Research map / Adversarial robustness and security / Attacks on text and graphs
Be Your Own Neighborhood: Detecting Adversarial Examples by the Neighborhood Relations Built on Self-Supervised Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BEYOND, an adversarial example detector that flags inputs whose SSL-based label predictions and representations are inconsistent with those of 50 augmented neighbors, without any adversarial examples for training.
Problem
Detecting adversarial examples in image classifiers reliably, including under adaptive attacks, without relying on reference adversarial examples for training.
Approach
Use an off-the-shelf SSL model (SimSiam) to compare an input with its 50 augmented neighbors on two signals, label consistency and representation cosine similarity; adversarial inputs show abnormal relations with neighbors, and attacking both signals simultaneously creates conflicting gradients.
Key results
- On CIFAR-10 under gray-box attacks (L-inf 8/255), BEYOND achieves TPR@FPR5% of 86.16% (FGSM), 82.80% (PGD), 91.48% (C&W), and 93.42% (AutoAttack).
- Combined with adversarially trained classifiers on CIFAR-10 under AutoAttack, ATC+BEYOND raises robust accuracy from 66.20% to 84.40% (R2021Fixing70).
- Under Orthogonal-PGD adaptive attack at L-inf=8/255, BEYOND retains 13.8% RA@FPR5% alone, and ATC+BEYOND reaches 94.5%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BEYOND instead of the strongest listed baseline | CIFAR-10 AE detection · CIFAR-10, unseen PGD | AUC: 63.14% -> 99.29% | Helped |
| Use BEYOND instead of the strongest listed baseline | CIFAR-10 AE detection · CIFAR-10, seen FGSM | AUC: 99.88% -> 98.89% | Hurt |
| Add BEYOND to adversarially trained classifier | R2021Fixing70 · CIFAR-10, AutoAttack | robust accuracy: 66.20% -> 84.40% | Helped |
| Add ATC to BEYOND | BEYOND · CIFAR-10, Orthogonal-PGD, L∞=8/255 | RA@FPR5%: 13.80% -> 94.50% | Helped |
| Combine label consistency and representation similarity rather than use an individual mechanism (ablation) | BEYOND · CIFAR-10 and CIFAR-100, varied perturbation budgets | AUC | Helped |
| Use label consistency alone instead of the combined detector (ablation) | BEYOND · CIFAR-10 and CIFAR-100, varied perturbation budgets | AUC | Hurt |
| Use representation similarity alone instead of the combined detector (ablation) | BEYOND · CIFAR-10 and CIFAR-100, varied perturbation budgets | AUC | Hurt |
| Increase the number of neighbors beyond 50 (ablation) | BEYOND · CIFAR-10, PGD | detection performance | No clear effect |
| Set adaptive-attack trade-off α to 1 rather than 0 (ablation) | Adaptive attack against BEYOND · CIFAR-10 | AUC: 82.03% -> 63.91% | Hurt |
| Set adaptive-attack trade-off α to 1 rather than 0 (ablation) | Adaptive attack against BEYOND · CIFAR-100 | AUC: 90.58% -> 88.49% | Hurt |
Surprising findings
- Adaptive attack AUC on CIFAR-10 is lowest when alpha=0 for only one term? Instead, AUC is 82.03% at alpha=0 and drops to 63.91% at alpha=1, showing the combined objective is strongest at alpha=1.
Limitations
- Detection fails under large adaptive perturbations (RA@FPR5% only 13.8% at L-inf 8/255 without ATC).
- Gradient conflict rates drop with large perturbations, so the adaptive-attack resistance weakens as budgets grow.
- Higher parameter count and FLOPs than LNG due to the SSL backbone and three-layer projection head.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: CIFAR-10 CIFAR-100 ImageNet
Metrics: TPR@FPR AUC ROC curve robust accuracy
Baselines: kNN DkNN LID LNG Hu et al. Trapdoor DLA'20 SID'21 SPAM'19
Builds on: SimSiam DkNN LNG RobustBench
Closest papers by meaning
- Decision Boundary Analysis of Adversarial Examples (ICLR 2018 · similarity 0.87)
- On Adversarial Training without Perturbing all Examples (ICLR 2024 · similarity 0.87)
- Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.85)
- Self-Supervised Adversarial Training via Diverse Augmented Queries and Self-Supervised Double Perturbation (NeurIPS 2024 · similarity 0.85)
- 3SAT: A Simple Self-Supervised Adversarial Training Framework (AAAI 2025 · similarity 0.85)
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.