Keyless entry systems in cars are adopting neural networks for localizing its
operators. Using test-time adversarial defences equip such systems with the
ability to defend against adversarial attacks without prior training on
adversarial samples. We propose a test-time adversarial example detector which
detects the input adversarial example through quantifying the localized
intermediate responses of a pre-trained neural network and confidence scores of
an auxiliary softmax layer. Furthermore, in order to make the network robust,
we extenuate the non-relevant features by non-iterative input sample clipping.
Using our approach, mean performance over 15 levels of adversarial
perturbations is increased by 55.33% for the fast gradient sign method (FGSM)
and 6.3% for both the basic iterative method (BIM) and the projected gradient
method (PGD).

本论文提出了一种通过量化预训练神经网络的局部中间响应和辅助 softmax 层的置信度得出输入的对抗样本的测试时间对抗样本例探测器，并通过非迭代输入样本剪辑来减弱非相关特征，从而提高了 15 种对抗扰动水平下的平均性能，其中快速梯度符号法（FGSM）提高了 55.33％，而基本迭代法（BIM）和投影梯度法（PGD）分别提高了 6.3％。