Deep learning models are known to be vulnerable to adversarial examples that
are elaborately designed for malicious purposes and are imperceptible to the
human perceptual system. Autoencoder, when trained solely over benign examples,
has been widely used for (self-supervised) adversarial detection based on the
assumption that adversarial examples yield larger reconstruction errors.
However, because lacking adversarial examples in its training and the too
strong generalization ability of autoencoder, this assumption does not always
hold true in practice. To alleviate this problem, we explore how to detect
adversarial examples with disentangled label/semantic features under the
autoencoder structure. Specifically, we propose Disentangled
Representation-based Reconstruction (DRR). In DRR, we train an autoencoder over
both correctly paired label/semantic features and incorrectly paired
label/semantic features to reconstruct benign and counterexamples. This mimics
the behavior of adversarial examples and can reduce the unnecessary
generalization ability of autoencoder. We compare our method with the
state-of-the-art self-supervised detection methods under different adversarial
attacks and different victim models, and it exhibits better performance in
various metrics (area under the ROC curve, true positive rate, and true
negative rate) for most attack settings. Though DRR is initially designed for
visual tasks only, we demonstrate that it can be easily extended for natural
language tasks as well. Notably, different from other autoencoder-based
detectors, our method can provide resistance to the adaptive adversary.

该论文提出了一种名为 DRR 的新方法，它使用自编码器结构进行对抗性样本检测，并采用解缠表示来减少不必要的自编码器泛化能力，能够在视觉任务和自然语言任务中提供抗适应性对抗性攻击，并在各种度量标准下表现出更好的性能。