## 2 Related Works
### Adversarial Attack  
Adversarial attacks try to force deep neural networks(DNNs) to make mistakes by crafting adversarial examples with human imperceptible perturbations. We denote \(x\) as the input of DNN, \(C_{x}\) as the label of input \(x\), and \(f(\cdot)\) as the well-trained DNNs. Given \(x\) and network \(f(\cdot)\), we can obtain the label of input \(x\) through forward propagation; in general, we can call \(x\) an adversarial example if \(f(x)\
eq C_{x}\). Here, we introduce five mainstream attack methods including FGSM, PGD, DeepFool, JSMA, and CW. They are all typical attack methods ranging from \(L_{0}\), \(L_{2}\), to \(L\infty\) norms. Figure 1: An overview of our detection method based on inner-class adjusted cosine similarity (IACS): We first extract the features of each layer and flatten them into one dimension. Then, the extracted features and predicted label information are used to calculate the IACS and further train the linear regression classifier to discriminate the IACS values of adversarial examples from those of normal examples. * **FGSM:** The fast gradient sign method(FGSM) was proposed by [PERSON] et al. [3] and is a single-step attack method. The elements of the imperceptibly small perturbation are equal to the sign of the elements of the gradient of the loss function with respect to the input; therefore, it is a typical \(l_{\infty}\)-norm attack method. The discovery of the FGSM also proved that the direction of the perturbation, rather than the specific point in space, mattered most. * **PGD:** The projected gradient descent (PGD) was proposed by [PERSON] et al. [7] and is a multistep attack method. As in the FGSM [3], it also utilizes the gradient of the loss function with regard to the input to guide the generation of adversarial examples. However, the method introduces random perturbations and replaces one big step with several small steps; therefore, it can generate more accurate adversarial examples but it also requires a higher computation complexity. * **JSMA:** The Jacobian based saliency map attack(JSMA) [22] was proposed by [PERSON] et al. and is a typical \(l_{0}\)-norm method. It aims to change as few pixels as possible by perturbing the most significant pixels to mislead the model. In this process, the approach updates a saliency map to guide the choice of the most significant pixel at each iteration. The saliency map can be calculated by: \[S(X,t)[i]=\left\{ \begin{aligned} & 0,\ if\ \frac{\partial F_{i}(X)}{ \partial X_{i}}>0\ or\ \sum_{j\
eq t}\frac{\partial F_{j}(X)}{\partial X_{i}}<0,\\ &\quad(\frac{\partial F_{i}(X)}{\partial X_{i}})\ |\ \sum_{j\
eq t}\frac{ \partial F_{j}(X)}{\partial X_{i}}\ |\,\ otherwise\end{aligned} \right.\] (1) where \(i\) is a pixel index of the input. * **DeepFool:** This algorithm was proposed by [PERSON] et al. [23] and is a nontarget attack method. It aims to find minimal perturbations. The method views the model as a linear function around the original sample and adopts an iterative procedure to estimate the minimal perturbation from the sample to its nearest decision boundary. By moving vertically to the nearest decision boundary at each iteration, it reaches the other side of the classification boundary. Since the DeepFool algorithm can calculate the minimal perturbations, therefore, it can reliably quantify the robustness of DNNs. * **CW:** This refers to a series of attack methods for the \(L_{0}\), \(L_{2}\), and \(L_{\infty}\) distance metrics proposed by [PERSON] and [PERSON] [24]. In order to generate strong attacks, they introduced confidence to strengthen the attack performance, and to ensure the modification yielded a valid image, they introduced a _change of variables_ to deal with the \"box constraint\" problem. As a typical optimization-based method, the overall optimization function can be defined as follows: \[minimizeD(x,x+\delta)+c*f(x+\delta),\] (2) where \(c\) is the confidence, \(D\) is the distance function, and \(f(\cdot)\) is the cost function. We adopted the \(l_{2}\)-norm attack in the following experiments.