Robust Adversarial Example Detection Algorithm Based on High-Level Feature Differences

. 2025 Mar 12;25(6):1770. doi: 10.3390/s25061770

Algorithm 1: Training the similarity measurement model.

Input

: X_{t r a i n}

, selection operation

S (\cdot)

, training epoch T, target model f

Output: the parameters of model D
1: for t = 0 to T-1 do
2:

feed x \in X_{t r a i n}

into the target model f

and obtain the label y = f (x)

select a counterpart image for x

, x^{'} = S (y),

where x^{'} \in X_{t r a i n}

generate an adversarial example x_{a d v}

by attacking x

feed x_{a d v}

into f

and obtain y_{a d v} = f (x_{a d v})

select a counterpart image for x_{a d v}

, x_{a d v}^{'} = S (y_{a d v})

, where x_{a d v}^{'} \in X_{t r a i n}

feed x, x_{a d v}, x^{'}, x_{a d v}^{'}

into the Encoder E:

F_{x} = E (x), F_{x_{a d v}} = E (x_{a d v}), F_{x^{'}} = E (x^{'}), F_{{x'}_{a d v}} = E ({x'}_{a d v})

8: construct feature pairs:

F_{s i m} = c o n c a t (F_{x}, F_{x^{'}})

, labeled as 0;

F_{d i f} = c o n c a t (F_{x_{a d v}}, F_{x_{a d v}^{'}})

, labeled as 1
9:

feed F_{s i m}

and F_{d i f}

to model D
10: optimize model D using cross-entropy loss
11: end for