CIGA: Detecting Adversarial Samples Via Critical Inference Graph Analysis

Deep neural networks (DNNs) exhibit significant vulnerability under adversarial sample attacks, where carefully crafted small perturbations added to benign samples lead to misclassification during testing. A large amount of work has been proposed to detect adversarial samples. However, existing works primarily rely on data or activation features of DNNs, focusing only on the impact of individual neurons at each layer while neglecting the effects of inter-layer correlations on decisions. Our key observation is that benign and adversarial samples tend to experience not only distinctive neurons in each layer but also different connection patterns among different layers during inference. Leveraging this insight, we extract Critical Inference Graphs (CIGs) of samples from DNNs. Based on the statistical features of CIGs, we analyze the data features of each layer and the structural features between layers during the classification process. We then propose an unsupervised adversarial sample detection algorithm via CIG Analysis (CIGA). We evaluate CIGA against 7 white-box attacks, 2 black-box attacks and 1 real-world attack. We also compare CIGA with six state-of-the-art (SOTA) detection algorithms. The experimental results demonstrate that our proposed CIGA maintains high sensitivity (over 90%) while keeping a low false positive rate (below 3%) across all attacks, showing better generalization performance compared to SOTA algorithms.