Deep neural networks (DNNs) play a key role in many applications. Unsurprisingly, they also became a potential attack target of adversaries. Some studies have demonstrated DNN classifiers can be fooled by the adversarial example, which is crafted via introducing some perturbations into an original sample. Accordingly, some powerful defense techniques were proposed against adversarial examples. However, existing defense techniques require modifying the target model or depend on the prior knowledge of attack techniques to different degrees. In this paper, we propose a straightforward method for detecting adversarial image examples. It doesn't require any prior knowledge of attack techniques and can be directly deployed into unmodified off-the-shelf DNN models. Specifically, we consider the perturbation to images as a kind of noise and introduce two classical image processing techniques, scalar quantization and smoothing spatial filter, to reduce its effect. The image two-dimensional entropy is employed as a metric to implement an adaptive noise reduction for different kinds of images. As a result, the adversarial example can be effectively detected by comparing the classification results of a given sample and its denoised version. Thousands of adversarial examples against some state-of-the-art DNN models are used to evaluate the proposed method, which are crafted with different attack techniques. The experiment shows that our detection method can achieve an overall recall of 93.73% and an overall precision of 95.45% without referring to any prior knowledge of attack techniques.

该文章提出了一种直接部署到标准深度神经网络模型中的简单方法，通过引入两个经典图像处理技术，标量量化和平滑空间滤波，将图像中的扰动降低到最小，使用图像熵作为度量标准，可以有效地检测出对基于多种攻击技术的先进深度学习模型的20,000多个对抗样本，最终的实验结果表明，该检测方法可以取得96.39％的高整体F1评分。

使用自适应噪声降低在深度网络中检测对抗样本