A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection

Marine Picot (1, 2) , Federica Granese (3) , Guillaume Staerman (4) , Marco Romanelli (1) , Francisco Messina (5) , Pablo Piantanida (6) , Pierre Colombo (7)

1 L2S - Laboratoire des signaux et systèmes
2 McGill University = Université McGill [Montréal, Canada]
3 COMETE - Concurrency, Mobility and Transactions
4 MIND - Modèles et inférence pour les données de Neuroimagerie
5 UBA - Universidad de Buenos Aires [Buenos Aires]
6 ILLS - International Laboratory on Learning Systems
7 MICS - Mathématiques et Informatique pour la Complexité et les Systèmes

Despite the widespread use of deep learning algorithms, vulnerability to adversarial attacks is still an issue limiting their use in critical applications. Detecting these attacks is thus crucial to build reliable algorithms and has received increasing attention in the last few years. In this paper, we introduce the HalfspAce Mass dePth dEtectoR (HAMPER), a new method to detect adversarial examples by leveraging the concept of data depths, a statistical notion that provides center-outward ordering of points with respect to (w.r.t.) a probability distribution. In particular, the halfspace-mass (HM) depth exhibits attractive properties which makes it a natural candidate for adversarial attack detection in high-dimensional spaces. Additionally, HM is non differentiable making it harder for attackers to directly attack HAMPER via gradient based-methods. We evaluate HAMPER in the context of supervised adversarial attacks detection across four benchmark datasets. Overall, we empirically show that HAMPER consistently outperforms SOTA methods. In particular, the gains are 13.1% (29.0%) in terms of AUROC↑ (resp. FPR ↓95%) on SVHN, 14.6% (25.7%) on CIFAR10 and 22.6% (49.0%) on CIFAR100 compared to the best performing method.

Domaines: Informatique et langage [cs.CL]

Marine Picot, Federica Granese, Guillaume Staerman, Marco Romanelli, Francisco Messina, et al.. A Halfspace-Mass Depth-Based Method for Adversarial Attack Detection. Transactions on Machine Learning Research Journal, 2023. ⟨hal-04575113⟩