On Detecting Adversarial Perturbations
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to augment deep neural networks with a small ``detector** subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. Our method is orthogonal to prior work on addressing adversarial perturbations, which has mostly focused on making the classification network itself more robust. We show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. Moreover, while the detectors have been trained to detect only a specific adversary, they generalize to similar and weaker adversaries. In addition, we propose an adversarial attack that fools both the classifier and the detector and a novel training procedure for the detector that counteracts this attack.
This paper explores an important angle to adversarial examples: the detection of adversarial images and their utilization for trainig more robust networks. This takes the competition between adversaries and models to a new level. The paper presents appealing evidence for the feasibility of robustifying networks by employing the a detector subnetwork that is trained particularly for the purpose of detecting the adversaries in a terget manner rather than just making the networks themselves robust to adversarial examples. The jointly trained primary/detector system is evaluated in various scenarios including the cases when the adversary generator has access to the model and those where they are generated in a generic way. The results of the paper show good improvements with the approach and present well motived thorough analyses to back the main message. The writing is clear and concise.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
On Detecting Adversarial Perturbations
Machine learning and deep learning in particular has advanced tremendously on perceptual tasks in recent years. However, it remains vulnerable against adversarial perturbations of the input that have been crafted specifically to fool the system while being quasi-imperceptible to a human. In this work, we propose to augment deep neural networks with a small ``detector** subnetwork which is trained on the binary classification task of distinguishing genuine data from data containing adversarial perturbations. Our method is orthogonal to prior work on addressing adversarial perturbations, which has mostly focused on making the classification network itself more robust. We show empirically that adversarial perturbations can be detected surprisingly well even though they are quasi-imperceptible to humans. Moreover, while the detectors have been trained to detect only a specific adversary, they generalize to similar and weaker adversaries. In addition, we propose an adversarial attack that fools both the classifier and the detector and a novel training procedure for the detector that counteracts this attack.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper explores an important angle to adversarial examples: the detection of adversarial images and their utilization for trainig more robust networks. This takes the competition between adversaries and models to a new level. The paper presents appealing evidence for the feasibility of robustifying networks by employing the a detector subnetwork that is trained particularly for the purpose of detecting the adversaries in a terget manner rather than just making the networks themselves robust to adversarial examples. The jointly trained primary/detector system is evaluated in various scenarios including the cases when the adversary generator has access to the model and those where they are generated in a generic way. The results of the paper show good improvements with the approach and present well motived thorough analyses to back the main message. The writing is clear and concise.
assistant
This paper explores an important angle to adversarial examples: the detection of adversarial images and their utilization for trainig more robust networks. This takes the competition between adversaries and models to a new level. The paper presents appealing evidence for the feasibility of robustifying networks by employing the a detector subnetwork that is trained particularly for the purpose of detecting the adversaries in a terget manner rather than just making the networks themselves robust to adversarial examples. The jointly trained primary/detector system is evaluated in various scenarios including the cases when the adversary generator has access to the model and those where they are generated in a generic way. The results of the paper show good improvements with the approach and present well motived thorough analyses to back the main message. The writing is clear and concise.