Prediction Inconsistency Helps Achieve Generalizable Detection of Adversarial Examples Article Swipe

MAKE IMPACT

Sicong Han , Chenhao Lin , Zhengyu Zhao , Xiyuan Wang , Xinlei He , Qian Li , Cong Wang , Qian Wang , Chao Shen · YOU? · · 2025 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2506.03765

Adversarial detection protects models from adversarial attacks by refusing suspicious test samples. However, current detection methods often suffer from weak generalization: their effectiveness tends to degrade significantly when applied to adversarially trained models rather than naturally trained ones, and they generally struggle to achieve consistent effectiveness across both white-box and black-box attack settings. In this work, we observe that an auxiliary model, differing from the primary model in training strategy or model architecture, tends to assign low confidence to the primary model's predictions on adversarial examples (AEs), while preserving high confidence on normal examples (NEs). Based on this discovery, we propose Prediction Inconsistency Detector (PID), a lightweight and generalizable detection framework to distinguish AEs from NEs by capturing the prediction inconsistency between the primal and auxiliary models. PID is compatible with both naturally and adversarially trained primal models and outperforms four detection methods across 3 white-box, 3 black-box, and 1 mixed adversarial attacks. Specifically, PID achieves average AUC scores of 99.29\% and 99.30\% on CIFAR-10 when the primal model is naturally and adversarially trained, respectively, and 98.31% and 96.81% on ImageNet under the same conditions, outperforming existing SOTAs by 4.70%$\sim$25.46%.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2506.03765

PDF

https://arxiv.org/pdf/2506.03765

OA Status

green

OpenAlex ID

https://openalex.org/W4416073812

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4416073812

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2506.03765

Digital Object Identifier

Title

Prediction Inconsistency Helps Achieve Generalizable Detection of Adversarial Examples

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2025

Year of publication

Publication date

2025-06-04

Full publication date if available

Authors

Sicong Han, Chenhao Lin, Zhengyu Zhao, Xiyuan Wang, Xinlei He, Qian Li, Cong Wang, Qian Wang, Chao Shen

List of authors in order

Landing page

https://arxiv.org/abs/2506.03765

Publisher landing page

PDF URL

https://arxiv.org/pdf/2506.03765

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2506.03765

Direct OA link when available

Cited by

0

Total citation count in OpenAlex

Full payload