From Pixels to Trajectory: Universal Adversarial Example Detection via Temporal Imprints

2025-03-06

AI Summary

Detecting adversarial examples remains challenging when no prior knowledge of attacks is available, as adversarial and clean samples exhibit high feature-space overlap. Method: We propose TRAIT, the first method to identify a universal, robust temporal loss signature left by adversarial examples along model training trajectories. TRAIT models per-sample forward-pass loss as a time series, extracts spectral signatures via fast Fourier transform, and constructs an unsupervised one-class classification detector—requiring neither fine-tuning nor attack assumptions. Contribution/Results: TRAIT uncovers cross-task and cross-modal universal adversarial temporal patterns. Evaluated across 12 attacks (including SMACK), multiple models, tasks, and modalities, it achieves 97–99% detection accuracy with only 1% false rejection rate, while maintaining robustness against strong adaptive attacks.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs

Abstract

For the first time, we unveil discernible temporal (or historical) trajectory imprints resulting from adversarial example (AE) attacks. Standing in contrast to existing studies all focusing on spatial (or static) imprints within the targeted underlying victim models, we present a fresh temporal paradigm for understanding these attacks. Of paramount discovery is that these imprints are encapsulated within a single loss metric, spanning universally across diverse tasks such as classification and regression, and modalities including image, text, and audio. Recognizing the distinct nature of loss between adversarial and clean examples, we exploit this temporal imprint for AE detection by proposing TRAIT (TRaceable Adversarial temporal trajectory ImprinTs). TRAIT operates under minimal assumptions without prior knowledge of attacks, thereby framing the detection challenge as a one-class classification problem. However, detecting AEs is still challenged by significant overlaps between the constructed synthetic losses of adversarial and clean examples due to the absence of ground truth for incoming inputs. TRAIT addresses this challenge by converting the synthetic loss into a spectrum signature, using the technique of Fast Fourier Transform to highlight the discrepancies, drawing inspiration from the temporal nature of the imprints, analogous to time-series signals. Across 12 AE attacks including SMACK (USENIX Sec'2023), TRAIT demonstrates consistent outstanding performance across comprehensively evaluated modalities, tasks, datasets, and model architectures. In all scenarios, TRAIT achieves an AE detection accuracy exceeding 97%, often around 99%, while maintaining a false rejection rate of 1%. TRAIT remains effective under the formulated strong adaptive attacks.

Problem

• Detects adversarial examples via temporal trajectory imprints.
• Proposes TRAIT for universal AE detection across tasks and modalities.
• Achieves high accuracy in AE detection with minimal assumptions.

Innovation

• Temporal trajectory imprints for AE detection
• Universal loss metric across tasks and modalities
• Fast Fourier Transform for spectrum signature analysis