## 6 Conclusions  
In this paper, we proposed an adversarial examples detection method based on the inner-class adjusted cosine similarity. By introducing the predicted label information and leveraging the natural advantages of the cosine distance on high-dimensional data, it greatly improved the detection ability on adversarial examples. Extensive experiments were conducted and showed that our method could achieve a greater performance gain compared with other detection methods. Most importantly, our method could be extended to extract the disentangled features with different models other than the target model (the adversarial attack model) and could also detect adversarial examples from crossing attacks. Therefore, our method had a wider scope of application. Moreover, our method further confirmed that the direction of the adversarial perturbation mattered most. For future research, it would be meaningful to explore more datasets, especially more complicated datasets, such as ImageNet, and other fields such as video outlier detection.  
**Author Contributions:** Conceptualization, D.G.; methodology, D.G.; software, D.G.; validation, D.G. and W.Z.; formal analysis, D.G.; investigation, D.G.; resources, D.G.; data curation, D.G.; writing--original draft preparation, D.G.; writing--review and editing, D.G.; supervision, W.Z.; project administration, W.Z. funding acquisition, W.Z. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research was funded by the National Natural Science Foundation of China (No. U1811462).  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Data are available on request to the authors.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**MNIST**} & \multicolumn{2}{c}{**SVHN**} & \multicolumn{2}{c}{**CIFAR**} \\ \cline{2-7}  & **IACS** & **IED** & **IACS** & **IED** & **IACS** & **IED** \\ \hline
**FGSM** & **1.0000** & **1.0000** & **0.9987** & 0.9920 & 0.9832 & **0.9958** \\
**PGD** & **1.0000** & 0.9541 & **0.9982** & 0.9328 & **0.9898** & 0.9546 \\
**DeepFool** & **1.0000** & 0.9878 & **0.9996** & 0.8690 & **0.9837** & 0.8759 \\
**JSMA** & **1.0000** & 0.9539 & **1.0000** & 0.7954 & **0.9869** & 0.7879 \\
**CW\({}_{2}\)** & **1.0000** & 0.9614 & **1.0000** & 0.8689 & **0.9842** & 0.8125 \\ \hline \hline \end{tabular}
\end{table}
Table 6: A comparison of discrimination power between IACS and IED method on the different datasets and with different attacks. The best results are highlighted in bold.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**MNIST**} & \multicolumn{2}{c}{**SVHN**} & \multicolumn{2}{c}{**CIFAR**} \\ \cline{2-10}  & **IACS** & **LACS** & **ACS** & **IACS** & **LACS** & **ACS** & **IACS** & **LACS** & **ACS** \\ \hline
**FGSM** & **1.0000** & 0.9968 & 0.5938 & **0.9987** & 0.9920 & 0.6683 & **0.9832** & 0.9485 & 0.5838 \\
**PGD** & **1.0000** & 0.8075 & 0.5532 & **0.9982** & 0.9328 & 0.7188 & 0.9898 & **0.9903** & 0.6985 \\
**DeepFool** & **1.0000** & 0.9485 & 0.5864 & **0.9996** & 0.7690 & 0.5730 & **0.9837** & 0.8758 & 0.8652 \\
**JSMA** & **1.0000** & 0.9539 & 0.5165 & **1.0000** & 0.8854 & 0.6695 & **0.9869** & 0.6764 & 0.5385 \\
**CW\({}_{2}\)** & **1.0000** & 0.9787 & 0.5910 & **1.0000** & 0.8689 & 0.5816 & **0.9842** & 0.9161 & 0.5680 \\ \hline \hline \end{tabular}
\end{table}
Table 5: A comparison of discrimination power (AUC score of a logistic regression classifier) among IACS, LACS, and ACS methods on the different datasets and with different attacks. The best results are highlighted in bold.