.1</strong></td></tr><tr><td>ε = 0.0625</td><td>87.4</td><td><strong>0.2</strong></td><td><strong>88.9</strong></td><td>0.7</td><td>87.5</td><td>0.6</td><td>33.7</td><td>16.8</td><td>7.4</td><td>6.8</td><td>2.5</td><td><strong>2.7</strong></td></tr><tr><td>ε = 0.25</td><td>16.7</td><td>89.3</td><td>51.6</td><td>88.9</td><td><strong>52.0</strong></td><td>85.1</td><td>35.4</td><td><strong>0.1</strong></td><td>8.4</td><td><strong>0.1</strong></td><td>3.0</td><td><strong>0.1</strong></td></tr><tr><td>ε = 0.5</td><td>4.1</td><td>89.3</td><td><strong>46.7</strong></td><td>86.7</td><td>46.0</td><td>84.6</td><td>35.4</td><td><strong>0.1</strong></td><td>8.4</td><td><strong>0.1</strong></td><td>3.0</td><td><strong>0.1</strong></td></tr><tr><td>PGD1, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>22.8</td><td>89.3</td><td>32.9</td><td>91.3</td><td><strong>43.6</strong></td><td>89.2</td><td>30.3</td><td>32.7</td><td>7.1</td><td>8.5</td><td>2.5</td><td><strong>3.1</strong></td></tr><tr><td>PGD1, FGSM, BIM, CW1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>4.7</td><td>89.3</td><td><strong>41.3</strong></td><td>91.3</td><td>40.8</td><td>89.2</td><td>12.7</td><td>35.5</td><td>1.7</td><td>8.5</td><td>0.4</td><td><strong>3.1</strong></td></tr><tr><td colspan="14"><strong>No norm</strong></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>89.3</td><td><strong>0.0</strong></td><td><strong>91.2</strong></td><td>0.2</td><td>85.9</td><td>23.4</td><td>19.9</td><td>33.5</td><td>4.2</td><td>8.3</td><td>1.4</td><td><strong>3.1</strong></td></tr></tbody></table>

<figure><img src="image_24.png" /><figcaption>(a) Analysis AUROC↑%</figcaption></figure>

<figure><img src="image_25.png" /><figcaption>(b) Analysis FPR↓95%</figcaption></figure>

<caption>**Figure C.2: Our method against the adaptive-attacks under MEAD.** We consider the worst case scenario in Table C.6, i.e., when $\alpha = 0.1$.</caption>

a single adaptive attack is perpetrated on the classifier and detectors, but rather multiple adaptive attacks are concurrently occurring. We extend the framework to include two main cases: (i) for attacks on the classifier and the single detectors individually; (ii) for attacks on the classifier and all the detectors simultaneously.

The tables with the complete results are Tables C.6 and C.7, where $\alpha$ is the coefficient that controls the gradient's speed of the attack against the detectors.
<table><caption>**Table C.5: Simultaneous attacks detection: the proposed method on SVHN.**
We train NSS on natural and adversarial examples created with PGD algorithm and $L_\infty$ norm constraint. The perturbation magnitude $\epsilon$ is shown in the columns. We indicate in **bold** the best result.</caption><thead><tr><th rowspan="3"></th><th colspan="12">Ours</th></tr><tr><th colspan="3">0.03125</th><th colspan="3">0.0625</th><th colspan="3">0.125</th><th colspan="3">0.25</th><th colspan="3">0.3125</th><th colspan="3">0.5</th></tr><tr><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th><th>AUROC†%</th><th>FPR↓95%</th></tr></thead><tbody><tr><td colspan="15"><strong>Norm L<sub>1</sub></strong></td></tr><tr><td>PGD1</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>79.3</td><td>65.2</td><td>77.4</td><td>73.4</td><td>76.9</td><td>78.9</td><td>76.9</td><td>79.0</td><td>76.7</td><td>79.5</td><td>74.0</td><td>84.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 10</td><td>74.4</td><td>65.1</td><td>72.8</td><td>73.1</td><td>71.9</td><td>81.6</td><td>73.0</td><td>82.5</td><td>71.9</td><td>84.2</td><td>66.9</td><td>89.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 15</td><td>76.0</td><td>57.0</td><td>75.7</td><td>64.6</td><td>75.8</td><td>73.1</td><td>78.9</td><td>72.5</td><td>77.3</td><td>74.7</td><td>71.9</td><td>84.9</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 20</td><td>77.3</td><td>48.1</td><td>77.9</td><td>54.9</td><td>79.2</td><td>61.9</td><td>83.6</td><td>60.7</td><td>82.2</td><td>64.3</td><td>77.4</td><td>76.9</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 25</td><td>78.2</td><td>40.9</td><td>79.4</td><td>44.4</td><td>81.4</td><td>49.4</td><td>87.0</td><td>48.6</td><td>85.7</td><td>52.5</td><td>81.4</td><td>66.7</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 30</td><td>78.8</td><td>34.4</td><td>80.4</td><td>35.3</td><td>83.0</td><td>36.6</td><td>89.3</td><td>37.2</td><td>88.1</td><td>41.6</td><td>84.4</td><td>53.8</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 40</td><td>79.7</td><td>23.4</td><td>81.6</td><td>22.4</td><td>84.7</td><td>20.2</td><td>92.6</td><td>20.0</td><td>91.1</td><td>23.0</td><td>87.8</td><td>30.5</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="15"><strong>Norm L<sub>2</sub></strong></td></tr><tr><td>PGD2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>82.2</td><td>61.7</td><td>80.6</td><td>68.4</td><td>80.3</td><td>72.4</td><td>80.2</td><td>74.5</td><td>80.1</td><td>73.5</td><td>79.7</td><td>75.5</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.25</td><td>75.7</td><td>63.6</td><td>74.0</td><td>71.7</td><td>73.3</td><td>80.3</td><td>74.0</td><td>81.7</td><td>72.6</td><td>82.8</td><td>67.8</td><td>89.0</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>75.5</td><td>61.6</td><td>74.3</td><td>70.1</td><td>73.9</td><td>78.4</td><td>75.2</td><td>79.4</td><td>73.9</td><td>81.7</td><td>70.6</td><td>86.7</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.5</td><td>77.2</td><td>50.6</td><td>77.6</td><td>57.4</td><td>78.6</td><td>64.1</td><td>82.5</td><td>64.4</td><td>81.2</td><td>67.1</td><td>76.3</td><td>79.5</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 1</td><td>79.5</td><td>25.8</td><td>81.3</td><td>24.8</td><td>84.3</td><td>24.1</td><td>92.3</td><td>24.7</td><td>90.7</td><td>27.7</td><td>87.1</td><td>36.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 1.5</td><td>80.2</td><td>19.5</td><td>82.2</td><td>17.6</td><td>85.6</td><td>14.3</td><td>94.1</td><td>7.5</td><td>92.9</td><td>8.6</td><td>89.9</td><td>11.8</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 2</td><td>80.5</td><td>19.4</td><td>82.5</td><td>17.5</td><td>85.9</td><td>14.1</td><td>94.9</td><td>5.3</td><td>94.5</td><td>6.8</td><td>90.7</td><td>9.5</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="15"><strong>DeepFool</strong></td></tr><tr><td>No ε</td><td>96.3</td><td>8.6</td><td>95.9</td><td>10.5</td><td>95.0</td><td>12.9</td><td>94.9</td><td>12.0</td><td>95.3</td><td>12.1</td><td>95.5</td><td>12.6</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>CW2</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.01</td><td>59.7</td><td>76.3</td><td>57.2</td><td>80.1</td><td>53.4</td><td>89.9</td><td>54.2</td><td>92.0</td><td>51.1</td><td>93.5</td><td>44.3</td><td>96.1</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>HOP</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.1</td><td>96.1</td><td>7.9</td><td>95.6</td><td>9.8</td><td>95.9</td><td>11.7</td><td>96.0</td><td>10.2</td><td>95.9</td><td>9.9</td><td>96.1</td><td>10.0</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="15"><strong>Norm L<sub>∞</sub></strong></td></tr><tr><td>PGDi, FGSM, BIM</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>74.3</td><td>60.0</td><td>75.8</td><td>60.3</td><td>77.8</td><td>62.6</td><td>81.4</td><td>64.9</td><td>80.1</td><td>67.1</td><td>76.7</td><td>75.5</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.0625</td><td>78.4</td><td>36.0</td><td>80.3</td><td>34.1</td><td>83.2</td><td>33.8</td><td>89.1</td><td>33.3</td><td>87.9</td><td>34.4</td><td>85.7</td><td>37.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.25</td><td>80.1</td><td>19.4</td><td>82.1</td><td>17.5</td><td>85.2</td><td>15.8</td><td>92.3</td><td>16.4</td><td>92.1</td><td>16.8</td><td>89.6</td><td>17.0</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.5</td><td>80.3</td><td>19.4</td><td>82.3</td><td>17.5</td><td>85.5</td><td>14.1</td><td>92.9</td><td>14.4</td><td>91.7</td><td>15.2</td><td>90.1</td><td>14.8</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGDi, FGSM, BIM, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>78.9</td><td>29.0</td><td>80.8</td><td>28.1</td><td>83.8</td><td>28.7</td><td>89.2</td><td>29.1</td><td>88.4</td><td>28.9</td><td>86.8</td><td>28.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>PGDi, FGSM, BIM, CW</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>78.7</td><td>33.4</td><td>80.5</td><td>31.9</td><td>83.1</td><td>34.0</td><td>88.2</td><td>33.1</td><td>88.1</td><td>31.7</td><td>86.7</td><td>31.2</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="15"><strong>No norm</strong></td></tr><tr><td>STA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>No ε</td><td>94.7</td><td>14.5</td><td>93.3</td><td>16.8</td><td>89.9</td><td>23.1</td><td>90.2</td><td>23.2</td><td>91.0</td><td>22.4</td><td>91.1</td><td>22.4</td><td></td><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>

We try many different values $\alpha = \{.1, 1, 5, 10\}$. The case where $\alpha$ is equal to 0 is added for completeness, and it corresponds to the case where only the target classifier is attacked. We report in Fig. C.2 the comparison of the results between case (i) and case (ii) on CIFAR10 and $\alpha = 0.1$, as this corresponds to the case with the worst performances. As can be seen, the performances of our aggregator improve when the detectors are attacked singularly. This is particularly interesting for the setting we are dealing with. Indeed, our method is not a new supervised adversarial detection method but a framework to aggregate detectors, in this case, applied to the adversarial detection problem. Hence, it does not propose solving the problem of finding a new robust method for adaptive attacks but rather creating a mixture of experts based on the proposed sound mathematical framework. Thus, an attacker to successfully fool our method needs to have the complete access to all the underlying detectors and also an up-to-the-date knowledge of the detectors employed as the defender can always include a new
<table><caption>**Table C.6:** The proposed method against the adaptive-attacks under MEAD.
In the following setting, we attack each detector and the classifier once at a time. $\alpha$ is the parameter to control the losses.</caption><thead><tr><th rowspan="3"></th><th colspan="6">CIFAR10</th></tr><tr><th colspan="2">α = 0</th><th colspan="2">α = .1</th><th colspan="2">α = 1</th><th colspan="2">α = 5</th><th colspan="2">α = 10</th></tr><tr><th>AUROC†%</th><th>FPR↓90%</th><th>AUROC†%</th><th>FPR↓90%</th><th>AUROC†%</th><th>FPR↓90%</th><th>AUROC†%</th><th>FPR↓90%</th><th>AUROC†%</th><th>FPR↓90%</th></tr></thead><tbody><tr><td colspan="11"><strong>Norm L<sub>1</sub><br>PGDI*</strong></td></tr><tr><td>ε = 5</td><td>62.1</td><td>87.1</td><td>61.3</td><td>88.6</td><td>61.2</td><td>89.3</td><td>63.1</td><td>89.2</td><td>62.6</td><td>91.3</td></tr><tr><td>ε = 10</td><td>56.8</td><td>90.6</td><td>53.1</td><td>94.5</td><td>54.4</td><td>93.9</td><td>60.0</td><td>91.0</td><td>60.6</td><td>91.9</td></tr><tr><td>ε = 15</td><td>69.3</td><td>84.4</td><td>51.5</td><td>96.5</td><td>54.7</td><td>94.6</td><td>64.1</td><td>88.1</td><td>65.7</td><td>87.7</td></tr><tr><td>ε = 20</td><td>78.7</td><td>73.1</td><td>53.4</td><td>96.8</td><td>55.9</td><td>94.9</td><td>66.7</td><td>84.1</td><td>69.4</td><td>82.7</td></tr><tr><td>ε = 25</td><td>87.1</td><td>50.8</td><td>54.0</td><td>97.2</td><td>56.7</td><td>94.6</td><td>67.8</td><td>82.7</td><td>71.1</td><td>79.0</td></tr><tr><td>ε = 30</td><td>90.3</td><td>35.4</td><td>54.5</td><td>97.1</td><td>56.6</td><td>94.4</td><td>68.9</td><td>81.1</td><td>71.9</td><td>78.4</td></tr><tr><td>ε = 40</td><td>92.1</td><td>22.7</td><td>54.4</td><td>97.0</td><td>57.7</td><td>93.6</td><td>69.4</td><td>79.7</td><td>72.9</td><td>74.2</td></tr><tr><td colspan="11"><strong>Norm L<sub>2</sub><br>PGD2*</strong></td></tr><tr><td>ε = 0.125</td><td>63.9</td><td>85.4</td><td>61.4</td><td>88.0</td><td>62.4</td><td>88.8</td><td>63.7</td><td>88.5</td><td>63.9</td><td>89.9</td></tr><tr><td>ε = 0.25</td><td>57.1</td><td>90.5</td><td>52.9</td><td>94.2</td><td>55.0</td><td>93.6</td><td>60.6</td><td>89.7</td><td>61.5</td><td>90.3</td></tr><tr><td>ε = 0.3125</td><td>61.0</td><td>88.9</td><td>51.6</td><td>95.7</td><td>54.1</td><td>94.7</td><td>62.2</td><td>87.8</td><td>63.7</td><td>87.9</td></tr><tr><td>ε = 0.5</td><td>79.4</td><td>73.2</td><td>52.8</td><td>96.8</td><td>55.3</td><td>94.3</td><td>66.2</td><td>84.6</td><td>68.8</td><td>81.5</td></tr><tr><td>ε = 1</td><td>91.4</td><td>26.4</td><td>52.7</td><td>96.8</td><td>57.3</td><td>93.4</td><td>69.0</td><td>78.3</td><td>72.1</td><td>74.4</td></tr><tr><td>ε = 1.5</td><td>91.9</td><td>24.2</td><td>53.9</td><td>96.1</td><td>57.9</td><td>91.4</td><td>70.5</td><td>73.7</td><td>74.1</td><td>68.1</td></tr><tr><td>ε = 2</td><td>91.9</td><td>24.1</td><td>54.6</td><td>94.6</td><td>59.3</td><td>88.5</td><td>72.3</td><td>67.8</td><td>75.6</td><td>62.7</td></tr><tr><td colspan="11"><strong>Norm L<sub>∞</sub><br>PGDI*, FGSM*, BIM*</strong></td></tr><tr><td>ε = 0.03125</td><td>82.3</td><td>59.7</td><td>45.3</td><td>96.2</td><td>46.0</td><td>96.4</td><td>54.5</td><td>91.4</td><td>57.4</td><td>89.3</td></tr><tr><td>ε = 0.0625</td><td>92.0</td><td>29.6</td><td>44.3</td><td>96.2</td><td>49.8</td><td>93.8</td><td>59.7</td><td>82.4</td><td>64.3</td><td>76.4</td></tr><tr><td>ε = 0.5</td><td>94.6</td><td>9.7</td><td>62.1</td><td>81.3</td><td>54.9</td><td>81.9</td><td>66.1</td><td>60.8</td><td>68.9</td><td>57.9</td></tr><tr><td colspan="11"><strong>PGDI*, FGSM*, BIM*, SA</strong></td></tr><tr><td>ε = 0.125</td><td>88.9</td><td>40.8</td><td>48.6</td><td>90.7</td><td>54.9</td><td>85.0</td><td>61.9</td><td>73.1</td><td>66.3</td><td>67.5</td></tr><tr><td colspan="11"><strong>PGDI*, FGSM*, BIM*, CWi</strong></td></tr><tr><td>ε = 0.3125</td><td>80.0</td><td>61.1</td><td>56.6</td><td>82.0</td><td>56.3</td><td>79.6</td><td>66.1</td><td>66.1</td><td>69.2</td><td>64.4</td></tr></tbody></table>

detection mechanism to the pool of the detectors.

To give more insights on the proposed aggregator under this setting, we train a stronger version of the four shallow detectors where the detectors at training time have seen the corresponding adaptive attacks generated through the PGD algorithm. We report the results in Table C.8 where we focus on the group of simultaneous attacks with $L_\infty$ norm and $\varepsilon = 0.25$ as this represents the worst result of our method in Table C.7. If our method was only good as the best among the detectors, we should expect similar results in Table C.8. In this case, the only solution would be to train a better detector. However, the strength of the aggregator is not just mimicking the performance of its parts but rather creating a mixture of experts based on the proposed sound mathematical framework. Therefore, we should expect better performances. Indeed, this consistently holds as the method performs much better than the best detector.
<table><caption>**Table C.7:** The proposed method against the adaptive-attacks under MEAD. In the following setting, we attack all the detectors and the classifier together at the time. $\alpha$ is the parameter to control the losses.</caption><thead><tr><th rowspan="3"></th><th colspan="8">CIFAR10</th></tr><tr><th colspan="2">α = 0</th><th colspan="2">α = .1</th><th colspan="2">α = 1</th><th colspan="2">α = 5</th><th colspan="2">α = 10</th></tr><tr><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><td>Norm L<sub>1</sub><br>PGDI*</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 5</td><td>62.1</td><td>87.1</td><td>61.2</td><td>90.4</td><td>63.6</td><td>86.8</td><td>65.8</td><td>83.9</td><td>66.3</td><td>83.2</td></tr><tr><td>ε = 10</td><td>56.8</td><td>90.6</td><td>50.5</td><td>96.4</td><td>55.9</td><td>91.6</td><td>60.1</td><td>88.1</td><td>61.1</td><td>87.2</td></tr><tr><td>ε = 15</td><td>69.3</td><td>84.4</td><td>47.3</td><td>97.6</td><td>53.8</td><td>92.3</td><td>62.0</td><td>84.9</td><td>63.7</td><td>83.7</td></tr><tr><td>ε = 20</td><td>78.7</td><td>73.1</td><td>47.1</td><td>97.9</td><td>54.2</td><td>92.5</td><td>64.2</td><td>82.8</td><td>66.8</td><td>79.1</td></tr><tr><td>ε = 25</td><td>87.1</td><td>50.8</td><td>47.8</td><td>98.0</td><td>55.0</td><td>92.1</td><td>66.5</td><td>79.5</td><td>68.8</td><td>77.2</td></tr><tr><td>ε = 30</td><td>90.3</td><td>35.4</td><td>48.8</td><td>98.0</td><td>55.8</td><td>91.3</td><td>67.4</td><td>78.5</td><td>70.4</td><td>75.0</td></tr><tr><td>ε = 40</td><td>92.1</td><td>22.7</td><td>49.1</td><td>98.0</td><td>56.8</td><td>90.5</td><td>68.6</td><td>77.4</td><td>72.5</td><td>71.6</td></tr><tr><td>Norm L<sub>2</sub><br>PGDI*</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>63.9</td><td>85.4</td><td>62.4</td><td>88.5</td><td>65.0</td><td>86.2</td><td>66.9</td><td>82.9</td><td>67.2</td><td>81.1</td></tr><tr><td>ε = 0.25</td><td>57.1</td><td>90.5</td><td>51.2</td><td>96.0</td><td>56.3</td><td>91.7</td><td>60.6</td><td>87.2</td><td>61.6</td><td>86.8</td></tr><tr><td>ε = 0.3125</td><td>61.0</td><td>88.9</td><td>56.0</td><td>94.6</td><td>57.9</td><td>93.6</td><td>65.3</td><td>86.4</td><td>66.7</td><td>86.6</td></tr><tr><td>ε = 0.5</td><td>79.4</td><td>73.2</td><td>46.8</td><td>97.8</td><td>54.6</td><td>91.3</td><td>64.5</td><td>82.4</td><td>66.8</td><td>79.5</td></tr><tr><td>ε = 1</td><td>91.4</td><td>26.4</td><td>47.2</td><td>98.0</td><td>57.8</td><td>89.4</td><td>69.9</td><td>73.8</td><td>73.1</td><td>71.7</td></tr><tr><td>ε = 1.5</td><td>91.9</td><td>24.2</td><td>47.5</td><td>97.6</td><td>59.9</td><td>86.9</td><td>73.2</td><td>68.7</td><td>76.5</td><td>63.1</td></tr><tr><td>ε = 2</td><td>91.9</td><td>24.1</td><td>49.0</td><td>97.0</td><td>62.8</td><td>83.3</td><td>75.6</td><td>63.7</td><td>79.5</td><td>56.6</td></tr><tr><td>Norm L<sub>∞</sub><br>PGDI*, FGSM*, BIM*</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.03125</td><td>82.3</td><td>59.7</td><td>40.2</td><td>98.0</td><td>47.6</td><td>95.5</td><td>60.6</td><td>86.2</td><td>65.0</td><td>81.8</td></tr><tr><td>ε = 0.0625</td><td>92.0</td><td>29.6</td><td>37.9</td><td>98.0</td><td>47.0</td><td>95.9</td><td>61.9</td><td>82.1</td><td>65.8</td><td>77.1</td></tr><tr><td>ε = 0.25</td><td>95.9</td><td>8.8</td><td>36.5</td><td>96.4</td><td>47.4</td><td>97.7</td><td>62.5</td><td>92.6</td><td>65.4</td><td>90.8</td></tr><tr><td>ε = 0.5</td><td>94.6</td><td>9.7</td><td>36.7</td><td>96.2</td><td>46.0</td><td>97.7</td><td>61.6</td><td>96.1</td><td>66.0</td><td>94.8</td></tr><tr><td>PGDI*, FGSM*, BIM*, SA</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.125</td><td>88.9</td><td>40.8</td><td>38.5</td><td>95.9</td><td>46.8</td><td>95.4</td><td>60.1</td><td>85.0</td><td>61.9</td><td>83.2</td></tr><tr><td>PGDI*, FGSM*, BIM*, CWI</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>ε = 0.3125</td><td>80.0</td><td>61.1</td><td>37.2</td><td>95.3</td><td>46.7</td><td>97.4</td><td>60.9</td><td>92.4</td><td>64.1</td><td>90.1</td></tr></tbody></table>

<table><caption>**Table C.8:** Comparison between the proposed method and the single detectors (stronger version) against the adaptive-attacks. Norm $L_\infty$ and $\epsilon = 0.25$ (i.e., attacks PGDi*, FGSM*, BIM*).</caption><thead><tr><th>CIFAR10</th><th>Ours</th><th>ACE</th><th>KL</th><th>FR</th><th>Gini</th></tr></thead><tbody><tr><td>AUROC↑%</td><td><strong>54.6</strong></td><td>35.7</td><td>30.6</td><td>26.3</td><td>36.2</td></tr><tr><td>FPR↓95%</td><td><strong>73.0</strong></td><td>96.5</td><td>97.0</td><td>97.4</td><td>99.6</td></tr></tbody></table>
### C.2.3 AutoAttack

We present an application of AutoAttack [CH20], a state-of-the-art evaluation tool for robustness, redesigned for adversarial detection evaluation and adapted to our simultaneous attacks framework. In its original version, AutoAttack evaluates the accuracy of robust classifiers. In so doing, [CH20] proposes a multiple attacks framework to ensure that at least one attack succeeds in producing an adversarial example for each natural one. In their context, it does not matter which attack will succeed since any successful attack would undermine the accuracy of the target classifier in the same way. In our case, the number of different successful attacks for each natural sample will affect the detection quality since a detector is successful only if it can detect all of them. Because of the above mentioned differences, it is impossible to deploy it directly in our framework without any modifications. A modified version of AutoAttack, adapted to the evaluation of our proposed method, has been implemented, and the results are presented below. While AutoAttack suggests using different attack strategies, in our case, we combine different attack strategies matched with different losses to make the pool of attacks more strong and more diversified.

<table><caption>Table C.9: The proposed method on AutoAttack (MEAD setting). The attacks are APGD-CE, APGD-DLR, FAB, SA.</caption><thead><tr><th></th><th colspan="2">CIFAR10</th></tr><tr><th></th><th colspan="2">Ours</th></tr><tr><th></th><th>AUROC↑%</th><th>FPR↓95%</th></tr></thead><tbody><tr><th colspan="3">Norm L<sub>1</sub></th></tr><tr><td>ε = 5</td><td>57.1</td><td>88.4</td></tr><tr><td>ε = 10</td><td>67.1</td><td>75.7</td></tr><tr><td>ε = 15</td><td>72.2</td><td>66.7</td></tr><tr><td>ε = 20</td><td>72.7</td><td>65.2</td></tr><tr><td>ε = 25</td><td>72.8</td><td>65.6</td></tr><tr><td>ε = 30</td><td>73.4</td><td>64.0</td></tr><tr><td>ε = 40</td><td>73.6</td><td>64.0</td></tr><tr><th colspan="3">Norm L<sub>2</sub></th></tr><tr><td>ε = 0.125</td><td>67.4</td><td>81.0</td></tr><tr><td>ε = 0.25</td><td>58.0</td><td>89.0</td></tr><tr><td>ε = 0.3125</td><td>58.1</td><td>88.8</td></tr><tr><td>ε = 0.5</td><td>69.4</td><td>74.7</td></tr><tr><td>ε = 1</td><td>75.1</td><td>61.6</td></tr><tr><td>ε = 1.5</td><td>76.1</td><td>60.7</td></tr><tr><td>ε = 2</td><td>76.1</td><td>60.5</td></tr><tr><th colspan="3">Norm L<sub>∞</sub></th></tr><tr><td>ε = 0.03125</td><td>75.7</td><td>61.0</td></tr><tr><td>ε = 0.0625</td><td>76.0</td><td>60.7</td></tr><tr><td>ε = 0.125</td><td>76.8</td><td>60.3</td></tr><tr><td>ε = 0.25</td><td>76.8</td><td>60.0</td></tr><tr><td>ε = 0.3125</td><td>78.6</td><td>57.6</td></tr><tr><td>ε = 0.5</td><td>76.1</td><td>60.3</td></tr></tbody></table>
<figure><img src="image_26.png" /><figcaption>(a) PGD-L₁-40-ACE</figcaption></figure>

<figure><img src="image_27.png" /><figcaption>(b) PGD-L₁-40-KL</figcaption></figure>

<figure><img src="image_28.png" /><figcaption>(c) PGD-L₁-40-FR</figcaption></figure>

<figure><img src="image_29.png" /><figcaption>(d) PGD-L₁-40-Gini</figcaption></figure>

**Figure C.3:** In pink the results for the adversarial examples and in blue the ones for the naturals. In this simulation, we consider a subset of the available detectors (ACE, KL, FR). Under each plot, we indicate the tested attack configuration parameters: algorithm-L<sub>p</sub>-ε-loss.

### C.2.4 Additional plots

The specific shape in the histograms depends on the set of considered detectors. To shed light on this fact, we include the plots in Fig. C.3 in which we consider a subset of the available detectors (ACE, KL, FR). These plots should be compared with the ones in Fig. 5.2.