Adversarial Detection

Detection mechanisms exploit the fundamental statistical differences between natural signals and adversarial perturbations. Legitimate IQ samples follow the expected distribution of channel noise and hardware imperfections, while adversarial examples introduce subtle, structured anomalies. Detectors analyze layer-wise activation patterns, kernel density estimates, or Mahalanobis distances in feature space. A sample is flagged if its internal representation deviates significantly from the manifold of clean training data, often using a threshold calibrated on a held-out validation set.

A common detection strategy involves applying a destructive transformation to the input before classification. Techniques include:

• Feature squeezing: Reducing color depth or applying median filtering to collapse perturbation space.
• Randomized resizing and padding: Introducing stochasticity to break the precise structure of adversarial noise.
• JPEG compression: Discarding high-frequency components where perturbations often reside. If the model's prediction changes significantly between the raw and transformed input, the sample is deemed adversarial. This method assumes natural signals are robust to minor transformations while adversarial ones are brittle.

Instead of modifying the primary classifier, a separate binary classifier is trained specifically to distinguish clean from adversarial inputs. This detector can be a lightweight neural network or a classical model like a Support Vector Machine (SVM) operating on features extracted from intermediate layers of the main model. The detector is trained on a dataset containing both legitimate samples and examples generated by known attack algorithms such as FGSM or PGD. Its independence from the primary classifier allows for modular updates as new attack vectors emerge.

Bayesian neural networks and Monte Carlo Dropout enable detection by measuring a model's epistemic uncertainty. When processing an adversarial example, the model often exhibits high variance in its predictions across multiple stochastic forward passes. By setting a threshold on metrics like mutual information or predictive entropy, the system can reject inputs for which the model is not confident. This approach frames detection as an out-of-distribution (OOD) problem, where adversarial samples lie far from the training distribution in the model's learned probability space.

Adversarial detection is an ongoing arms race. Sophisticated adaptive attackers can craft perturbations designed to evade known detectors by optimizing for both misclassification and detector stealth. Backward pass differentiable approximation (BPDA) attacks bypass gradient-obfuscated detectors. Furthermore, detectors themselves can be vulnerable to secondary adversarial examples. A robust defense requires a layered security strategy, combining multiple orthogonal detection methods with certified robustness techniques to avoid single points of failure.

A carefully crafted noise pattern added to an input signal to induce misclassification. These perturbations are often imperceptible to human observers but catastrophic for neural networks.

• Lp-norm constraints bound the perturbation magnitude
• White-box perturbations exploit full gradient knowledge
• Physical perturbations survive real-world transformations like printing and recapture
• Example: Adding a human-imperceptible waveform to a QPSK signal causes a classifier to label it as 16-QAM

An inference-time attack where an adversary modifies a malicious sample to bypass a trained classifier without altering the model itself. Unlike poisoning, evasion leaves the training pipeline untouched.

• Gradient-based evasion uses model gradients to craft adversarial examples
• Decision-based evasion relies only on hard-label outputs
• Score-based evasion exploits confidence scores for optimization
• Evasion attacks are the primary threat that adversarial detection systems must intercept

The task of identifying test samples drawn from a fundamentally different distribution than the training data. OOD detection is closely related to adversarial detection but addresses a broader class of anomalous inputs.

• Softmax thresholding rejects low-confidence predictions
• Energy-based models assign higher scores to in-distribution samples
• Mahalanobis distance measures feature-space deviation from class centroids
• OOD detectors often serve as the first line of defense before specialized adversarial detectors

A proactive defensive technique that injects adversarial examples into the training dataset to improve model robustness. While adversarial detection is a reactive filter, adversarial training hardens the classifier itself.

• PGD-based training uses multi-step attacks during each training iteration
• TRADES balances clean accuracy with adversarial robustness via a regularization term
• Ensemble adversarial training augments data with attacks from multiple surrogate models
• Often combined with detection systems for defense-in-depth architectures

A formal guarantee that a classifier's prediction will not change for any input within a mathematically verified perturbation bound. Unlike empirical detection methods, certified robustness provides provable security.

• Interval bound propagation computes guaranteed output ranges for all inputs in an epsilon-ball
• Semidefinite relaxation provides tighter certification bounds for ReLU networks
• Randomized smoothing constructs certifiably robust classifiers via noise injection
• Certification complements detection by providing worst-case guarantees rather than probabilistic filtering

A formal characterization of an adversary's goals, knowledge, and capabilities that defines the specific security guarantees a defense must provide. Every adversarial detection system is designed against a specific threat model.

• White-box access assumes full knowledge of model architecture and parameters
• Black-box access restricts the adversary to query-based interactions only
• Lp-norm budgets define the maximum allowable perturbation magnitude
• Adaptive adversaries are aware of the detection mechanism and actively try to evade it
• A detector validated against a weak threat model provides a false sense of security