Research map / Adversarial robustness and security / Attacks on text and graphs
Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add multi-timestep perturbation expectation (EPS) vs. single-sample norm of score as statistic (ablation) | EPS-based detector · ImageNet FGSM-l2 eps=4/255 | AUROC: EPS-AD 1.0000 vs EPS-N best 0.8191 | Helped |
| replace raw sample features with EPS (score-based statistic) (ablation) | EPS-AD · ImageNet, 6 attacks, eps=4/255 | AUROC: ~0.72 -> 1.00 | Helped |
| add noise perturbations before computing the score (ablation) | EPS-AD · ImageNet PGD, eps=1/255 | AUROC: +3.6 points (0.9274 -> 0.9637) | Helped |
| use the MMD on EPS instead of the norm of score (EPS-N) | EPS-based detection · CIFAR-10 eps=4/255 FGSM-l2 | AUROC: 0.9916 -> 0.9995 | Helped |
| choice of diffusion timestep T* for EPS (ablation) | EPS-AD on CIFAR-10 · FGSM-l2 eps=4/255 | AUROC: 0.5166 at T=1 vs 0.9994 at T=20 | Mixed |
| use the EPS norm (EPS-N) instead of full EPS-MMD on ImageNet at large attacks (ablation) | EPS-N vs EPS-AD · ImageNet FGSM-l2 eps=4/255 | AUROC: 0.8191 vs 1.0000 | Hurt |
| EPS-AD vs diffusion score-norm baseline (Yoon-style, raw score norm) | detection on ImageNet FGSM-l2 · ImageNet eps=4/255 | AUROC: 0.8830 -> 1.0000 | Helped |
Closest papers by meaning
- Detecting Adversarial Data Using Perturbation Forgery (CVPR 2025 · similarity 0.89)
- One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy (ICML 2025 · similarity 0.87)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.85)
- Wide Two-Layer Networks can Learn from Adversarial Perturbations (NeurIPS 2024 · similarity 0.85)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.85)
- Theoretical Understanding of Learning from Adversarial Perturbations (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.