Identifying artificial artifacts in input data to detect adversarial attacks

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to:

• process, by a neural network executing on the data processing system, original input data representing non-adversarial input data;
• determine, by mean output learning logic executing in the data processing system, a mean response for each intermediate layer of one or more intermediate layers of the neural network based on results of processing the original input data;
• process, by the neural network, adversarial input data representing input data having one or more distortions;
• compare, by layer-wise comparison logic executing in the data processing system, for each intermediate layer of the one or more intermediate layers of the neural network, a response generated by the intermediate layer based on processing the adversarial input data, to the mean response associated with the intermediate layer, to thereby generate one or more distance metrics for the one or more intermediate layers;
• generate, by the layer-wise comparison logic, a vector output based on the one or more distance metrics for the one or more intermediate layers;
• and
• train, based on the vector output, a classifier executing in the data processing system, to identify adversarial input data based on responses generated by the one or more intermediate layers of the neural network.

A data processing system comprising:

• at least one processor;
• and
• at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by one or more of the at least one processor, cause the one or more processors to implement a neural network, mean output learning logic, layer-wise comparison logic, and a classifier that operate to:
• process, by the neural network, original input data representing non-adversarial input data;
• determine, by the mean output learning logic, a mean response for each intermediate layer of one or more intermediate layers of the neural network based on results of processing the original input data;
• process, by the neural network, adversarial input data representing input data having one or more distortions;
• compare, by the layer-wise comparison logic, for each intermediate layer of the one or more intermediate layers of the neural network, a response generated by the intermediate layer based on processing the adversarial input data, to the mean response associated with the intermediate layer, to thereby generate one or more distance metrics for the one or more intermediate layers;
• generate, by the layer-wise comparison logic, a vector output based on the one or more distance metrics for the one or more intermediate layers;
• and
• train, based on the vector output, the classifier executing in the data processing system, to identify adversarial input data based on responses generated by the one or more intermediate layers of the neural network.