# LiBRe: A Practical Bayesian Approach to Adversarial Detection

Source: [LiBRe: A Practical Bayesian Approach to Adversarial Detection](<https://www.sota2.com/research/paper/68fa6a0a1e209131cea25a8e>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-27T06:07:38.446Z

Authors: Zhijie Deng, Xiao Yang, Shizhen Xu, Hang Su, Jun Zhu

Published: 2021-03-27T07:48:58.000Z

## Abstract

Despite their appealing flexibility, deep neural networks (DNNs) are vulnerable against adversarial examples. Various adversarial defense strategies have been proposed to resolve this problem, but they typically demonstrate restricted practicability owing to unsurmountable compromise on universality, effectiveness, or efficiency. In this work, we propose a more practical approach, Lightweight Bayesian Refinement (LiBRe), in the spirit of leveraging Bayesian neural networks (BNNs) for adversarial detection. Empowered by the task and attack agnostic modeling under Bayes principle, LiBRe can endow a variety of pre-trained task-dependent DNNs with the ability of defending heterogeneous adversarial attacks at a low cost. We develop and integrate advanced learning techniques to make LiBRe appropriate for adversarial detection. Concretely, we build the few-layer deep ensemble variational and adopt the pre-training & fine-tuning workflow to boost the effectiveness and efficiency of LiBRe. We further provide a novel insight to realise adversarial detection-oriented uncertainty quantification without inefficiently crafting adversarial examples during training. Extensive empirical studies covering a wide range of scenarios verify the practicability of LiBRe. We also conduct thorough ablation studies to evidence the superiority of our modeling and learning strategies.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Adversarial Attack Detection on Face dataset Adv-Mask attack](<https://www.sota2.com/research/sota/adversarial-attack-detection-on-face-dataset-adv-mask-attack.md>): Adversarial Attack Detection; Face dataset Adv-Mask attack; AUROC: 99.93.

- [Adversarial Attack Detection on Face dataset Adv-Sticker attack](<https://www.sota2.com/research/sota/adversarial-attack-detection-on-face-dataset-adv-sticker-attack.md>): Adversarial Attack Detection; Face dataset Adv-Sticker attack; AUROC: 0.9739.

- [Adversarial Attack Detection on Face dataset Adv-Glasses attack](<https://www.sota2.com/research/sota/adversarial-attack-detection-on-face-dataset-adv-glasses-attack.md>): Adversarial Attack Detection; Face dataset Adv-Glasses attack; AUROC: 81.4.

- [Adversarial Attack Detection on Face dataset TIPIM attack](<https://www.sota2.com/research/sota/adversarial-attack-detection-on-face-dataset-tipim-attack.md>): Adversarial Attack Detection; Face dataset TIPIM attack; AUROC: 0.5345.

- [Adversarial Attack Detection on ImageNet100](<https://www.sota2.com/research/sota/adversarial-attack-detection-on-imagenet100.md>): Adversarial Attack Detection; ImageNet100; Robustness (BIM): 92.59.

- [Adversarial Detection on ImageNet MIFGSM attack (test)](<https://www.sota2.com/research/sota/adversarial-detection-on-imagenet-mifgsm-attack-test.md>): Adversarial Detection; ImageNet MIFGSM attack (test); AUROC: 87.25.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2103.14835>)

[PDF](<https://arxiv.org/pdf/2103.14835.pdf>)