Expected Perturbation Scores for Adversarial Detection
Authors: Shuhai Zhang
Feng Liu
Jiahao Yang
Yifan Yang
Bo Han
Mingkui Tan
Venue: Submitted to ICLR 2023 (2023)

Abstract: Adversarial detection aims to determine whether a given sample is an adversarial one based on the discrepancy between natural and adversarial distributions. Unfortunately, estimating or comparing two data distributions is extremely difficult, especially in the high-dimension space. Recently, the gradients of log probability density (a.k.a., score) w.r.t. samples is used as an alternative statistic to compute. However, we find that the score is sensitive in identifying adversarial samples due to insufficient information with one sample only. In this paper, we propose a new statistic called expected perturbation score (EPS), which is essentially the expected score of a sample after various perturbations. Specifically, to obtain adequate information regarding one sample, we can perturb it by adding various noises to capture its multi-view observations. We theoretically prove that EPS is a proper statistic to compute the discrepancy between two distributions under mild conditions. In practice, we can use a pre-trained diffusion model to estimate EPS for each sample. Last, we propose an EPS-based adversarial detection (EPS-AD) method, in which we develop EPS-based maximum mean discrepancy (MMD) as a metric to measure the discrepancy between the test sample and natural samples. To verify the validity of our proposed method, we also prove that the EPS-based MMD between natural and adversarial samples is larger than that among natural samples. Empirical studies on CIFAR-10 and ImageNet across different network architectures including ResNet, WideResNet, and ViT show the superior adversarial detection performance of EPS-AD compared to existing methods.

Under review as a conference paper at ICLR 2023
EXPECTED PERTURBATION SCORE FOR ADVERSARIAL DETECTION
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial detection aims to determine whether given sample is an adversarial one based on the discrepancy between natural and adversarial distributions. Un- fortunately, estimating or comparing two data distributions is extremely difficult, especially in the high-dimension space. Recently, the gradient of log probability density (a.k.a., score) w.r.t the sample is used as alternative statistic to com- pute. However, we find that the score is sensitive in identifying adversarial sam- ples due to insufficient information with sample only. In this paper, we pro- pose new statistic called expected perturbation score (EPS), which is essentially the expected score of a sample after various perturbations. Specifically, to obtain adequate information regarding one sample, we can perturb it by adding various noises capture its multi-view observations. We theoretically prove that EPS is a proper statistic to compute the discrepancy between two samples under mild conditions. In practice, we can use pre-trained diffusion model estimate EPS for each sample. Last, we propose an EPS- bess-baed adversarial detection (EPS-AD) method, in which we develop EPS-based maximun mean discrepancy (MMD) as a metric measure the discrepancy between the test sample and natural samples. To verify the validity of our proposed method, we also prove that the EPS-based MMD between natural and adversarial samples is larger than that among natural samples. Empirical studies on CIFAR-10 and ImageNet across different network architectures including ResNet, WideResNet, and VIT show the superior adver- sarial detection performance of EPS-AD compared to existing methods.
INTRODUCTION
Deep neural networks (DNNs) are known to be sensitive to adversarial samples that are generated by adding imperceptible perturbations to the input but may mislead the model to make unexpected pre- dictions (Szegedy et al. 2014; Goodfellow et al., 2013). Adversarial samples threaten widespread machine learning systems (Li & Vorobeychik 2014 Ozbulak et al.) 2019), which raises urgent requirement for advanced techniques to improve the robustness of models. Among them, adversar- ial training introduces adversarial data into training to improve the robustness of models but suffers from significant performance degradation and high computational complexity (Sriramanan et al., 2021 Laidlaw al. 2021 Wong al. 2020); adversarial purification relies on generative mod- cls to purily adversarial data before classification, which still has to compromise on unsatisfactory
natural and adversarial accuracy (Shi et al. 2021 Yoon al. 2021 Nie et al. 2022).
In contrast, another class of defense methods, called adversarial detection, could be achieved by detecting and rejecting adversarial examples, which are friendly to existed machine learning systems due to the lossless natural accuracy, and can help to identify
input sources (Abusnaina et al., (02T). Adversarial detection aims to tell whether a test sample an adversarial sample, for which the key is to find the discrepancy between the adversarial and natural distributions. However, existing adversarial detection approaches primarily train a tailored detector for specific attacks (Feinman et al. 2017] Ma et al. 2018 Lee et al. 2018) or for specific classifier (Deng et al. 2021), which largely overlook modeling the adversarial and natural distributions, resulting in their limited performance against unseen attacks or transferable attacks.
Unfortunately, it is non-trivial to estimate or compare two data distributions, especially in the high- dimension space (e.g., image-based space). One alternative approach is to estimate the gradient

---

Under review as a conference paper at ICLR 2023
of log probability density with respect to the sample, i.e. score. This statistic has emerged powerful means for adversarial defense Yoon et al.] [202]] Nie et al. 2022) and diffusion models
(Song & Ermon 2019 Song et al.) 2021 Kingma al. [2021 Huang et al. (02I). However, how
to effectively exploit the score function for adversarial detection is not well studied.
Recently, Yoon et al. 2021) purify adversarial samples by gradually removing the adversarial noise from the (attacked) samples with the score function for adversar- ial defense. During the purification process, they em- ploy the norm of scores (between reing-purifien adver- sarial samples and natural samples) to set threshold for determining which timestep to stop purifying. They empirically find that natural samples usually have lower score norms than adversarial samples across purifica- tion timesteps. Intuitivelyy the score could represent the momentum the sample towards the high-density ar- of natural data (Song& & Ermon, 2019). From this point of view, a lower score norm indicates the sample closer the high-density areas of natural data, i.e., a higher probability of the sample following the natural distribution. To further understand this, we demonstrate the score norms of natural samples and adversarial sam- ples at different purification timesteps. According to Figure I most natural samples have lower score norms than adversarial samples at the same timestep, but they are very sensitive to the timesteps due to the significant overlap across all timesteps. This suggests that the score of one sample is useful but not effective enough in identifying the adversarial samples.
1.002
Normallzed Score Norm
0.913
9.992
0.925
0.072
Natural Data
0.802
Adversarial Data
15
Timestep 1000
Figure An illustration of score norms of 200 random sampled natural images and adversarial images on ImageNet, in which most natural images have lower score norms than adversarial images at the same timestep but are very sensitive to the timesteps due to the significant overlap.
In this paper, we propose new statistic called expected perturbation score (EPS), which represents the expected score after multiple perturbations of a given sample. In EPS, we consider multiple levels of noise perturbations to diversify one sample, allowing us to capture multi-view observations of one sample and thus extract adequate information from the data. Our theoretical analysis shows EPS is valid statistic in distinguishing between natural and adversarial samples under mild con- ditions. Thus, we propose an EPS-based adversarial detection method (EPS-AD) for adversarial detection, illustrated in Figure 2 Specifically, given a pre-trained score-based diffusion model, EPS-AD consists of three steps: 1) we simultaneously add multiple perturbations to a set of natural images and an upcoming image following the forward diffusion process with time step T*; 2) we obtain their EPSs via the score model; 3) we adopt the maximum mean discrepancy (MMD) between any test sample and natural samples relying on EPS.
We provide both empirical and theoretical analyses to demonstrate the effectiveness of EPS-AD. Empirically, we achieve superior performance on both CIFAR-10 and ImageNet across many net- work architectures including ResNet, WideResNet and ViT compared to existing methods. Espe- cially for the extremely low attack intensity e = 1/255 on ImageNet, we achieve the area under the receiver operating characteristic (AUROC) of +95% against 12 attacks over ResNet-50. Theoret- ically, we prove that the MMD between EPSs of the natural samples is smaller than that between natural and adversarial samples.
We summarize our main contributions as follows:
We propose a new and reliable statistic called expected perturbation score (EPS) to capture suffi- cient information regarding sample from its multi-view observations by adding various pertur- bations. We theoretically prove that EPS a proper statistic to compute the discrepancy between two distributions under mild conditions.
Relying on the proposed EPS, we exploit the maximum mean discrepancy (MMD) as a metric to measure the discrepancy between the test sample and natural samples and then develop a novel adversarial detection method called EPS-AD. We theoretically show that the EPS- aaseb MMD between natural and adversarial samples is larger than that among natural samples, which verifies the validity of the proposed adversarial detection method.
2

---

Under review as a conference paper at ICLR 2023
2 PRELIMINARIES
We start by recalling the setting of score- base- continuous-timg diffusion models, and then present the concept of maximum mean discrepancy.
Adversarial data generation. Given well-trained classifier f on data set D{ 4))² with x; being a sample from the input space X' and 4 being its ground-truth label defined in a label set C (1, C). adversarial data & regarding x with perturbation is given by
arg max l (f(x).
x
(1)
xEB(x.e)
where e(x, {x's X' (x, x) S E). d is some distance (e.g., lg or loo distance), and is some loss function. For simplicity, we denote x = x + as the adversarial data regarding x.
Continuous-time diffusion models. Following [Sng et al. (021), let p(x) be the unknown data distribution. Diffusion models firstly construct forward diffusion process {xx) Tan indexed by a continuous time variable & E [0, Tam). which can be modeled by stochastic differential equation (SDE) with positive time increments:
dx = f(x, t)dt + g(t)dw,
(2)
where Xy := x p(x), f(.,)) Rd + Rd is a vector-valued function, g(-) R + IR a sealar function that is independent
and is standard Wiener process.
Let pr (x) be the the marginal distribution of x₁ with po(x) = p(x), if t) and g(t) are designed well such that (x) x N (0, La). by reversing the diffusion process from t = Taiff to t 0, we can reconstruct samples Xo ~ (x). The reverse process is given by the reverse-time SDE:
dx = [(x, t) - V log Pr (x)] dt + g(t)dw,
(3)
where w is standard roverse-time Wiener process and dt is an infinitesimal negative time step. Throughout the paper. we consider the VP-SDE following the setting of Song et al. (202I). where
f(x. t) = - 3())) and g(t) = v Bt) with ((t) being the linear noise schedule, iee., (t) = 8min (Amax Smin ) /t/ a/Ta for t [0, Taml
Reconstructing samples from the Gaussian distribution requires the score of the marginal distribu-
tion, i.e., Vx log pe (x)) in the reverse process Eq. (3) To estimate the score function V. log loggrx (x).
one effective solution is to train a score model so So(x, x t) on samples with score matching (Hyvärinen
& Dayan 2005 Song & Ermon
2019
Vincent
2011
The training objective function is:
0* = min E, ((t) Ex Px || (x,, t) - Vx, logPos Pox (x, 0
x,)]
2
(4)
where X(t) is positive weighting function, and (x: Xo) is transition kernll from xo to Xt. which can be derived by the forward SDE in Eq.
Maximum mean discrepancy. Following Gretton et al. (2012); Borgwardt et al. (2006), let X C Rd be separable metric space and p. q be Borel probability measures on X. Given two independent identically distributed (IID) observations Sx = {x( | Fi-1 and Sy = { ] from distributions p and g, respectively, maximum mean discrepancy (MMD) aims to measure the closeness between these two distributions, which is defined as:
MMD(p, F) == sup [[f( - [(f() JEF
where FF is class of functions f X - R, and X ~. p, q two random variables. To better study the richness of the MMD function class F, Borgwardt et al. (0066) propose to choose F to be the unit ball in universal reproducing kernel Hilbert space and obtain the following kernel-based MMD,
MMD (p. Ha) JEH,
sup
[[[(()) [E)())]
I1,
(6)
11/4 - Mall = V I (x, Y") (X)
where k X' x X + R is the kernel of reproducing kernel Hilbert space H Mo := Ek
and M4g := Ejk(-, ,, Y)] are the kernel mean embeddings of p and q, respectively (rretoon et al. 2012
Borgwardt et al. 2006 Jitkrittum al. 2017 Liu et al. 2020 Gao et al. 2021)
3

---

Under review as a conference paper at ICLR 2023
X / %
xp / &x
Perturbations
x0)
-p(x)
Perturbations
[(x]0 Je-1
EPS Computation
{ x x()p(())
MMD(P(), 2())
Por (Kt
S(x) = (x
Perturbations
S(3)
Por (o)
Figure 2: Overview of the proposed EPS-AD. EPS denotes the expected score after multiple per- turbations of sample using pre-trained score model. Specifically, we simultaneously add pertur- bations to a set of natural images (x(") and test image & following the diffusion process with a time step T get perturbed images, from which we obtain their EPSs S(x) via the score model and calculate the MMD between EPS of the test sample and EPSs of natural samples.
3 PROPOSED METHOD
In this section, we first provide the problem definition of adversarial detection in Section 3.1 Then present the definition of expected perturbation score (EPS) and provide the theoretical analysis that EPS is able to distinguish between natural and adversarial data well if natural data are from Gaussian distributions (Section B.2). Motivated by this, we develop a new adversarial detection method, called EPS-AD, as shown in Figure 2 Particularly, we estimate the EPS for each sample using pre-trained score-based diffusion model and then adopt the maximum mean discrepancy (MMD) between the test sample and natural samples relying on EPS characteristic of the test sample (Section 3.3).. Moreover, we provide theoretical analysis that the MMD between EPSs the natural samples smaller than that between natural and ad adversarial samples. (Section 3.4
3.1 PROBLEM SETTING
In this paper, we aim to address the following adversarial detection problem.
Problem (Adversarial detection) Let X Rd be a separable metric space and p be Borel probability measure on X, and IID observations Sx = {x J from the distribution and ground-truth labeling mapping f(-) =
= Rd C with (1, (1....,C) C} being a label set. Assuming that the attacker has access to some well-trained classifier f on Sx and III) observations S'x from the distribution p. wish know whether each new sample in Sy {x(()) j= with S is following the distribution p.
} that are crafted
Note that the definition of adversarial detection in Problem iis different from that in two-sample test (Grosse al.) (017)). Particularly, Problem aims determine whether each example in Sy is sampled from the distribution p. while two-sample test aims to tell if two populations Sx and Sy come from the same distribution, which focuses on the closeness between two populations.
3.2 EXPECTED PERTURBATION SCORE
As aforementioned, the score of one sample, e-g., Vx log p(x), is ineffective enough in identifying the adversarial samples. To capture more information from one sample, we propose a new statistic expected perturbation score (EPS), which is formulated bellow.
Definition 1. (Expected perturbation score) Let X C Rdd be a separable metric space and be Borel probability measure X. Given a perturbation process transition distribution pot (x, Xn). the expected perturbation score (EPS) of sample x is given by:
S (x) E Vx log Pt. (x),
where (x() is the marginal probability distribution of x,, Xy = x the initialized sample at t = 0, and T is the last perturbation time step.
4

---

Under review as a conference paper at ICLR 2023
Note that the perturbation process transition distribution Pot (x; xx) can be any distribution, such as the commonly used Gaussian distribution or uniform distribution. Moreover, we consider multiple levels of noise in the definition of EPS, with the aim of diversifying the single sample, which enables us to capture multi-view observation data and thus fully exploit more information from the data.
Built upon Definition 1 we derive following theorem to give closer look on EPS S(x) for the natural data and adversarial data when the perturbation process transition distribution Por (x, Xx)
and p(x) are from Gaussian distributions.
Theorem 1. Assuming that the distribution of natural data p(x) = [Nxxx
( T given perturba- tion transition kernel Pot (xe xo) = N (xx: Yo., Ii with "/ and or being the time- denedeeendent
noise schedule, then the following three conclusions hold for S(x):
1) For V x~>(xx), S(x) NO0 d).1);
2) For V y~>p(x), adversarial sample --y+t with perturbation e, (19)~N(-Hs.
3) For V x,y ~ p(x), adversarial sample y-y+c, we have
S(x) 5( 4 NN0.
(8)
S(x) - Sty) $ N (us, 20²
where pss-Ee- Mh with 14, 72 and 03 (0.20) with of
Theorem tells us: 1) the first two findings show that the mean of EPS for the adversarial sample differs from that of the natural sample due to the additional perturbation term ps; 2) the third finding indicates that the EPS of the natural sample is closer to that of other natural samples compared to ad- versarial samples, and this discrepancy becomes more pronounced when the perturbation transition Th and or are small. These findings motivate us to employ S(x) for adversarial detection.
Why multiple scores? Note that μr and of decrease as the timestep increases due to the increase of yy and or However, smaller variance d² and larger mean μa are required for good adversarial detection. If we only consider one score of some unique timestep (i.c., removing the expectation from the definition of EPS), the variance o and mean A4s of the discrepancy will be so fluctuant that performing detecting adversarial samples will be very sensitive to the timestep (as validated in Section 4.4p To alleviate this issue, we consider taking expectation w.r.t. the timestep on multiple scores. In this way, the distribution of the discrepancy between the natural sample and the adversarial sample will be more stable to the timestep, which makes it easier to obtain a superior solution.
3.3 ADVERSARIAL DETECTION WITH EXPECTED PERTURBATION SCORE
Estimation for expected perturbation score. Note that EPS (i.e., S(x)) in Eq. requires
knowing the score function Vx log Pt (x), which can be estimated by training a neural network
with score matching (Hyvärinen & Dayan 2005; Song & Ermon, 2019, Vincent 2011 Kingma et al. 202T). To this end, we model the perturbation process transition as a Gaussian distribution
Por (Xt xo) = N' (xr; 71:00, 1,) where 7/- = - J. ((s)de and of = 1 e -Jo B()dd with B(t) for t E [0, 1000] being the time- -enendennddnt noise schedule. By optimizing Eq. (4). with sufficient data
and model capacity. score matching ensures that the optimal solution to Eq. 44 equals log p. (x)
for almost x and (Song et al. 2021). ). As a result, the score Vx log P: (x) can be approximated by a pre-trained diffusion model to achieve the estimation for the score.
so (xx, t). In practice,
MMD for characterizing expected perturbation score. Using the norm of estimated EPS S(x) as a characterization for adversarial detection is straightforward. Nevertheless, using the norm of S(x) as the criterion can only describe the magnitude of the EPS vector, so it ignores the rich information that can be derived from its direction. It is critical that we design distance metric to measure the distance between the EPS of upcoming sample and the EPSs of natural samples in order to derive more useful information from S(z).
Benefiting from the superior performance of maximum mean discrepancy (MMD) in measuring two given distributions (Long et al., 2015 Zhu et al. 2019 Gao et al.) 2021). we resort to it for characterizing EPS. The basic idea of MMD is that two distributions would be identical if two random variables are identical for any order, and the moment that makes the largest distance between the two distributions should be the measure of the two distributions when the two distributions
5

---

Under review as a conference paper at ICLR 2023
not the same (moola al. 2007
Gong et al. 2022
Formally, define two distributions for x and test sample x as Qr
the natural samples {x(() Ji=1 Px 5(lly - x respectively, where d is the Dirac function (Al 2006). Then we estimate the distance between these two distributions as
-i=1 å
2 MMD, Pxx Qy; Hd]
=
Σ 1,j=1
(x(0
xx))
h (x) + k(y,)) Σ n 1=1
2
(10)
n2
where is (x, = (x)(x,, S(y)) with x being the kernel of a reproducing kernel Hilbert space Hx such as the Gaussian kernel K. (x exp
||x yl? / (20")) In our practice, we consider
deep kernel MMD following Liu et al. (2020).
3.4 THEORETICAL ANALYSIS FOR EPS-AD
Note that after performing the same perturbation process, the first and the third terms in Eq. 10 are the same for each upcoming sample, thus we only focus on the cross-term Next, we analyze this term for the adversarial sample.
Ei= y).
Corollary 1. Considering the Gaussian kernel (x, exp (- ||x 1ox-xy y112 /200)) and the sumption in Theorem for v0<n<l, L, the probability of P(k(x, ni is given by
P(k(x,))>n) = 1/ (1l
(1I)
where u. denotes the mean of S(x) - S(y). is a constant for given and a, x² is the probability density function of noncentral chi-squared distribution with d degrees freedom (Abdel-Ary 1954..
Corollary I indicates that the cross-term J will be larger if || is close to zero given an Com- bining Eq. (8 and Eq. (9), we conclude that the natural data have larger J than the adversarial data with higher probability due to the additional term E, 707 suggesting that the MMD between EPSs of the natural samples is smaller than that between natural and adversarial samples.
EXPERIMENTS
4.1 EXPERIMENTAL SETTINGS
Datasets and network architectures. We evaluate our method on CIFAR-I0 (Krizhevsky 2009)
and ImageNet (Deng et al.) 2009p. We implement three widely used architectures as classifiers:
WideResNet (Zagoruyko & Komodakis 2016 Gowal al.] 2021) for CIFAR- 10, ResNet (He et al.)
2016) and ViT (Dosovitskiy et al., (021) for ImageNet. For diffusion models, we consider the
pre-trained diffusion models of Score SDE (Song al. 2021 for CIFAR-10 and Guided Diffusion
Dhariwal & Nichol 2021) for ImageNet, respectively.
Attack methods. Following Deng al. (202I), evaluate our adversarial detection method under various attack methods. We consider the commonly used f2 and &oo threat models, including PGD (Madry al., (2088). FGSM (Goodfellow
al., 2013), BIM (Kurakin al. 2018), MIM (Dong et al. 2018). TIM (Dong et al. 2019). CW (Carlini & Wagner 2017), DLMIM(Xie et al. 2019). Moreover, we apply two adaptive attack methods such as AutoAttack (AA) (Croce Hein 2020)
and Siniiuu--Marge Attack (MM) (Gao et al., (022). To show the superiority of our method, we consider the relatively low attack intensities, i.e., E2-ball and boal c-constrains with e 4/255, and iterative attacks run for 5 steps using step size e/5, unless stated otherwise.
Baselines. We compare our method with several state-of-the-art adversarial detection methods, including kernel density (KD) (Feinman et al. 2017). 1), local intrinsic dimensionality (LID) (Ma et al.) 2018), mahalanobis distance (MD) (Lee et al. 2018 and LiBRe (Deng et al. 2021). Besides, we construct two adversarial detection methods based on diffusion models: 1) S-N: using the score norm of raw images, i.e., [x,,(x, t) 12. 2) EPS-N: using the norm of the EPS, i.e., [|] Differently, proposed EPS-AD further calculates the maximum discrepancy of EPSs.

---

Under review as a conference paper at ICLR 2023
Table 1: Comparison of different adversarial detection methods CIFAR-10 and ImageNet in terms of AUROC under e = 4/255. The bold number indicates the best results.
Dataset
AUROC
FGSM
PGD
BIM
CW
FGSM-
BIM-f2
AA
KD
0.9213
0,9007
0.9037
0.8335
0.9121
0.9107
0.9135
LID
0.9236
0.9159
0.9217
0.9014
0.9169
0.9320
0,9419
CIFAR-I0
MD
0.9990
0.9860
0.9758
0.9829
0.9995
0,9586
0,9830
S-N
1.0000
0.9998
0,9961
0.9998
0.9885
0.9674
0.9995
EPS-N (Ours)
1.0000
1.0000
0.9996
1.0000
0.9916
0.9883
1,0000
EPS-AD (Ours)
1.0000
1.0000
0.9998
1.0000
0.9995
0.9991
1.0000
KD
0.7099
0,9720
0.9797
0.9413
0.7004
0.9775
0.9319
LID
0.8912
0.9750
0,9808
0.9528
0.8932
0.9816
0,9582
ImageNet
MD
0.8786
0.9773
0,9835
0.9609
0,8715
0.9830
0,9518
LiBRe
0.9889
0.9530
0.9269
0.9039
0.8708
0.9211
0.8724
S-N
0.9828
0.8974
0.7208
0.8969
0.8830
0.6762
0.9151
EPS-N (Ours)
0.9987
0.9978
0.9215
0.9978
0.8191
0.7172
0.9943
EPS-AD (Ours)
1.0000
1.0000
1.0000
1.0000
1.0000
1.0000
1.0000
1.00
AUROC
EPSADD (ours)
f_ 255
(./ 255
f./ 255
(a) Attack Method: PGD
(b) Attack Method: FGSM
(c) Attack Method: CW
1.00
1.00
1.00
0.95
0.90
0.85
0.85
0.80
0.75
0.75
0.70
0.75
0.70
255
(f) Attack Method: AA Attack Figure 3: Comparison with adversarial detection methods on CIFAR-10 in terms of AUROC under
(d) Attack Method: BIM
(c) Attack Method: FGSM-
cE (1/255, ...,
11,,5,,..../.5.... 8/255). Sub-figures (a) (f) share the same legend presented in sub-figure (a).
Evaluation metric. We evaluate the performance of adversarial detection approaches with the area under the receiver operating characteristic (AUROC). which is a widely used statistic for assessing the discriminatory capacity of distribution models (Jménezz Valverde, 2012). Considering the com- putational cost of applying 12 attacks to the classifier, especially for the ImageNet, following Gao al. (2021), we randomly select two disjoint subsets adversarial and natural samples (each con- laining 500 samples) and compute the AUROC value over these two subsets. Notably, our method applicable different data sizes, which verified in Appendix. Moreover, we set T 20 in S(x) on CIFAR- 10 and T = 50 on ImageNet for both our EPS-AD and EPS-N, and set t = 5 in so s0(x, t) on CIFAR-10 10 and l"
on ImageNet for S-N.
4.2 DETECTING ON KNOWN ATTACKS
We start by comparing EPS-AD with the state-of- the-tht---rttt adversarial detection methods that trained with seen adversarial examples, against E, and &x threat models. Considering adversar- ial detection becomes more challenging when the attack intensity of adversarial samples is low, to
7

---

Under review as a conference paper at ICLR 2023
10
1.0
0.5
0.9
AUROC
AUROC
0.8
AUROC
0.8
Liflle
0.7
S-N
N tours!
0.6
2
f./ 255
f./255
f5/255
(a) Attack Method: PGD
(b) Attack Method: FGSM
(c) Attack Method: CW
1.0
1.0
1.0
0.9
0.8
AUKOC
AUROC
0.8
AUROC
0.6
S-N
0.6
EPS-N
(ours)
2
4
2
0
20
40
80
80
1000
f-/ 235
1/ 255
Timestop 10000
(d) Attack Method: BIM
(c) Attack Method: FGSM-12
(f) Imppcc of timestep
Figure 4: Results of adversarial detection on ImageNet. Sub-figures (a) (e) report the AUROC on different attacks under eE [112255, .. .., 8/255} and share the same legend presented in sub-figure (a). Sub-figure (f) reports the AUROCS of different timesteps in {1, 2, 5, 10, 20, 50, 1003.
broadly evaluate the adversarial detection performance, we compare our method with other base- lines on different attacks under different attack intensities. Moreover, to show the best performance of KD, LID and MD, we test the detection performance on their corresponding adversarial examples.
Results CIFAR-10. Figure shows adversarial detection performance against attacks under different attack intensities (E(1/255,.... ..., 8/255] on CIFAR-10 over WieeRes 10 (Zagoruyko & Komodakis (016) compared to other baselines. We demonstrate other attacks and more results on WideResNet-70-16 (Gowal et al. 2021) in Appendix. Obviously, our EPS-AD have much higher AUROC performance than other methods. Critically, observe that our EPS-AD pre- serves almost non non-degraded AUROC when the attack intensity surpasses 2/255 against & and foc attacks, which shows the stability of EPS-AD when detecting challenge adversarial samples.
In addition, we report quantitative results for adversarial detection under the attack intensity 6 <= 4/255 in Table [ The results show that by employing EPS and measuring their MMD, EPS- AD consistently outperforms existing methods against various attacks in terms of AUROC. We also see that by simply applying the norm of EPS, EPS-N achieves superior adversarial detection perfor- mance, which demonstrates the effectiveness of EPS.
Results on ImageNet. We report the adversarial detection performance against & and Ex attacks on ImageNet over ResNet-50 (He et al., (0166) in Table I and Figure 4. We defer the results of one widely-used ViT architecture, DeiT-S (Dosovitskiy et al. 2021). in Appendix. We observe that our approach consistently outperforms baselines under various attacks, especially for detecting PGD, BIM and FGSM-f2 attacks. These results reveal that our proposed EPS-AD is effective even on large-scale data set. Moreover,
observe that EPS-N exhibits poor results compared EPS- AD when detecting l attacks (e.g., FGSM-(2 and BIM-(2) since the norm of EPS ignores rich information contained the EPS vector, which is not effective enough detect on large-scale data set. This performance degradation is more pronounced in the method S-N.
4.3 DETECTING ON UNSEEN ATTACKS AND TRANSFERABLE ATTACKS
In light of poor performance for adversarial detection baselines against unseen attacks and transfer- able attacks, we evaluate method in the context of these kinds of attacks.
Detecting on unseen attacks. To detect unseen attacks, we train KD, LID, and MD detectors on CIFAR-10 10 using only FGSM and FGSM-42 adversarial examples and evaluate their performance
8

---

Under review as a conference paper at ICLR 2023
Table 2:
Comparison of AUROC for detecting unseen attacks CIFAR-10, where "FGSM (seen)"
denotes the seen adversarial attack used for the training of KD, LID and MD.
(Seen)
PGD
BIM
CW
TGSM-22 (seen)
BIM-62
AA
KD 0.9213
0.9007
0.9082
0.8339
0.9146
0.9146
0.9135
LID
0.9236
0.8964
0.9028
0.8828
0,9160
0.8984
0,9253
MD
0,9990
0,9855
0.9742
0,9835
0,9992
0,9503
0.9820
S-N
1,0000
0.9998
0.9961
0.9998
0.9885
0.9674
0,9995
EPS-N (Ours)
1.0000
1.0000
0.9996
1.0000
0.9916
0.9883
1,0000
EPS-AD (Ours)
1.0000
1.0000
0.9998
1.0000
0.9995
0.9991
1.0000
Table 3: Comparison AUROC for detecting transferable attacks on ImageNet, where KD, LID, MD and LiBRe trained with adversarial examples with ResNet-50 but detect the adversarial examples crafted with ResNet-101.
FGSM
PGD
BIM
CW
FGSM-L2
BIM-E2
AA
KD
0.7754
0.5999
0.5847
0.7632
0.7906
0.7756
0.7698
LID
0.8467
0.7627
0.7663
0.7704
0.8520
0.7925
0.7967
MD
0.8467
0.7698
0.7684
0,7665
0.8067
0.7759
0,7880
LiBRe
0.9849
0.8414
0.7161
0.8286
0.8489
0.7250
0,8485
S-N 0.9816
0.8965
0.7166
0.8963
0.8764
0.6705
0,9106
EPS-N (Ours)
0.9983
0.9975
0.9178
0.9979
0.8235
0.7215
0,9930
EPS-AD (Ours)
1.0000
1.0000
1.0000
1.0000
1,0000
0.9998
1.0000
under other attacks. Combining Table 2 and | we find that adversarial detection performance for MD and LID worsens. An explanation is that their detectors are trained with vectorized features extracted from the samples through logistic regression, resulting in their limited generalization on unseen attacks. contrast, diffusion- based detection methods show superior performance since they directly model the distribution of natural data.
Detecting on transferable attacks. To validate the transferability, we train KD, LID, MD and LiBRe detectors with ResNet-50 but detect the adversarial examples from surrogate ResNet-101 model. Comparing Table and []] the non-diffusion-base methods (e.g., KD, LID, MD and Li- BRe) drop significantly against transferable attacks. By contrast, our EPS-AD method achieves significantly better transferability, since it does not rely on specific classifiers, but rather models the distribution natural data, indicating its versatility various attack scenarios.
4.4 ABLATION STUDY ON IMPACT OF TIMESTEP
We conduct experiments on ImageNet over ResNet-50 to show the effect of the timestep. To this end, we set the total timestep T 100, which is sufficient for both EPS-AD and EPS-N achieve good solution. As shown in Figure (f), we draw two observations: 1) our EPS-AD and EPS-N are insensitive the total timestep 7 while S-N fluctuates greatly with the timestep 2) As the total timestep T' increases, EPS-AD and EPS-N exhibit progressively better performance, however, this gain gradually decreases when exceeds the optimal value. This is due to the larger diffusion time, the mean μa in ( gradually approaches zeros, resulting in smaller discrepancy between the natural and adversarial distributions. Nie et al. (2022) also confirms this phenomenon (Theorem 1).
CONCLUSION
In this paper, we propose a new statistic expected perturbation score (EPS) to capture the informa- tion from multi-view observations of one sample, which is able to distinguish between natural and adversarial data well. Relying on EPS, we propose a novel adversarial detection method, EPS-AD. We provide theoretical analysis demonstrate the superiority of EPS-AD. Extensive experiments on CIFAR-18 10 and ImageNet across different network architectures including ResNet, WideResNet and ViT show EPS-AD successfully detects adversarial samples in various attack scenarios.

---

Under review as a conference paper at ICLR 2023
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of experimental results, we provide an exhaustive implementation in Section[Dante and the code will be released upon acceptance.
REFERENCES
SH Abdel-Aty. Approximate formulae for the percentage points and the probability integral of the non-central X 2 distribution. Biometrika, (1(44)):53--540, 1954.
Ahmed Abusnaina, Yuhang Wu, Sunpreet Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen. Adversarial example detection using latent neighborhood graph. In Proceedings of the JEEE/CVF International Conference on Computer Vision, pp. 7687-7696, 2021.
HW Alt. Lineare funktionaalnallsss.. eine anwendungsorrienterte einführung aufi. Springer-Verlee 10:978-3, 2006.
Karsten M Borgwardt, Arthur Gretton, Malte Rasch, Hans-Peter Kriegel, Bernhard Schölkopf, and Alex J Smola. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformaticc, 22 22(14):44-e557 2006.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pp. 39 57. IEEE, 2017.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with ensem- ble of diverse parameter-free attacks. In Proceedings of the 37th International Conference on Machine Learning, pp. 2206-2216 PMLR, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248-255. IEEE, 2009.
Zhijie Deng, Xiao Yang. Shizhen Xu, Hang Su, and Jun Zhu, Libre: A practical bayesian approach to adversarial detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 972-982, 2021.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversar- ial examples by translation-invarinl attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321, 2019.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An im- age is worth 16x16 words: Transformers for image recognition scale. International Confer- ence on Learning Representations, 2021.
Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. arXiv preprint arXiv: /703. 0003 10, 2017.
Ruize Gao, Feng Liu, Jingfeng Zhang, Bo Han, Tongliang Liu, Gang Niu, and Masashi Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. In International Conference on Machine Learning, pp. 3564-3575. PMLR, 2021.
Ruize Gao, Jiongxiao Wang. Kaiwen Zhou, Feng Liu, Binghui Xie, Gang Niu, Bo Han, and James Cheng. Fast and reliable evaluation of adversarial robustness with minimum-maree attack. In Proceedings of the 39th International Conference on Machine Learning, pp. 7144-7163, PMLR, 2022.
10

---

Under review as a conference paper at ICLR 2023
Li-Hua Gong, Ling-Zhi Xiang, Si-Hang Liu, and Nan-Run Zhou. Born machine model based on matrix product state quantum circuit. Physica A: Statistical Mechanics and its Applications, 593: 126907, 2022.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34:4218 2021.
Arthur Gretton, Karsten M Borgwardt, Malte Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. Journal of Machine Learning Research, 13(1):723-77,, 2012.
Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprint TeeXiv:/702..00 06220, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings the IEEE Conference Computer Vision and Pattern Recognition, 2016.
Chin-Wei Huang, Jae Hyun Lim, and Aaron C Courville. A variational perspective on diffusion- based generative models and score matching. Advances in Neural Information Processing Sys- tems, 34:22863-228777 2021.
Aapo Hyvärinen and Peter Dayan, Estimation of non-normalized statistical models by score match- ing. Journal of Machine Learning Research, 6(4), 2005.
Alberto Jiménez- Valverde. Insights into the area under the receiver operating characteristic curve (auc) a discrimination measure in species distribution modelling. Global Ecology and Bio- geogruphy, 21 5944 2012.
Wittawat Jitkrittum, Wenkai Xu, Zoltán Szabó, Kenji Fukumizu, and Arthur Gretton. A linear-time kernel goodness-of--ee test. Advances Neural Information Processing Systems, 30, 2017.
Diederik Kingma, Tim Salimans, Ben Poole, and Jonathan Ho. Variational diffusion models. Ad- vances in Neural Information Processing Systems, 34:21696-21707, 2021.
Alex Krizhevsky. Learning multiple layers of features from tiny images. (Technical Report) Uni- versity of Toronto., 2009.
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial Intelligence Safety and Security, pp. 99-112. Chapman and Hal//CRC, 2018.
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference Learning Representations, 2021.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of -uttt--diitribution samples and adversarial attacks. Advances in Neural Information Processing Systems, 31, 2018.
Bo Li and Yevgeniy Vorobeychik. Feature cross cross-substitution adversarial classification. Advances in Neural Information Processing Systems, 27, 2014.
Feng Liu, Wenkai Xu, Jie Lu, Guangquan Zhang, Arthur Gretton, and Danica J Sutherland. Learn- ing deep kernels for non-parametric two-sample tests. In International Conference on Machine Learning, pp. 6316-6326. PMLR, 2020.
Mingsheng Long, Yue Cao, Jianmin Wang, and Michael Jordan. Learning transferable features with deep adaptation networks. In International Conference on Machine Learning, pp. 97-105. PMLR, 2015.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: fast ode solver for diffusion probabilistic model sampling in around 10 steps. 2022.
11

---

Under review as a conference paper at ICLR 2023
Xingjun Ma, Bo Li, Yisen Wang. Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. In International Conference Learning Representations, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, 2022.
Utku Ozbulak, Arnout Van Messem, and Wesley De Neve. Impact of adversarial examples on deep learning models for biomedical image segmentation. In MICCAI, 2019.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Con- ference Computer Vision and Pattern Recognition, pp. 10684-10695, 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kam- yar Seyed Ghasemipour, Burcu Karagol Ayan, S Sara Mahdavi, Rapha Gontijo Lopes, et al. Photorealistic text-to-image diffusion models with deep language understanding. arXiv preprint WrXiv:2205.11483 2022.
Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self- supervision. In International Conference on Learning Representations, 2021.
Alex Smola, Arthur Gretton, Le Song, and Bernhard Schölkopf. A hilbert space embedding for distributions. In International Conference on Algorithmic Learning Theory, pp. 13-31. Springer, 2007.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in Neural Information Processing Systems, 32, 2019.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference on Learning Representations, 2021.
Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj. et al. Towards efficient and effective adver- sarial training. Advances in Neural Information Processing Systems, 34:1 1e11112211118 2021.
Christian Szegedy. Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
Pascal Vincent. A connection between score matching and denoising autoencoders. Neural Compu- tation, 23(7):1661-1674, 2011.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pp. 1924-1933, 2021.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan I. Yuille. Improving transferabilityy of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2730-2739, 2019.
Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based based generative models. In International Conference Machine Learning, pp. 12062-12072. PMLR, 2021.
12

---

Under review as a conference paper at ICLR 2023
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016, 2016.
Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transferability via neuron attribution-based attacks. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14993- 15002, 2022.
Yongchun Zhu, Fuzhen Zhuang, and Deqing Wang. Aligning domain-spedte distribution and clas- sifier for cross-domain classification from multiple sources. In Proceedings of the AAAI Confer- ence on Artificial Intelligence, volume 33, pp. 5989-5996, 2019.
13

---

Under review as a conference paper at ICLR 2023
APPENDIX OF EPS-AD
In appendix, we provide detailed proof' of the theorem and corollary, descriptions of related works, more details and more experimental results of the proposed EPS-AD. We organize the supplemen- tary into the following sections. In Section [ we provide descriptions of related works regarding adversarial detection. In Section B we derive the proofs of the theorem and corollary. In Section C we demonstrate the pseudo-code of our proposed EPS-AD. In Section D present detailed imple-
mentation of our experiments. In Section E, we show the impact of EPS in our method, In Section
F we study the impact of adding perturbations over samples in our method. In Section G we report more comparison results, more ablation studies and more applications of our proposed EPS-AD,
A RELATED WORK
Diffusion models. Diffusion models have emerged as a powerful generative model in many syn- thesis tasks (Song& & Ermon 2019 Dhariwal & Nichol [021] Saharia et al. 2022. Rombach et al.) 2022 Ramesh et al., (2022). Since then, many researchers exploit the diffusion model to adversarial purification for improving the robustness of model (Nie et al., 2022; Yoon et al. 202T, where the score becomes a powerful means. Yet, only few researchers apply them to adversarial detection. Recently, Yoon et al. (202T) employ the score model purify the adversarial examples and use the norm of scores as the stopping condition of the purification. They also demonstrate some results about the norm of score in distinguishing adversarial samples from natural samples. However, this criterion is not effective enough for adversarial detection. In our work, we comprehensively consider multiple scores of perturbed samples, where these perturbed samples are from the same sample, and exploit rich information from these scores for adversarial detection. We empirically compare our approach to these methods and find that our approach outperforms these methods by a large margin.
Adversarial Attack. Numerous studies have been proposed to attack neural networks by slightly modifying the input data to trigger misclassifications of classifiers. We enumerate a series of such works in what follows. Fast Gradient Sign Method (FGSM) (Goodfellow et al. 2013) simply adds small noise along the gradient of the loss function. To further adjust the direction of increment, Kurakin et al. (2018) propose Basic Iterative Method (BIM) that extends FGSM to iteratively take multiple steps. Madry et al.] (2018) propose Projected Gradient Descent (PGD) by combining the iterative method with random initialization for the adversarial example. Meanwhile, (Dong et al.) 2018) propose Momentum Iterative Method (MIM) by adding a momentum term to BIM for achiev- ing a more stable attack. Besides, Dong et al. (2019) propose
caanslation-nvvriinn Method (TIM) by optimizing the perturbation over translated images to obtain more transferable attacks, which can be incorporated into the methods FGSM and BIM. To further improve the transferability of attack, Wang & He| (202T) propose variance tunning to guide the gradient update, namely VMI-FGSM; Zhang et al. (202) conduct feature-level attacks with more accurate neuron importance estimations, (NAA) attack. Besides the non-targeted attack methods mentioned above, there are also many methods that perturb data to one target label. For example. Carlini & Wagner (017)) perform an attack by incorporating the iterative mechanism of BIM, called CW. Be- sides, there approaches that combine multiple attacks to perturb data, such as the AutoAttack (Croce & Hein 2020) and the Minimum margin (MM) attack (Gao et al. 2022). y. the faster version of AutoAttack. The various attacks may cause serious consequences in security-critica, tasks, raising an urgent requirement for advanced techniques to achieve a robust model.
called Neuron Autribution-base
Adversarial detection. To ensure the safety of machine learning system, a plethora of exploration
for adversarial detection has attracted increasing sight. The most common idea to filter out ad- versarial samples from test data using a trained binary classifier, Recently, statistics on hidden-layer features of DNNs are widely considered for adversarial detection. Feinman et al. (2017) train a logistic regression classifier using Kernel Density (KD) of features in the last hidden layer, as well as Bayesian Uncertainty (BU) as a basis. Ma et al. (2018) consider the local intrinsic dimensionality (LID) of the features of DNNs as the characteristics for detection. [ee et al. (2018) 8) use maha- lanobis distance-based score to detect adversarial examples. In addition, Deng et al. (202T) train a Bayesian neural network by adding uniform noises to the samples. However, these methods train a tailored detector for some specific attacks or for a specific classifier, which largely overlooks the modeling for data distribution, leading to their limited performance under unknow attacks.
14

---

Under review as a conference paper at ICLR 2023
B PROOFS IN SECTION 3
B. PROOF OF THEOREM I
Theorem 1 Assuming that the distribution of natural data p(x) = Nuxx o given a perturba-
tion transition kernel pox (xt xo) = N (xe: Tx
x Ii with "It and or being the time-dependent noise schedule. then the following three conclusions hold for ((x):
1) For & x~p(x), S(x) ~ (N, džI);
2) For V y-)p(x), adversarial sample y=y+c with perturbation 6, (19)~N(-Mss;p3
3) For V y p(x), adversarial sample y-y+e, we have
S(x) 5(y) 4 NO0, 20
(12)
S(x) S()) 4 (Hs,
(13)
where pss -
77070-000000 1102-00
c and o E, 3
Proof. Based on the distribution p(x), Le., x N4xx: I)), obtain Xo fx + 0x
with z (N, I); based on the perturbation transition kernel po: (xt xo) N (x::7 of we have X2 = "xuu + o,z. Combining the distribution of x and Xg, we have
X -xx V 1803 ofl.
i. N(TMxx 2o + of)
(14)
For x, px())= N(TMMx 1f + o/), we calculate the derivation
Vx log (x) = X, 7M
N(0,I).
(15)
20 +
Vi202 + top
Taking expectation to f, we give the distribution of S(x)
S(x) N(0, where o² = B, 1
(16)
98 720 + o²
2) Based on y p(x) and y y e, obtain 8o ÿ NN + e, 1 + e -
Then, we have
Vy Po (5)
N(O,I)
(17)
20 + oF
V + +
1o +
where the last equation is based on pr(y) (x() = NN(T 1002 + o0).
Taking expectation to f, we give the distribution of S(ý)
e1 and o3 E,
S(g)~N((Hs, where ps
(18)
72 7oz
7202 of
3) According to the additive property of the Gaussian distribution, combing Eq. (16) and Eq. obtain the third conclusion.
18
B.2 PROOF OF COROLLARY 1
Corollary Considering the Gaussian kernel k. (x,y) exp (- 1-xx-x11- (11x==11(((20))) and the sumption in Theorem for v0<x<11 the probability of P(k(x,)) > 1) is given by
y/12
P(k(x,))>n) - [ (1(1luss1))dd
(19)
where μ. denotes the mean of S(x) - S is a constant for given and o, x2 is the probability density function of noncentral chi-squared distribution with d degrees of freedom Abbde--Ay 1954).
15

---

Under review as a conference paper at ICLR 2023
Proof. Based the Gaussian kernel x. (x, y). we have
P P(k(x,8) =P { exp (- -1x)()) (202) mn}
= - <2
(20)
Inn] 1n2
(21)
Let g ~ S(x) - -((),
then E ~ N (( 03²), thus we have
P ((((x,)))n) = 2
120 -
Σ E
d
d
Sa
20 In
P
(22)
05
Note that fo ((ms)) 1), based on the definition of noncentral chi-squared distribution ag
(Abdel-
Aty
1954), we have
x2 (1
(23)
0s
Let C 22 Inn, o3
we obtain the conclusion
P ((((x,))2n)= = S/ <3(lluss??)de
(24)
C PSEUDO-CODE OF EPS-AD
Algorithm 1: Expected Perturbation Score for Adversarial Detection (EPS-AD)
Input:
Natural sample set {x]] (n) 1i-1. an upcoming sample &o, pre-trained score model 8e (x1, 1) and
diffusion timestep 7"
Output: MMD between EPS of the upcoming sample Xo and EPSs of natural samples (xg }. Set initial time step t= for f 1,..., T do
Obtaining perturbed natural samples fx) Ti=1 according to Pos (Xe xu); Obtaining perturbed upcoming sample x according Pos (X, xx))
end
Compute EPSs of natural samples (S(x (0) } using Eq
Compute EPS upcoming sample S(x) using Eq.
Compute the MMD between ()) and ((x) using Eq. 10
16

---

Under review as a conference paper at ICLR 2023
D MORE DETAILS FOR EXPERIMENT SETTINGS
D.1 IMPLEMENTATION DETAILS OF OUR METHOD
Our adversarial detection method built upon diffusion models. Specifically, we consider the pre-
trained diffusion model of Score SDE for CIFAR-10 following [Song et al. (202T) and choose the
vp/cifar/0 SisiarrO_ddpppa ddpmppp deep continuous checkpoint from the score_sde library for ImageNet, we con-
sider the pre-trained diffusion model of Guided Diffusion following Dhariwal & Nichol [022 and
use the 256> x 256 diffusion (unconditional) checkpoint from the mnided-diiffusionn library
For classifiers, we use pre-trained WiderResNet-28- (Zaooruyko & Komodakis 2016) and WiderRessNet-7--16 (Gowal et al., 2021) for CIFAR-10, and ResNet-50,, ResNet-101 (He et al. 2016), and DeiT-S (Dosovitskiy et al.) 2021) for ImageNet. For attacks, consider 8 attack inten- sities é E [1/255, 8/255] with iterative attacks run for steps using step size e/5 under 12 different lg and fo attack methods to generate adversarial examples, including PGD, PGD-Cz (Madry al., 2018), FGSM, FGSM-&2 (Goodfellow et al. 2013). BIM, BIM- (Kurakin et al. 2018). MIM (Dong et al. 2018), TIM (Dong al. 2019), CW (Carlini & Wagner| 2017), DI MIMiM al.) 2019) and two adaptive attacks AutoAttack (AA) (Croce & Hein| 2020) and Minimum-Margin Ar- tack (MM) (Gao et al., 2022) that is a faster version of AA. And for evaluation, we choose the area under the receiver operating characteristic curve (AUROC) as metric for adversarial detection. Through all our experiments, we only use FGSM and FGSM-L22 = /255) to train a deep kernel to perform detection against all the attacks following Liu et al. (2020) where the deep kernel can also be trained on general public dataset which we leave for our future work. Note that our method is suitable for detecting all the le and foo adversarial samples. We conduct our experiments based on Python 3.7 and Pytorch 1.7.1 on server with Ix RTX 3090 GPU.
D.2 IMPLEMENTATION DETAILS OF BASELINES
We choose three standard adversarial detection approaches, KD (Feinman et al. 2017). LID MMal et al. (0118) and MD (Lee et al. 2018) as baselines for both CIFAR-I0 and ImageNet, as well as LiBRe (Deng et al. 2021) individually on the ImageNet, which trains a Bayesian neural network by adding the uniform noises into the samples. Besides, we also construct two additional diffusion- based detection methods: S-N: using the score norm of raw images as the characteristics, i.e.
||sa(x, [) 2) EPS-N: using the norm of the EPS as the characteristics, i.e., [|S(x)]1
KD LID MD. We implement KD following the codebase LID following the codebase and MD following the codebasse These three methods train a logistic regressor to distinguish natural, noisy and adversarial samples. To show their best performance for adversarial detection, we choose the noise scale of the le distance in KD, LID and MD 40, 1, 10 on CIFAR-10 and 20, 1, 10 on ImageNet. Besides, for KD, we choose bandwidth as 10 on CIFAR- 10 and 20 on ImageNet.
LiBRe. We implement LiBRe ImageNet following their codebase on ResNet-50 and ResNet-101 to make a comparison.
We evaluate its performance
D.3 IMPLEMENTATION DETAILS OF FIGURE
For the results in Figure I we calculate the norms of scores of natural samples and adversarial samples at different purification timesteps using score model pre-trained on ImageNet, where these adversarial samples are crafted by FGSM with 1/255. Before feeding these samples into the score model, we do not perturb them again. To better demonstrate these results, we normalize score norm with the maximum of scores in each timestep.
ittpp///tttaaa.ccaoooo/////eeees sde
http:///ggiiiicccaa/a//aamaaaaaa subspaceeeeeceeee detection
httpa///stttii...c///kkaaggs///p Maha arobt detecctooo arobla_detsctoor
tttpa:/// http:///gthhub..mm//t////// R
17

---

Under review as a conference paper at ICLR 2023
E IMPACT OF EPS FOR EPS-AD
In our method EPS-AD, we use diffusion-based score model to calculate the characteristics of sam- ples, i.e., EPS, which has the same dimension this sample. In this experiment, we investigate the impact of EPS in our method. As result, we remove the calculation of EPS from our method, instead using the raw sample mance of our method against 6 attacks under attack intensities E {2/255, 4/255] on ImageNet over ResNet-50 compared to that without EPS. Obviously. EPS-AD without employing EPS demon- strates significant performance drop ( 28% 4), suggesting the superiority of our proposed EPS in distinguishing between adversarial and natural samples.
their characteristic. Table 4 shows adversarial detection perfor-
Table 4: Impact of EPS with ResNet-50 on ImageNet under e = 2/255 and 6 = 4/225..
Perturbation
Method
FGSM
PGD
BIM
MIM
TIM
CW
EPS-AD (w/o EPS)
0.7132
0.7108
0.7101
0.7119
0.7120
0.7107
6 2/255
EPS-AD (w/ EPS)
1.0000
0,9997
0.9999
1.0000
0.9983
0.9995
EPS-AD (w/o EPS)
0.7176
0.7144
0.7131
0.7156
0.7156
0.7142
4/255
EPS-AD (w/ EPS)
1.0000
1.0000
1.0000
1.0000
1.0000
1,0000
Perturbation
Method
DIMIM
PGD-62
FGSM-&2
BIM-
MM
AA
EPS-AD (w/o EPS)
0.7117
0.7118
0.7133
0.7097
0.7066
0.7067
= 2/255
EPS-AD (w/ EPS)
0.9999
1.0000
1.0000
0.9999
1.0000
1.0000
EPS-AD (w/o EPS)
0.7156
0.7154
0.7175
0.7128
0.7101
0.7104
4/255
EPS-AD (w/ EPS)
1.0000
1.0000
1.0000
1.0000
1.0000
1.0000
IMPACT OF ADDING PERTURBATIONS OVER SAMPLES FOR EPS-AD
Adding perturbations into the samples is critical for our proposed EPS-AD. To investigate the impact of this operation, we conduct ablation studies against 6 adversarial attack methods on ImageNet. Ta- ble demonstrates adversarial detection performance of EPS-AD against attacks under = 1/255 on ImageNet over ResNet-50 compared to that without adding perturbations. We observe that the adversarial detection performance is significantly improved with adding perturbations. Specifically, method obtains about 1.86% 1 average of 12 attacks, in which the maximum is 4.84% against BIM- This coincides with the conclusion in Theorem that adding the perturbations helps distinguish between adversarial and natural samples.
Table 5: Impact of adding perturbations with ResNet-50 ImageNet under 1/255.
Method
PGD
BIM
FGSM-62
BIM-62
AA
EPS-AD (w/o perturbation)
0.9274
0.9405
0.9257
0.9960
0.9443
0.9835
EPS-AD (w/ perturbation)
0.9637
0.9845
0.9549
0.9997
0.9927
0,9936
Method
FGSM
MIM
TIM
DLMIM
PGD-éz
MM
EPS-AD (w/o perturbation)
0.9954
0.9885
0.9397
0.9791
0.9858
0.9818
EPS-AD (w/ perturbation)
0.9982
0.9972
0.9561
0.9817
0.9961
0.9928
18

---

Under review as a conference paper at ICLR 2023
G MORE RESULTS OF ADVERSARIAL DETECTION
To further evaluate the effectiveness of our proposed EPS-AD, in subsection G.1 we conduct more comparison experiments on detecting more adversarial attacks on ImageNet and CIFAR-I0 datasets. To demonstrate the generalization of EPS-AD, we conduct more experiments on detecting unseen attacks and transferable attacks. In subsection G.2 we additionally study the mechanism of EPS- AD by reporting the impact of time steps, set size, low attack intensity, transferability across datasets and real application detecting face anti-spoofing samples. We provide extra results of all compared as supplements of additional attack methods corre-
experiments in Table 6 7 8 and Figure 5 6 7
sponding to the main body.
G.1 MORE COMPARISON EXPERIMENTS
More comparison results on basic setup. In Table we provide additional attack results in- cluding MIM, TIM, DIMIM, PGD-42, MM on CIFAR-10 and ImageNet. We observe that EPS- AD keeps dominant position under these attacks. EPS-N and S-N exhibit poor performance on ImageNet due to the fact that these two methods use the norm of vectors and thus overlook the rich information that can be deviated from the vector. Moreover, we find that Figure and Figure 6 most adversarial detection methods suffer from the extremely low attack intensity (e.g. 1/255). In contrast, our method EPS-AD still has promising detection performance (refer to Table 14 for more quantitative results).
Table 6: More results of different adversarial detection methods CIFAR-10 and ImageNet in terms of AUROC under = 4/255 (MIM, TIM, DI, MIM, PGD-I2, MM).
Dataset
Method
MIM
TIM
DLMIM
PGD-2
MM
KD
0.8863
0.8856
0.8459
0.9296
0.9116
LID
0.9135
0.8781
0.8638
0.9426
0.9380
CIFAR- 10
MD
0.9890
0.9998
0,9846
0.9958
0,9836
S-N
0,9993
0,9985
0,9980
1.0000
0,9994
EPS-N (Ours)
0.9999
0,9996
0.9996
1,0000
0.9996
EPS-AD (Ours)
1.0000
0.9993
0.9999
1.0000
0.9995
KD
0.9669
0.9317
0.7402
0.9809
0.9377
LID
0.9665
0.9397
0.7658
0.9833
0,9575
ImageNet
MD
0,9664
0.9365
0,8612
0.9858
0,9585
LiBRe
0.9483
0.8772
0.9968
0.9532
0.8697
S-N
0.9087
0.8310
0.9143
0.9505
0.9090
EPS-N (Ours)
0.9778
0.9114
0.9779
0.9989
0.9939
EPS-AD (Ours)
1.0000
1.0000
1.0000
1.0000
1.0000
More comparison results on unseen and transferable attacks. We also compare our EPS- AD with KD, LID MD and LiBRe under 6 additional unseen transferable attacks (MIM, TIM, DIMIM, PGD-Ez, MM, VMI-FGSM (Wang & He 202T)) to further evaluate the effectiveness of method. In Table 7 and Table 8 Our approach consistently exhibits superior generalization compared to other baselines.
More comparison results CIFAR-10 over robust WideRessNet70-16. We further compare our method with baselines on an adversarial trained classifier on CIFAR- 10, e.g., WideResNet-70 16 (Gowal al. (021) against various attacks. Table 9 I0 We observe that diffusion-based detection methods are much better than other baselines trained with specific adversarial samples. One possible reason that adversarial samples are difficult to deceive robust classifiers, which means that such adversarial samples are ineffective for training effective detectors.
More comparison results on ImageNet over DeiT-S. We further make an attempt on Vision- transformer-based architecture (i.e. DeïT-S (Dosovitskiy et al. 202Th) ImageNet. Considering
19

---

Under review as a conference paper at ICLR 2023
1.00
0.95
0.90
0.85
AUROC
0.90
0.80
0.75
0.70
EPSN (oun)
(PS-D
0.75
235
233
f.
(a) Attack Method: BIM-L2
(b) Attack Method: DI_MIM
(c) Attack Method: MIM
1.00
1.000
1.00
0.955
0.90
0.550
AUROC
0.90
0.85
0.925
0.900
0.85
0.875
0.75
0.859
0.825
0.75
4/
(d) Attack Method: MM Attack
(e) Attack Method: PGD-L2
(1) Attack Method: TIM
Figure 5: More Results of adversarial detection on CIFAR-10. Sub-figures (a) (f) report the
AUROC on different attacks under (E(1) (1/2255, .., 8/255) and share the same legend in sub-figure (c).
1.0
1.0
0.5
0.9
AUROC
AUROC
0.8
AUROC
0.8
- LD
XD
0.7
<6- MD
LBNs
0.6
0.6
S-Ni
EPS (ours)
EPS-AD (cuns)
4
2
255
2.5255
255
(a) Attack Method: BIM-L2
(b) Attack Method: DL.IM
(c) Attack Method: MIM
1.0
1.0
1.0
0.5
0.9
AUROC
0.8
0.8
AUROC
0.8
0.7
2
2
4.
255
1/ 255
f,/
(d) Attack Method: MM Attack
(e) Attack Method: PGD-
(1) Attack Method: TIM
Figure 6: More Results of adversarial detection ImageNet. Sub-figures (a) (f) report the
AUROC on different attacks under eE (1/2555, ..., 8/255] and share the same legend in sub-figure (c).
the specificity of the vision-transformer-baac structure, we compare our method three baselines (LID, S-N and EPS-N). From Table [1 our method exhibits consistent superiority when compared other baselines, suggesting the versatility of EPS-AD with different architectures.
20

---

Under review as a conference paper at ICLR 2023
Table 7: More results of AUROC for detecting the unseen attacks (MIM, TIM. DIMIM, PGD-E2,
MM) on CIFAR-10. "FGSM (seen)" denotes the seen adversarial attack used for the training of KD, LID and MD.
Method
FGSM(scenn
MIM
TIM
DIMIM
PGD-62
MM
KD
0.9213
0.8867
0.8876
0.8549
0.9303
0.9114
LID
0.9236
0.9131
0.8479
0.8631
0.9090
0.9244
MD
0.9990
0.9858
0.9998
0.9791
0.9958
0,9829
S-N
1.0000
0,9993
0.9985
0.9980
1.0000
0,9994
EPS-N (Ours)
1.0000
0.9999
0.9996
0.9996
1.0000
0.9996
EPS-AD (Ours)
1.0000
1.0000
0.9993
0.9999
1.0000
0.9995
Table 8: More results of AUROC for detecting the transferable attacks (MIM, TIM, DI MIMM,, PGD- l2, MM, VMI-FGSM) on ImageNet, where KD, LID, MD and LiBRe are trained with adversarial examples with ResNet-50 but detect the adversarial examples crafted with R0s.
Method
MIM
TIM
DIMIM
PGD-42
MM
VMI-FGSM
KD
0.6355
0.7006
0.7558
0.7028
0.7381
0.7669
LID
0,7780
0.7978
0.7654
0.7734
0.7913
0,7386
MD
0.7756
0.7612
0.8395
0.7827
0.7864
0,8039
LiBRe
0,8966
0.7317
0.9722
0.8749
0.8388
0,9944
S-N
0.9049
0.8216
0.9117
0.9490
0.9043
0.8638
EPS-N (Ours)
0.9771
0.9049
0.9765
0.9987
0.9930
0.9609
EPS-AD (Ours)
1.0000
1.0000
1.0000
1.0000
1.0000
1.0000
G.2 MORE DISCUSSIONS OF EPS-AD
Ablation of timestep. The ablation study of timestep is provided in Table 12 We observe that when the timestep 7' stays in [10, 100). EPS-AD and EPS-N both obtain usable AUROC in detect- ing FGSM-62 attack, which verifies that our method is insensitive to the timestep. Moreover, Our approach achieves optimum performance when T 20 on CIFAR-10 and T 50 on ImageNet.
Impact of set size. Previous adversarial detection methods usually measure the discrepancy well only with large amount of data (Gao et al. 2021). To show the effectiveness of our proposed EPS- AD, in this experiment, we further ablate the effect of set size by conducting experiments on 100 to 500 samples subset of CIFAR-10 with WideResNNt-228- 10 and ImageNet with ResNet-50.. Per- formance of our three methods, S-N, EPS-N and EPS-AD, is shown in Table [3 and Figure [ It obvious that EPS-AD consistently outperforms EPS-N and S-N with small set size and large set size. Moreover, EPS-AD is robust to the changes of set size while EPS-N and S-N fluctuate with set size, especially on CIFAR-10 dataset.
Computational efficiency of EPS-AD Given a fixed-size model, the computational cost of our method (EPS-AD) mainly depends on two factors: the resolution of input images and total diffusion timestep T. Actually, our EPS-AD performs adversarial detection efficiently, especially on low- resolution images, and yields promising performance compared to existing methods. To evaluate the efficiency of EPS-AD, we randomly choose 500 images from CIFAR- 10 and ImageNet respectively in detecting FGSM-&2 adversarial samples on single RTX3090 GPU. The average time costs per image for CIFAR- 10 (T" 20) and ImageNet (I 50) 0.038s and 2.386s, respectively.
To further demonstrate the effect of total diffusion timesteps on the efficiency, we provide the results under different diffusion timesteps against FGSM-L2 attack, as shown in Table 12 From the table,
our EPS-AD method shows superior adversarial detection performance when 20 < T < 100 on ImageNet and takes 0.954s when T 20, which is much more efficient than that with T = 50. Moreover, our EPS-AD achieves superior or comparable performance on ImageNet and CIFAR-10 compared with existing methods (i.e., KD, LID, and MD) even with T as small as 20.
21

---

Under review as a conference paper at ICLR 2023
Table 9: Comparison of AUROC for using adversarial trained N classifier
CIFAR-10 under 2/255. Due to the constraint of memory and resources, we omit the detection
results on AutoAttack for KD, LID and MD.
Method
KD
LID
MD
S-N
EPS-N (Ours)
EPS-AD (Ours)
FGSM
0.5852
0.7551
0.6924
0.9797
0.9976
0.9978
PGD
0.5672
0.7517
0.6846
0.9625
0.9954
0,9961
BIM
0.5786
0.7543
0.6787
0.9568
0,9935
0.9930
MIM
0.5795
0.7544
0.6804
0.9679
0.9963
0.9957
TIM
0.5812
0.7533
0.6783
0.8468
0.9506
0.9407
CW
0.5559
0.7511
0,6830
0,9600
0.9949
0.9953
DLMIM
0.5763
0.7505
0.6712
0.8877
0,9728
0,9700
PGD-42
0.6116
0.7632
0.7049
0.9942
0,9994
0.9998
FGSM-62
0.6114
0.7619
0.7032
0.9471
0,9766
0.9861
BIM-62
0.7550
0.7629
0.7060
0.9396
0.9756
0.9828
Table 10: Comparison of AUROC for using adversarial trained WideResNNet-0-116 classifier on
CIFAR-10 under 4/255.
Method
KD
LID
MD
S-N
EPS-N (Ours)
EPS-AD (Ours)
FGSM
0.6020
0.7628
0.7668
0.9999
1.0000
1.0000
PGD
0.5913
0.7598
0.7535
0.9998
1.0000
1.0000
BIM
0.6076
0.7617
0.7588
0.9994
1.0000
1.0000
MIM
0.7683
0.7625
0.7601
0.9997
1.0000
1.0000
TIM
0.6029
0.7605
0.7563
0.9917
0.9984
0.9987
CW
0.5919
0.7581
0.7524
0,9998
1.0000
1.0000
DIMIM
0.6015
0.7562
0.7551
0.9983
0.9998
0,9999
PGD-62
0.8314
0.7774
0.7544
1.0000
1.0000
1.0000
FGSM-&2
0.7805
0.7709
0.7489
0.9803
0.9902
0.9967
BIM-&
0,8351
0.7739
0.8141
0.9835
0.9927
0.9955
Note that the computational efficiency of our method can be further improved by applying an ef-
ficient sampling strategy (Lu al.] 2022). a low-resolution diffusion model (Dhariwal Nichol 2021 and a sparse diffusion timestep (e.g., sampling with time interval of 2/1000 during the dif- fusion process). We leave these techniques for our future work.
Detecting on low attack intensity. To further reveal the superiority of our EPS-AD, conduct an experiment under an extremely low attack intensity (e.g., c 1/255) on ImageNet. In Table 14 observe that Our EPS-AD achieves significant advantage in detecting adversarial samples crafted with extremely low attack intensity, demonstrating its significant effectiveness.
Detecting on adversarial samples across datasets. We further exploit the transferability across different datasets. To this end, we utilize pre-trained ccore-hased diffusion model on ImageNet to perform detecting adversarial samples from CIFAR-10. Specifically, we randomly select two dis- joint subsets adversarial and natural samples (each containing 500 samples) from CIFAR-10 and use score model pre-trained on ImageNet to calculate the AUROC, which is named EPS-AD* Table 15 demonstrates detection performance of 6 methods against 12 attacks under 2/255 on CIFAR- 10 over WideResNet-28. 28-10. We observe that EPS-AD* still exhibits superior detection per- formance compared to KD, LID, MD baselines, and achieves comparable performance compared to other diffusion-based methods that use the score model pre-trained on CIFAR-10.
22

---

Under review as a conference paper at ICLR 2023
Table 11: Comparison of AUROC for using DeiT-S as classifier on ImageNet under e = 4/255.
Method
LID
S-N
EPS-N (Ours)
EPS-AD (Ours)
FGSM
0.8846
0.9789
0.9984
1.0000
PGD
0.9162
0.8935
0.9969
1.0000
BIM
0.9191
0.7331
0,9215
1.0000
MIM
0.9102
0,9025
0,9780
L.0000
TIM
0.9019
0,8091
0,8765
0.9606
CW
0.8742
0.8934
0.9975
0.9999
DI.MM
0.7246
0.9074
0.9752
1.0000
PGD-62
0.9041
0,9451
0,9987
1.0000
FGSM-&2 &
0.8698
0,7665
0,7023
1.0000
BIM-f2
0.9002
0.6564
0.6544
1.0000
MM
0.9164
0,8902
0,9886
0.9993
AA
0.9191
0.9023
0.9915
1.0000
1.0
1,000
0,975
0.9475
AUROC
0.925
EPS AD (ours)
(ours!
0.3950
0.9925
EIS-N touns) EPS AD (ours)
SIN
AUROC
0.6
0.8
0.9900
0.4
EPS-DD (ours)
0.3625
0.2
500
20
40
60
80
100
Size
Size
Times 11000
(a) Impact of set size on ImageNet (b) Impact of set size on CIFAR-10
(c) Impact of timestep
Figure 7: Impact of different sizes and diffusion time step. Sub-figures (a) and (b) report the AUROC on FGSM-&2 attack under = 4/255. Sub-figure (c) reports the AUROCs of different diffusion time {1, 2, 5, 10, 20, 50, 100} on CIFAR-10 dataset.
Table 12: Impact timestep with WideResNet-28-10 on CIFAR-10 and ResNet-50 on ImageNet against FGSM-&2 under = 4/255.
timestep
Dataset
10
20
50
100
Method
S-N
0.9508
0.9792
0.9885
0.9860
0.9768
0.7590
0.6218
CIFAR-10
EPS-N (Ours)
0.2346
0.4454
0.8018
0.9526
0.9916
0.9915
0.9889
EPS-AD (Ours)
0.5166
0.5368
0.6994
0.9566
0.9994
0.9988
0.9985
S-N
0.4794
0,5298
0.7168
0.8528
0.8830
0.7309
0,5964
ImageNet
EPS-N (Ours)
0.2246
0,2466
0.4369
0.6215
0.7484
0.8191
0.8190
EPS-AD (Ours)
0.5112
0.5545
0.5662
0.6912
0.9917
1.0000
0,9930
Table 13: Impact of data set size with WideResNNt-28-10 on CIFAR- and ResNet-50 on ImageNet against FGSM-&2 under 4/255.
Dataset
size
100
200
300
400
500
Method
S-N
0.9829
0.9864
0.9850
0.9875
0.9885
CIFAR-10
EPS-N (Ours)
0.9872
0.9919
0.9907
0.9916
0.9916
EPS-AD (Ours)
0,9990
0.9997
0.9996
0,9996
0.9994
S-N
0.8867
0.8922
0.8889
0.8872
0.8830
ImageNet
EPS-N (Ours)
0,8318
0.8276
0.8257
0.8259
0.8191
EPS-AD (Ours)
1.0000
1.0000
1,0000
1,0000
1,0000
23

---

Under review as a conference paper at ICLR 2023
Table 14: Comparision of different adversarial detection methods with attack intensity e 1/255 over ResNet-50 on ImageNet.
Method
KD
LID
MD
LiBRe
S-N
EPS-N (Ours)
EPS-AD (Ours)
FGSM
0.7301
0.7765
0.7694
0.5653
0.5654
0.6942
0.9982
PGD
0.8167
0.7651
0,8116
0.6938
0.5348
0.6149
0.9637
BIM
0.8313
0.7711
0,8303
0.7154
0.5240
0,5619
0.9845
MIM
0.8079
0.7711
0.7313
0.6597
0.5411
0.6144
0.9972
TIM
0.7879
0.7634
0.7449
0.5655
0.5344
0.5780
0.9561
0.8161
0.7690
0,8336
0.6996
0.5345
0.6169
0.9549
DLMIM
0.7498
0.7498
0,7543
0,5538
0,5364
0.6052
0.9817
PGD-22
0.8597
0.8633
0.8707
0.7824
0.5519
0.6678
0.9961
FGSM-L2
0.7265
0.7737
0.7704
0.5727
0.5546
0.5978
0.9997
BIM-
0.8596
0,8602
0.8644
0.7701
0.5199
0.5462
0.9927
MM
0.8505
0.8730
0.8786
0.6611
0.5340
0.6106
0.9928
0.8535
0,8706
0.8733
0.6629
0.5351
0.6113
0.9936
Table 15: Comparison of cross-dataset EPS-AD* under attack intensity = 2/255 with other meth- ods over 28d on CIFAR-10, where EPS-AD" utilizes model pre-trained ImageNet.
Method
KD
LID
MD
S-N
EPS-N (Ours)
EPS-AD (Ours)
EPS-AD"
PGD
0.8871
0.8836
0.8815
0.9679
0.9950
0.9972
0.9987
FGSM
0.9112
0.9010
0.9200
0.9902
0.9987
0.9994
0.9961
BIM
0.8786
0.8878
0.8811
0.9268
0.9811
0.9914
0.9890
MIM
0.8873
0.8909
0.8947
0.9676
0,9935
0.9975
0,9964
TIM
0.8983
0.8735
0.9655
0.9603
0,9878
0.9747
0,9906
CW
0.8634
0.8762
0.8968
0,9682
0,9953
0.9975
0,9971
DI MIM
0.7810
0.7351
0.8153
0.9348
0.9764
0.9942
0.9918
PGD-C,
0.8727
0.8935
0.9128
0,9931
0,9989
0.9997
0,9994
FGSM-(2
0.9044
0.8927
0.9211
0,9166
0,9634
0.9976
0,9973
BIM-6
0.8675
0.8864
0.8946
0.8564
0,9333
0,9922
0,9896
MM
0.8627
0.8843
0.8404
0.9497
0.9706
0.9727
0.9658
AA
0.8754
0.8894
0.8392
0.9595
0.9775
0.9819
0.9782
24


Reviews:
[{"review_id": "oUS_6hg0Wn", "reviewer": "Reviewer_yyTy", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors introduce an adversarial detection algorithm which tackles the sensitivity of detection scores from the single sample via proposed expected perturbation score. Specifically, the scores are obtained by the diffusion process which takes into consideration multiple levels of noise. The obtained scores are compared through maximum mean discrepancy. The experiments are conducted on different datasets and settings, which involve the evaluation of different attacks. The proposed adversarial detection algorithm show superiority compared to other baselines.", "summary_of_the_review": "Overall, I think this paper is interesting and solid. It would be better if the authors can provide more analysis of the inference efficiency and include more evaluation of up-to-date transferable attacks.\n", "strength_and_weaknesses": "Pros:\n\n++ The paper is well-written and well-motivated. Motivated by the ineffectiveness of the score of one sample, the authors propose to use expected perturbation score via pre-trained diffusion model seems natural.\n\n++ The authors provide theoretical analysis to show that proposed expected perturbation score can better distinguish the distributions between natural examples and adversarial ones.\n\n++ The experiments are extensive. The evaluation is conducted on both CIFAR and ImageNet under various attacks. The authors also consider the adversarial detection of both white-box and black-box settings. The results are promising and convincing, which achieve better performance than other detectors.\n\nCons:\n\n-- One of my concerns lies in the computational cost of proposed adversarial detection. According to Figure 2, both a set of natural images and the target image are fed to the pre-trained diffusion model for perturbation generation and expected perturbation score computation, it seems to have a burden of computation compared to other two-sample test methods.\n\n-- It would be better for the authors to provide evaluation of adversarial detection on up-to-date transferable attacks, such as [1,2]. \n\n[1]. Enhancing the Transferability of Adversarial Attacks through Variance Tuning. CVPR 2021.\n\n[2]. Improving Adversarial Transferability via Neuron Attribution-based Attacks. CVPR 2022.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "MVyC8tDrLmj", "reviewer": "Reviewer_RHkt", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a new statistic, called Expected Perturbation Score (EPS), for adversarial detection. Based on EPS, the authors develop a Maximum Mean Difference (MMD) metric to measure the difference between test samples and natural samples, and further propose an EPS-based adversarial detection method (EPS-AD). Sufficient theoretical analysis and extensive experiments demonstrate the correctness and effectiveness of the proposed method.", "summary_of_the_review": "This paper is easy to read and interesting but still has some minor issues, please refer to weaknesses.", "strength_and_weaknesses": "Strength:\n1. This paper is easy to read.\n\n2. The authors propose a new statistical method, called Expected Perturbation Score (EPS), which is able to obtain enough information to identify adversarial examples with only one example after various perturbations.\n\n3. Sufficient theoretical analysis is performed to demonstrate that EPS is able to simulate the difference between the two distributions under mild conditions. Furthermore, extensive experimental results demonstrate the superiority of the proposed EPS-AD.\n\n4. The proposed EPS will be an effective statistic in many applications, such as out-of-distribution detection and anomaly detection.\n\nWeaknesses:\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "AmUOhiQ4vY", "reviewer": "Reviewer_d5es", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a new method based on average score function difference to detect adversarial perturbations in a given image. The main result of the paper is empirical, the paper also provides some theoretical justification of the usefulness of the score estimation.", "summary_of_the_review": "The empirical findings of the paper are solid, although not novel. The mathematics in the paper is a bit concerning and probably needs some rework.", "strength_and_weaknesses": "The main strength of the paper is empirical: the proposed method works very well compared to some of the earlier baselines. The method can effectively detect adversarial perturbation in the low perturbation regime. The author did experiments on both CIFAR data and ImageNet data with different architectures to justify the result.\n\n\nThe main weakness of the paper is three folds: First of all, the proposed method is based on the mean discrepancy. It is not very useful in detecting whether a single image is perturbed or not -- While the previously proposed method can do so for a single image. Hence the paper is only compared to other works in its favorable setting. To that extent, the paper should at least study the dependency of the detection accuracy w.r.t the total number of samples used. \n\nSecondly, the paper also emphasizes that their advantage is \"multi-view\", where they average the score estimation over time -- I expected the theory to provide some insights on why such averaging is useful, but I could not interpret it from the current form.\n\nThird, I have significant concerns about Definition 1. Here, the author seems to take x_0 = x to define S(x). However, in the \"Estimation for expected perturbation score\" section, the author claims that they are using s_\\theta(x_t, t) to estimate S(x). Note that  s_\\theta(x_t, t)  is computed not from x_0 = x, but by averaging over all possible x_0 sampled from distribution p_0. I am not sure this is a good approximation of the S(x) as in Definition 1. The definition probably needs some re-work, but I'm afraid that theorem 1 will be completely falsified after that.\n\n\n\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject