{"id":"https://openalex.org/W3153535239","doi":"https://doi.org/10.48550/arxiv.2104.10076","title":"MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis","display_name":"MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis","publication_year":2021,"publication_date":"2021-04-20","ids":{"openalex":"https://openalex.org/W3153535239","doi":"https://doi.org/10.48550/arxiv.2104.10076","mag":"3153535239"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2104.10076","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2104.10076","pdf_url":"https://arxiv.org/pdf/2104.10076","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2104.10076","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054969834","display_name":"Yijun Yang","orcid":"https://orcid.org/0000-0002-9243-6228","observed_orcids":["https://orcid.org/0000-0002-9243-6228"]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Yang, Yijun","raw_affiliation_strings":["REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","The Chinese University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103277863","display_name":"Ruiyuan Gao","orcid":"https://orcid.org/0000-0002-1979-6075","observed_orcids":["https://orcid.org/0000-0002-1979-6075"]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Gao, Ruiyuan","raw_affiliation_strings":["REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","The Chinese University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Li, Yu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Li, Yu","raw_affiliation_strings":["REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","The Chinese University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059830795","display_name":"Qiuxia Lai","orcid":"https://orcid.org/0000-0001-6872-5540","observed_orcids":["https://orcid.org/0000-0001-6872-5540"]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Lai, Qiuxia","raw_affiliation_strings":["REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","The Chinese University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088556682","display_name":"Qiang Xu","orcid":"https://orcid.org/0000-0001-6747-126X","observed_orcids":["https://orcid.org/0000-0001-6747-126X","https://orcid.org/0009-0001-9784-7528"]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xu, Qiang","raw_affiliation_strings":["REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","The Chinese University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"CUhk REliable Computing Laboratory (CURE) Department of Computer Science and Engirneering","institution_ids":["https://openalex.org/I177725633"]},{"raw_affiliation_string":"The Chinese University of Hong Kong","institution_ids":["https://openalex.org/I177725633"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I177725633"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-example-detection","display_name":"adversarial example detection","score":0.9879999756813049},{"id":"https://openalex.org/keywords/defense-in-depth","display_name":"defense-in-depth","score":0.9480000138282776},{"id":"https://openalex.org/keywords/deep-neural-network-robustness","display_name":"deep neural network robustness","score":0.7250000238418579},{"id":"https://openalex.org/keywords/noise-characteristics","display_name":"noise characteristics","score":0.6510000228881836},{"id":"https://openalex.org/keywords/semantic-consistency","display_name":"semantic consistency","score":0.4269999861717224},{"id":"https://openalex.org/keywords/image-classification","display_name":"image classification","score":0.5809999704360962},{"id":"https://openalex.org/keywords/adversarial-perturbations","display_name":"adversarial perturbations","score":0.5429999828338623}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7729371190071106},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7223160862922668},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.6817683577537537},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.5920807719230652},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.5610926747322083},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5581117868423462},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.510732889175415},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5049930214881897},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4664584696292877},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.46217530965805054},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.436400830745697},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33667898178100586},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3205782175064087},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2104.10076","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2104.10076","pdf_url":"https://arxiv.org/pdf/2104.10076","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2104.10076","doi":"https://doi.org/10.48550/arxiv.2104.10076","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2104.10076","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2104.10076","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2104.10076","pdf_url":"https://arxiv.org/pdf/2104.10076","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":73,"referenced_works":["https://openalex.org/W1673923490","https://openalex.org/W1839408879","https://openalex.org/W1945616565","https://openalex.org/W2004686575","https://openalex.org/W2009130368","https://openalex.org/W2031466562","https://openalex.org/W2067713319","https://openalex.org/W2096733369","https://openalex.org/W2106053110","https://openalex.org/W2117500881","https://openalex.org/W2128864022","https://openalex.org/W2136492908","https://openalex.org/W2174868984","https://openalex.org/W2180612164","https://openalex.org/W2243397390","https://openalex.org/W2460937040","https://openalex.org/W2503523779","https://openalex.org/W2516574342","https://openalex.org/W2590523583","https://openalex.org/W2593892853","https://openalex.org/W2594717275","https://openalex.org/W2594867206","https://openalex.org/W2604147826","https://openalex.org/W2607219512","https://openalex.org/W2618043096","https://openalex.org/W2618492571","https://openalex.org/W2620038827","https://openalex.org/W2765233338","https://openalex.org/W2765384636","https://openalex.org/W2767962654","https://openalex.org/W2781036271","https://openalex.org/W2783692467","https://openalex.org/W2783784437","https://openalex.org/W2787222284","https://openalex.org/W2787496614","https://openalex.org/W2787579267","https://openalex.org/W2788262295","https://openalex.org/W2791953061","https://openalex.org/W2808173987","https://openalex.org/W2810611310","https://openalex.org/W2883108656","https://openalex.org/W2890038638","https://openalex.org/W2902543210","https://openalex.org/W2912070915","https://openalex.org/W2912447214","https://openalex.org/W2913266441","https://openalex.org/W2913848079","https://openalex.org/W2921173985","https://openalex.org/W2944864651","https://openalex.org/W2947133760","https://openalex.org/W2949311987","https://openalex.org/W2949769151","https://openalex.org/W2952388520","https://openalex.org/W2962710014","https://openalex.org/W2962754210","https://openalex.org/W2963207607","https://openalex.org/W2963268689","https://openalex.org/W2963566318","https://openalex.org/W2964153729","https://openalex.org/W2964253222","https://openalex.org/W3006044868","https://openalex.org/W3006935033","https://openalex.org/W3007297946","https://openalex.org/W3024103409","https://openalex.org/W3039230418","https://openalex.org/W3044129898","https://openalex.org/W3081499133","https://openalex.org/W3088733693","https://openalex.org/W3088909400","https://openalex.org/W3105599650","https://openalex.org/W3146670357","https://openalex.org/W4289146964","https://openalex.org/W4293846201"],"related_works":["https://openalex.org/W2950183588","https://openalex.org/W3080754722","https://openalex.org/W4383221314","https://openalex.org/W3093978547","https://openalex.org/W2953536436","https://openalex.org/W3203790781","https://openalex.org/W4379251913","https://openalex.org/W4313346231","https://openalex.org/W2738001131","https://openalex.org/W4285785480"],"abstract_inverted_index":{"Machine":[0],"learning":[1],"with":[2,113,143,193],"deep":[3],"neural":[4],"networks":[5],"(DNNs)":[6],"has":[7,48],"become":[8],"one":[9],"of":[10,43,53,65,149],"the":[11,61,63,83,105,120,125,129,146,204,209],"foundation":[12],"techniques":[13,68,213],"in":[14,60],"many":[15],"safety-critical":[16],"systems,":[17,27],"such":[18,150,168],"as":[19],"autonomous":[20],"vehicles":[21],"and":[22,86,135],"medical":[23],"diagnosis":[24],"systems.":[25],"DNN-based":[26],"however,":[28],"are":[29,39,69,80,175],"known":[30],"to":[31,34,55,118,127,166,177],"be":[32],"vulnerable":[33],"adversarial":[35],"examples":[36],"(AEs)":[37],"that":[38,203],"maliciously":[40],"perturbed":[41],"variants":[42],"legitimate":[44],"inputs.":[45],"While":[46],"there":[47,181],"been":[49],"a":[50,95,162,215],"vast":[51],"body":[52],"research":[54],"defend":[56],"against":[57],"AE":[58,100,139,171,189,195,211],"attacks":[59,179],"literature,":[62],"performances":[64],"existing":[66,210],"defense":[67,84],"still":[70],"far":[71],"from":[72,124,155],"satisfactory,":[73],"especially":[74],"for":[75,99,138,170,188],"adaptive":[76,178],"attacks,":[77],"wherein":[78],"attackers":[79],"knowledgeable":[81],"about":[82],"mechanisms":[85],"craft":[87],"AEs":[88,112,142],"accordingly.":[89],"In":[90],"this":[91],"work,":[92],"we":[93,108,160],"propose":[94,117,161],"multilayer":[96],"defense-in-depth":[97],"framework":[98],"detection,":[101],"namely":[102],"MixDefense.":[103],"For":[104,141],"first":[106],"layer,":[107],"focus":[109],"on":[110,198],"those":[111],"large":[114],"perturbations.":[115],"We":[116],"leverage":[119],"`noise'":[121],"features":[122],"extracted":[123],"inputs":[126,151],"discover":[128],"statistical":[130],"difference":[131],"between":[132],"natural":[133],"images":[134],"tampered":[136],"ones":[137],"detection.":[140,172],"small":[144],"perturbations,":[145],"inference":[147],"result":[148],"would":[152],"largely":[153],"deviate":[154],"their":[156],"semantic":[157],"information.":[158],"Consequently,":[159],"novel":[163],"learning-based":[164],"solution":[165,207],"model":[167],"contradictions":[169],"Both":[173],"layers":[174],"resilient":[176],"because":[180],"do":[182],"not":[183],"exist":[184],"gradient":[185],"propagation":[186],"paths":[187],"generation.":[190],"Experimental":[191],"results":[192],"various":[194],"attack":[196],"methods":[197],"image":[199],"classification":[200],"datasets":[201],"show":[202],"proposed":[205],"MixDefense":[206],"outperforms":[208],"detection":[212],"by":[214],"considerable":[216],"margin.":[217]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2021-04-26T00:00:00"}