# On Detecting Adversarial Perturbations

Source: [On Detecting Adversarial Perturbations](<https://www.sota2.com/research/paper/68fa63211e209131ce9fd1ef>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-25T20:34:16.778Z

Authors: Jan Hendrik Metzen, Tim Genewein, Volker Fischer, Bastian Bischoff

Published: 2017-02-14T15:44:26.000Z

## Abstract

Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to augment deep neural networks with a small "detector" subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. Our method is orthogonal to prior work on addressing adversarial perturbations, which has mostly focused on making the classification network itself more robust. We show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. Moreover, while the detectors have been trained to detect only a specific adversary, they generalize to similar and weaker adversaries. In addition, we propose an adversarial attack that fools both the classifier and the detector and a novel training procedure for the detector that counteracts this attack.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Adversarial Robustness on CIFAR-10 (L-inf, eps=4/255)](<https://www.sota2.com/research/sota/adversarial-robustness-on-cifar-10-l-inf-eps-4-255.md>): Adversarial Robustness; CIFAR-10 L-infinity, epsilon=4/255; Robust Accuracy (AA): 6.17.

- [Deepfake Detection on Face Replacement](<https://www.sota2.com/research/sota/deepfake-detection-on-face-replacement.md>): Deepfake Detection; Face Replacement; Precision: 52.

- [Deepfake Detection on Face Editing](<https://www.sota2.com/research/sota/deepfake-detection-on-face-editing.md>): Deepfake Detection; Face Editing; Precision: 50.

- [Deepfake Detection on Facial Reenactment](<https://www.sota2.com/research/sota/deepfake-detection-on-facial-reenactment.md>): Deepfake Detection; Facial Reenactment; Precision: 48.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/1702.04267>)

[PDF](<https://arxiv.org/pdf/1702.04267.pdf>)