Detecting Adversarial Examples Through Image Transformation


  • Shixin Tian Iowa State University
  • Guolei Yang Iowa State University
  • Ying Cai Iowa State University


Adversarial examples, Convolutional neural network, Image transformation


Deep Neural Networks (DNNs) have demonstrated remarkable performance in a diverse range of applications. Along with the prevalence of deep learning, it has been revealed that DNNs are vulnerable to attacks. By deliberately crafting adversarial examples, an adversary can manipulate a DNN to generate incorrect outputs, which may lead catastrophic consequences in applications such as disease diagnosis and self-driving cars. In this paper, we propose an effective method to detect adversarial examples in image classification. Our key insight is that adversarial examples are usually sensitive to certain image transformation operations such as rotation and shifting. In contrast, a normal image is generally immune to such operations. We implement this idea of image transformation and evaluate its performance in oblivious attacks. Our experiments with two datasets show that our technique can detect nearly 99% of adversarial examples generated by the state-of-the-art algorithm. In addition to oblivious attacks, we consider the case of white-box attacks. We propose to introduce randomness in the process of image transformation, which can achieve a detection ratio of around 70%.




How to Cite

Tian, S., Yang, G., & Cai, Y. (2018). Detecting Adversarial Examples Through Image Transformation. Proceedings of the AAAI Conference on Artificial Intelligence, 32(1). Retrieved from