Paper:
Robust Detection of Adversarial Attacks by Modeling the Intrinsic Properties of Deep Neural Networks
It has been shown that deep neural network (DNN) based classifiers are vulnerable to human-imperceptive adversarial perturbations which can cause DNN classifiers to output wrong predictions with high confidence. We propose an unsupervised learning approach to detect adversarial inputs without any knowledge of attackers. Our approach tries to capture the intrinsic properties of a DNN classifier and uses them to detect adversarial inputs. The intrinsic properties used in this study are the output distributions of the hidden neurons in a DNN classifier presented with natural images. Our approach can be easily applied to any DNN classifiers or combined with other defense strategies to improve robustness. Experimental results show that our approach demonstrates state-of-the-art robustness in defending black-box and gray-box attacks.

Review:
The paper presents an unsupervised learning approach to the problem of adversarial attack detection in the context of deep neural networks.  The authors  model the intrinsic properties of the networks to detect adversarial inputs.  To do so, they employ a Gaussian Mixture Model (GMM) to approximate the hidden state distribution, in practice the state of the fully connected hidden layers, and detect adversarial samples by simply checking that their likelihood is lower than a given threshold. Exhaustive experimental results in different show that the proposed method achieves state-of-the-art performance compared to unsupervised methods while generalizing better than supervised approaches.   The paper reads well and is technically sound. The method is very simple but seems to work well. The experiments are rather convincing. I don’t have any major concern but I think that it would be interesting to see how the methods work with more complex networks (e.g. with more than 10 classes) and with other models than GMMs.  I have a couple of comments/questions: - For the sake of repeatability, it would be good to have more details about the EM procedure (number of iterations?) - In section 3/table 6, it is indicated that the likelihood threshold is set to keep 95 and 99% of training data. How is the threshold selected for the other experiments (section 4.1)?  minor comments: - Figure 2: “The OC curves”- “The ROC curves” - Figure 3 is not mentioned in the text - Line 154: “even the perturbations”-> “even if the perturbations” - Line 166” “outperform”->”outperforms” - Line 173: “same on the training”->”on the same training”