 It transforms the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,
<meaning-changed>  It transforms the imperceptible-perturbation attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,
 For strong attacks, it transforms the imperceptible attack on the target network directly into obvious reconstruction-error attack on the feedback autoencoder . Finally the detector gives an anomaly score and determines whether the input is adversarial according to the reconstruction errors . Experiments are conducted on MNIST and CIFAR-10 data-sets . Experimental results show that DAFAR is effective against popular and arguably most advanced attacks without losing performance on legitimate samples,