## 3 Method
### Adversarial Detection Based on Inner-Class Cosine Similarity
#### 3.2.2 Detector Training  
In the training phase, we first collect the flattened features of each classifier layer. The flattening operation of sample \(x\) can be formulated as follows:  
\[L_{k}(x)=\textit{flatten}(f_{k}(x)), \tag{8}\]  
where the \(\textit{flatten}(\cdot)\) denotes the flattening operation, which flattens the multidimensional data into one dimension.  
Then, we calculate the adjusted cosine similarity of the mixture data \(x_{i}\in D_{mix}\) with \(x_{j}\in D_{bsd}\), which can be formulated as follows:  
\[ACS(L_{k}(x_{i}),L_{k}(x_{j}))= \frac{(L_{k}(x_{i})-L_{k}(\tilde{x}_{i}))\cdot(L_{k}(x_{j})-L_{k }(\tilde{x}_{j}))}{\|(L_{k}(x_{i})-L_{k}(\tilde{x}_{i}))\|\|(L_{k}(x_{j})-L_{k }(x_{j}))\|}, \tag{9}\]  
where \(L_{k}(x_{i})\) denotes the average of the \(l\)th layer output features of the mixture examples, and \(L_{k}(\tilde{x}_{j})\) denotes the average of the \(l\)th layer output features of the baseline examples (normal examples). This means we calculate the ACS values between the mixture data and normal data.  
In order to better fit the anomaly detection task, we propose the inner-class adjusted cosine similarity (IACS) metric to detect adversarial examples. Given some label information predicted by classifier \(f(\cdot)\), the adjusted cosine similarity (ACS) with the same predicted label as the \(x\)'s label is selected to calculate the mean value, which is used as the IACS value of the sample \(x\) at the \(k_{th}\) layer, as shown in Equation (10).  
\[IACS_{k}(x)=\frac{1}{|C_{k}(x)|}\sum_{L_{k}(x_{j})\in C_{k}(x)}ACS(L_{k}(x),L_ {k}(x_{j})), \tag{10}\]  
where \(C_{k}(x)\) denotes the set of the \(k_{th}\) layer output features of normal samples with the same label as sample \(x\).  
We next describe how the inner-class adjusted cosine similarity (IACS) estimates can serve as features to train a detector to discriminate adversarial examples from normal examples. Just as Algorithm 1 shows, the IACS values associated with each mixture sample are estimated with the baseline samples by Equations (9) and (10). Then, we use the IACS values (one value for one layer) to train a linear regression classifier, in which the IACS values from adversarial examples are labeled as 1 and the IACS values from normal examples are labeled as 0 in the experiment.  
```
0:\(f(\cdot)\): A target classifier trained well by normal examples. \(D_{mix}\): Mixture dataset \(D_{mix}\), \(x_{i}\in D_{mix}\). \(D_{bsd}\): Baseline dataset \(D_{bsd}\), \(x_{j}\in D_{bsd}\).
0: Linear regression classifier LR.
1: Extract the output of \(f(\cdot)\)'s layer: \(\{f_{k}(x)\}_{1}^{n}\).
2: Flatten the output and get:\(\{L_{k}(x)\}_{1}^{n}\).
3:fork=1:n (number of layer) do
4: Calculate the mean value of \(L_{k}(x_{i})\) and \(L_{k}(x_{j})\) in a minibatch, \(x_{i}\in M\), \(x_{j}\in N\).
5: Calculate the adjusted cosine similarity by Equation (9) and get \(ACS(L_{k}(x_{i}),L_{k}(x_{j}))\).
6: Calculate the IACS by Equation (10) and get \(IACS_{k}(x_{i})\).
7:endfor
8: Set the feature \(IACS(x_{i})\) as \(1\) if \(x_{i}\) is from adversarial example else 0; \(IACS(x_{i})=[IACS_{1},IACS_{2},...,IACS_{n}]^{T}\)
9: Train a linear regression classifier LR on \((IACS_{pos},IACS_{neg})\).
```  
**Algorithm 1** Adversarial detection algorithm based on IACS.  
In addition, note that there is no need to choose a very big baseline dataset (normal examples) to calculate the IACS values, provided that the baseline data is chosen relatively randomly and there are enough samples in the same category to fully maintain its inner-class characteristics. This can significantly reduce the computation load. In the experiment, we found that the detecting performance could be efficiently ensured even for a size of baseline data as small as 100, that is, 10 normal samples per class.