Research map / Adversarial robustness and security / Certified and empirical robustness
The Odds are Odd: A Statistical Test for Detecting Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use noise-perturbed log-odds to detect adversarial inputs | CIFAR10 classifiers · CIFAR10, L∞-PGD | detection rate: 99.1% (WResNet); 95.0% (CNN7); 93.8% (CNN4) | Helped |
| Use noise-perturbed log-odds to detect adversarial inputs | ImageNet classifiers · ImageNet, L∞-PGD | detection rate: 99.6%; 99.8%; 99.8%; 99.9%; 99.9% | Helped |
| Correct predictions using the logistic classifier on perturbed log-odds | CIFAR10 classifiers · CIFAR10, L∞-PGD | accuracy: 96.0% / 92.7%; 93.6% / 89.5%; 71.0% / 67.6% | Helped |
| Use detection and correction rather than adversarial training | CIFAR10 classifiers · CIFAR10, PGD | accuracy: 92.7% vs 55.2%; 89.5% vs 44.4%; 67.6% vs 40.4% | Helped |
| Apply the trained correction method to an unseen L2-PGD attack | CNN7 · CIFAR10, L2-PGD | accuracy: 4.8% -> 92.9% | Helped |
| Apply the trained correction method to an unseen L2-CW attack | CNN7 · CIFAR10, L2-CW | accuracy: 3.9% -> 77.9% | Helped |
| Use the detector and correction method against a defense-aware attacker | CIFAR10 classifiers · CIFAR10, defense-aware PGD | accuracy: 56.0%; 56.6%; 56.5% | Helped |
| Use the method instead of feature squeezing for L∞-PGD detection | CIFAR10 · CIFAR10, L∞-PGD | detection rate: 55% -> 99% | Helped |
| Use the method instead of feature squeezing for L∞-PGD detection | ImageNet · ImageNet, L∞-PGD | detection rate: 64% -> 99% | Helped |
| Use the method instead of dropout randomization against a defense-aware attack | CIFAR10 ResNet · CIFAR10, defense-aware L2-CW | detection rate: 2% -> 71.4% | Helped |
| Use the tested detector across PGD iteration counts from 10 to 1000 | CIFAR10 models · CIFAR10, L∞-PGD | detection rate | No clear effect |
| Use one best noise source and magnitude with fewer samples instead of the noise mixture (ablation) | Statistical test · CIFAR10 and ImageNet | classification performance | No clear effect |
Closest papers by meaning
- Adversarial Examples Are a Natural Consequence of Test Error in Noise (ICML 2019 · similarity 0.90)
- Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.89)
- Theoretical evidence for adversarial robustness through randomization (NeurIPS 2019 · similarity 0.89)
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (ICML 2018 · similarity 0.89)
- One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy (ICML 2025 · similarity 0.87)
- On the Adversarial Risk of Test Time Adaptation: An Investigation into Realistic Test-Time Data Poisoning (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.