Abstract:Adversarial samples deceive machine learning models through small but elaborate modifications that lead to erroneous outputs. The severity of the adversarial sample problem has come to the forefront with the widespread use of machine learning in areas such as security systems, autonomous driving, speech recognition, finance, and medical diagnostics. Malicious attackers can use adversarial samples to circumvent security detection systems, interfere with autonomous driving perception, mislead speech recognition, defraud financial systems, and even cause medical diagnosis errors. The emergence of adversarial samples exposes the vulnerability of existing models and poses challenges for information tracing and forensics after the incident. The main goal of current adversarial sample restoration methods is to improve model robustness. Traditional approaches focus only on improving the model’s classification accuracy, ignoring the importance of adversarial information, which is crucial for understanding the attack mechanism and strengthening future defenses. To address this issue, we propose an adversarial sample restoration method based on the similarity between clean and adversarial sample blocks to balance the needs of adversarial forensics and recognition accuracy. We implement the Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), and Momentum Iterative Attack (MIA) attacks on MNIST, F-MNIST, and EMNIST datasets and perform experimental validation. The results demonstrate that our restoration method significantly enhances the model’s classification accuracy across various datasets and attack scenarios. Comparative analysis shows that the restored samples maintain a high similarity with the original adversarial samples, proving the method’s effectiveness. In addition, we performed performance tests on pre- and post-recovery samples. Taking the MNIST dataset as an example, we observed that the model performance metrics, such as MAPE, MAE, RMSE, and VAPE, of the restored samples improved by 88%, 88%, 65%, and 82%, respectively, after using the FGSM attack. This indicates that our restoration method successfully preserves the information of the generation mechanism of the adversarial samples and improves the model’s performance. This approach balances forensic capability and prediction accuracy, demonstrates a new direction in adversarial sample research, and substantially impacts security defense in practical applications.

Research on Adversarial Sample Detection Method Based on Image Similarity

Attack As Detection: Using Adversarial Attack Methods to Detect Abnormal Examples.

Detecting Adversarial Samples for Deep Learning Models: A Comparative Study

A Fast Adversarial Sample Detection Approach for Industrial Internet-of-Things Applications.

Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction

Sample-analysis Based Adversarial Attack with Saliency Map

Adversarial Detection Based on Inner-Class Adjusted Cosine Similarity

An Adversarial Sample Defense Method Based on Multi-Scale GAN

FCGSM: Fast Conjugate Gradient Sign Method for Adversarial Attack on Image Classification

Adversarial Examples Detection with Enhanced Image Difference Features based on Local Histogram Equalization

Integration of Statistical Detector and Gaussian Noise Injection Detector for Adversarial Example Detection in Deep Neural Networks

New Adversarial Image Detection Based on Sentiment Analysis

ADS-detector: An attention-based dual stream adversarial example detection method

AdvJND: Generating Adversarial Examples with Just Noticeable Difference

ADSAttack: an Adversarial Attack Algorithm Via Searching Adversarial Distribution in Latent Space

GGCAD: A Novel Method of Adversarial Detection by Guided Grad-CAM

A Survey of Defense Methods Against Adversarial Examples

Detecting adversarial samples by noise injection and denoising

A Method for Recovering Adversarial Samples with Both Adversarial Attack Forensics and Recognition Accuracy

Detection by Attack: Detecting Adversarial Samples by Undercover Attack

Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing