# Novel Exploit Feature-Map-Based Detection of Adversarial Attacks
## 2 Related Work  
[PERSON] et al. [7] proposed a non-DL approach which involves searching for features using a set of well-known image transforms, such as the Discrete Wavelet Transform, the Discrete Sine Transform, and classifying the features using a support-vector-machine-based classifier. The detection algorithm yielded at least 84.2% and 80.1% detection accuracy under seen and unseen database test settings, respectively. Additionally, they also emphasized how the impact of the adversarial perturbation can be neutralized using a wavelet-decomposition-based filtering method of denoising. [PERSON] et al. [8] carried out defensive approximation classification with the same level of accuracy without the application of retraining. The convolution neural network's resources and energy consumption were also decreased by using an approximation computing model. If a strong transferability-based attack on a LeNet-5 or Alexnet, the proposed implementation makes them more resistant to 99% and 87%, respectively, as the approximate logic implementation is easier to use. [PERSON] et al. [9] used the sensitivities of image classifiers to offer a unique technique for identifying adversarial pictures that is fast and accurate. Due to the fact that adversarial pictures are formed by adding noise, they concentrate on the behavior of the outputs of image classifiers for images that have been filtered differently. When the strength of an image classifier is increased, the output of a SoftMax function in the classifier is substantially altered in the case of adversarial images, but the output is rather steady in  
Figure 1: (**a**) Original image (**b**) feature-map (**c**) adversarial attack (**d**) attack feature-map. the case of normal images. They also explored the operation-oriented properties of several noise reduction techniques. [PERSON], et al. [10] proposed an auto attacker revolutionary reinforcement learning system in which agents learn how to operate around a black-box model by questioning it, extracting the underlying decision behavior efficiently, and successfully undermining it. The auto attacker is a first-of-its-kind reinforcement learning system that makes no assumptions about the differentiability or structure of the underlying function. As a result, it is resistant to standard defenses such as gradient obfuscation and adversarial training. The auto-attacker revolutionary reinforcement learning method works well even if the output is less descriptive or missing. [PERSON] et al. [11] developed innovative network topologies that promote adversary robustness by conducting feature denoising in order to improve adversarial resilience. They have specifically designed blocks in their networks that denoise the features by using non-local techniques or other filters. The complete network is trained from beginning to finish whenever new blocks come into the network. The designed system can be used in both white-box and black-box assault contexts. The ImageNet technique achieves 55.7% accuracy under 10-iteration on projected gradient descent white-box attacks, while the previous algorithm achieves 27.9% accuracy. While under severe 2000-iteration on projected gradient descent white-box attacks, their method achieved 42.6% accuracy. [PERSON] et al. [5] discussed an overview of the attack anomaly detection system by considering a successful, targeted test-time evasion attack example that was developed with a \"clean\" example \(x\) from a parent class \(cs\) and perturbing it until the perturbed example's judgement is identical to the source class \(cs\). They also carried out work on test-time evasion (TTE), data poisoning (DP), backdoor DP, and reverse engineering (RE) attacks and particularly defenses against the anomaly detection. [PERSON] and [PERSON] [12] considered an assault in which a pixel is selected at random to be perturbed by the same amount that may be used to cause an attack. Propagation Maps and Locality Analysis are two probable tools for understanding a one-pixel attack.