---
abstract: |
    Machine Learning (ML) models are applied in a variety of tasks such as network intrusion detection or malware classification. Yet, these models are vulnerable to a class of malicious inputs known as adversarial examples. These are slightly perturbed inputs that are classified incorrectly by the ML model. The mitigation of these adversarial inputs remains an open problem.

    As a step towards understanding adversarial examples, we show that they are not drawn from the same distribution than the original data, and can thus be detected using statistical tests. Using this knowledge, we introduce a complimentary approach to identify specific inputs that are adversarial. Specifically, we augment our ML model with an additional output, in which the model is trained to classify all adversarial inputs.

    We evaluate our approach[^1] on multiple adversarial example crafting methods (including the fast gradient sign and saliency map methods) with several datasets. The statistical test flags sample sets containing adversarial inputs confidently at sample sizes between $10$ and $100$ data points. Furthermore, our augmented model either detects adversarial examples as outliers with high accuracy ($>80$%) or increases the adversary’s cost—the perturbation added—by more than $150$%. In this way, we show that statistical properties of adversarial examples are essential to their detection.[^2]
author:
- |
    Kathrin Grosse$^\dagger$, Praveen Manoharan$^\dagger$, Nicolas Papernot$^\ddagger$, Michael Backes$^{\dagger\ast}$, Patrick McDaniel$^\ddagger$\
    CISPA, Saarland Informatics Campus$^\dagger$; Penn State University$^\ddagger$; MPI SWS$^\ast$\
    `kathrin.grosse@cispa.saarland`
bibliography:
- 'lit.bib'
title: 'On the (Statistical) Detection of Adversarial Examples'
---

[^1]: Please contact the authors to obtain the code for reproduction of the experiments.

[^2]: Recent work [@2017arXiv170507263C], however, has shown that our approach is vulnerable if optimization-based attacks are used, which require however more computational effort.
