Average and Strict GAN-Based Reconstruction for Adversarial Example Detection

Generative Adversarial Network (GAN) models have shown promise in detecting adversarial examples for classifiers by leveraging their ability to reconstruct benign and adversarial examples differently. However, existing approaches often struggle with reconstruction optimization convergence for adversarial examples, as GANs cannot perfectly reconstruct such inputs. To address this instability, we propose two novel methods: Average-RAED and Strict-RAED. Average-RAED focuses on the average reconstruction performance throughout the optimization process, with the difference in the classifier’s logit information between the candidate sample and its reconstructed version as the detection signal. This approach enhances robustness and effectiveness, particularly for complex datasets. Strict-RAED integrates classification information into the reconstruction process and imposes a strict constraint to keep the latent code within the initial latent subspace. This design enables Strict-RAED to effectively identify both manually-crafted and natural adversarial examples. We evaluated both methods in a grey-box scenario, where the adversary has full knowledge of the target classifier’s architecture and parameters but no information about the defense GAN. Our results demonstrate that both Average-RAED and Strict-RAED outperform baseline methods in distinguishing adversarial examples from benign samples. Notably, Strict-RAED achieves higher detection rates for both manually-crafted and natural adversarial examples. Furthermore, combining Strict-RAED for detection and Average-RAED for reforming candidate samples significantly improves classifier accuracy against less significant adversarial examples.