KoALA: KL-L0 Adversarial Detector via Label Agreement

TL;DR

KoALA tackles adversarial robustness by introducing a semantics-free detector that relies on the disagreement between a KL-divergence-based predictor and an L0-based predictor on class prototypes. Under norm-bounded perturbations and mild prototype-separation assumptions, the two stability bands are mutually exclusive, guaranteeing detection when a disagreement occurs. The detector is lightweight, requiring only a brief fine-tuning of the backbone to align embeddings with both metrics, and it does not rely on adversarial training or architectural changes. Empirical results on ResNet-CIFAR-10 and CLIP/Tiny-ImageNet corroborate the theory, showing strong detection performance and varying robustness across metric combinations. Overall, KoALA provides a practical, plug-in defense that complements training-time robustness and certification methods with provable detection guarantees.

Abstract

Deep neural networks are highly susceptible to adversarial attacks, which pose significant risks to security- and safety-critical applications. We present KoALA (KL-L0 Adversarial detection via Label Agreement), a novel, semantics-free adversarial detector that requires no architectural changes or adversarial retraining. KoALA operates on a simple principle: it detects an adversarial attack when class predictions from two complementary similarity metrics disagree. These metrics-KL divergence and an L0-based similarity-are specifically chosen to detect different types of perturbations. The KL divergence metric is sensitive to dense, low-amplitude shifts, while the L0-based similarity is designed for sparse, high-impact changes. We provide a formal proof of correctness for our approach. The only training required is a simple fine-tuning step on a pre-trained image encoder using clean images to ensure the embeddings align well with both metrics. This makes KOALA a lightweight, plug-and-play solution for existing models and various data modalities. Our extensive experiments on ResNet/CIFAR-10 and CLIP/Tiny-ImageNet confirm our theoretical claims. When the theorem's conditions are met, KoALA consistently and effectively detects adversarial examples. On the full test sets, KoALA achieves a precision of 0.94 and a recall of 0.81 on ResNet/CIFAR-10, and a precision of 0.66 and a recall of 0.85 on CLIP/Tiny-ImageNet.

Figures (2)

• Figure 1: Motivation for combining KL and $L_0$ as an attack detector. With an energy bound adversarial input, $\|\bm{\delta}\|_2 \le \epsilon$, the resulting perturbation may be dense (distributed) or sparse (concentrated). Each metric defines a prediction-stability band: inside the band the label remains $y^*$; outside it flips to $\hat{y}$. Dense attacks typically violate the $L_0$ band (green), while sparse attacks violate the KL band (orange). When two classification decisions disagree, we can detect adversarial attacks.
• Figure 2: Training phase: Class centroids $\bm{C}$ are computed as the centroid of image embeddings within each class. Each image embedding $\bm{p}$ is compared with $\bm{C}$ to compute the $Loss_{KL}$ and $Loss_{L_0}$. The model is trained to make the L0 and KL distances small for the correct class while large for incorrect classes. Inference phase: An input image embedding $p$ is compared with class centroids $\bm{C}$ to calculate $KL$ and $L0$-based predictions $\hat{y}_{KL}$ and $\hat{y}_{L_0}$. The predicted class is accepted only if both metrics agree; otherwise, the system flags the input as an adversarial attack detected ($\widehat{a}=1$).

Theorems & Definitions (10)

• Theorem 1
• Proposition 2: Necessary condition for successful attack on KL detector
• proof
• Proposition 3: Necessary condition for successful attack on $L_0$ detector
• proof
• Proposition 4: Necessary conditions of successful attacks on KL and $L_0$ detectors are mutually exclusive
• proof
• Claim B.1
• Claim B.2
• proof : Proof of \ref{['thm:mutual-exclusion']}