Adversarial examples remain an issue for contemporary neural networks. This paper draws on Background Check (Perello-Nieto et al., 2016), a technique in model calibration, to assist two-class neural networks in detecting adversarial examples, using the one dimensional difference between logit values as the underlying measure. This method interestingly tends to achieve the highest average recall on image sets that are generated with large perturbation vectors, which is unlike the existing literature on adversarial attacks (Cubuk et al., 2017). The proposed method does not need knowledge of the attack parameters or methods at training time, unlike a great deal of the literature that uses deep learning based methods to detect adversarial examples, such as Metzen et al. (2017), imbuing the proposed method with additional flexibility.
This paper addresses adversarial detection through the absolute-value difference between the two logit vector values of a DNN binary classifier, with one class associated with normal data and the other with adversarial data. Assignment of examples to an "adversarial" class is problematic in that adversarial examples are typically generated in regions for which training data is very sparse. To cope with this, the authors propose use of the Background Check calibration techniques recently proposed by Perello-Nieto et al. (ICDM 2016).  
Here, BC is used to estimate probabilities in a sparse "background" class (here, the adversarial class)  through a form of interpolation based on foreground and background densities. The underlying distributional assumption used for estimating foreground densities was that of a gamma function.  Rather than using BC's affine bias for estimating background density from the foreground density, the authors adapt it by raise the weighting for the "adversarial" decision to the fifth power. Unfortunately, no justification for this choice is given, other than to say that this was done with "domain knowledge informing the use of a power value". 
In their experimentation, the authors generate from CIFAR-10 data four kinds of adversarial attacks: noise alone, images with moderate noise, clear images with noticeable noise, and clear images with imperceptible noise. For a variety of attacks, they showed (in Table 2) differences between the average recall for normal examples vs the average recall for normal plus adversarial images. However, without knowing the proportion of adversarial examples used in testing, the significance of the reported differences cannot be judged. They also list the true positive rates of adversarial examples, which showed much variation from experiment to experiment (trending to rather poor performance for attacks with imperceptible noise). Again, the significance of the results cannot be judged without knowing the false negative rate, true negative rate, etc. Moreover, the results are reported without clearly identifying two of the attacks used ("Mom." is presumably Dong et al.'s attack using momentum in gradient descent, and Miyato et al.'s "VAT" is not properly introduced in the related work). Crucially, no evaluation of their method is made with respect to other adversarial detection strategies.
Pros:
* Overall, the calibration approach is well motivated, and likely to be of some benefit.
* The paper is generally readable and understandable. The issues behind calibration and the use of BC are well explained.
Cons:
* The result is a simple and straightforward application of an existing technique - not greatly original.
* Many design choices in the model (particularly the raising of one of the weights to a seemingly-arbitrary power) are mysterious. No indication is given as to other alternatives or how they might perform.
* The experimental results are inadequate to judge the impact of the proposed calibration approach.
* There is no comparison against other detection methods.