From Pixels to Trajectory: Universal Adversarial Example Detection via Temporal Imprints

TL;DR

This work reveals that adversarial examples imprint discernible temporal trajectories in the sequence of intermediate models during training, captured by a universal loss imprint. It introduces TRAIT, a two-phase framework that converts synthetic losses into spectrum-domain embeddings and uses a Deep-SVDD one-class detector to identify AEs without prior attack knowledge. TRAIT delivers state-of-the-art detection across image, audio, and text modalities and across classification and regression tasks, including robustness under adaptive attacks. The approach is scalable to typical DL models and large language models, with manageable latency overhead and memory requirements, offering a practical, modality- and task-agnostic defense against adversarial threats.

Abstract

For the first time, we unveil discernible temporal (or historical) trajectory imprints resulting from adversarial example (AE) attacks. Standing in contrast to existing studies all focusing on spatial (or static) imprints within the targeted underlying victim models, we present a fresh temporal paradigm for understanding these attacks. Of paramount discovery is that these imprints are encapsulated within a single loss metric, spanning universally across diverse tasks such as classification and regression, and modalities including image, text, and audio. Recognizing the distinct nature of loss between adversarial and clean examples, we exploit this temporal imprint for AE detection by proposing TRAIT (TRaceable Adversarial temporal trajectory ImprinTs). TRAIT operates under minimal assumptions without prior knowledge of attacks, thereby framing the detection challenge as a one-class classification problem. However, detecting AEs is still challenged by significant overlaps between the constructed synthetic losses of adversarial and clean examples due to the absence of ground truth for incoming inputs. TRAIT addresses this challenge by converting the synthetic loss into a spectrum signature, using the technique of Fast Fourier Transform to highlight the discrepancies, drawing inspiration from the temporal nature of the imprints, analogous to time-series signals. Across 12 AE attacks including SMACK (USENIX Sec'2023), TRAIT demonstrates consistent outstanding performance across comprehensively evaluated modalities, tasks, datasets, and model architectures. In all scenarios, TRAIT achieves an AE detection accuracy exceeding 97%, often around 99%, while maintaining a false rejection rate of 1%. TRAIT remains effective under the formulated strong adaptive attacks.

Figures (14)

• Figure 1: Losses of 1,000 clean and (untargeted) AEs on 100 intermediate models (CIFAR10+ResNet18). AE attack method is FGSM with $\epsilon = 8/255$ under $\ell_\infty$-norm. Note the loss here is computed with the ground-truth label.
• Figure 2: Synthetic losses of 1,000 clean and (untargeted) adversarial examples, respectively, on 100 intermediate models. Other settings are the same to \ref{['fig:FGSM_loss']}.
• Figure 3: Synthetic loss of (left) classification task of STL10 with ResNet18, and (right) multivariate time-series regression task, temperature forecasting with LSTM.
• Figure 4: T-SNE visualization of benign and adversarial examples of (left) synthetic loss, (middle) after noise suppression, and (right) after spectrum transformation. Benign examples are with cornflowerblue color and adversarial examples are with salmon color. Quantitative evaluations of the role of noise reduction and spectrum transformation are detailed in \ref{['sec:ablation']}.
• Figure 5: The TRAIT overview. The IM stands for an intermediate model of the underlying/victim model.