Detecting Patch Adversarial Attacks with Image Residuals

Understand

We introduce an adversarial sample detection algorithm based on image residuals, specifically designed to guard against patch-based attacks.

• The image residual is obtained as the difference between an input image and a denoised version of it, and a discriminator is trained to distinguish between clean and adversarial samples.
• More precisely, we use a wavelet domain algorithm for denoising images and demonstrate that the obtained residuals act as a digital fingerprint for adversarial attacks.
• To emulate the limitations of a physical adversary, we evaluate the performance of our approach against localized (patch-based) adversarial attacks, including in settings where the adversary has complete knowledge about the detection scheme.