FID: Detecting Adversarial Attacks with Feature Invariants and Applying to License Plate Recognition

Deep neural networks (DNNs) have become an integral part of everyday life. However, researchers have found that DNNs are vulnerable to adversarial examples attacks, which can cause abnormal behaviors such as misclassification. The existence of adversarial examples poses a significant threat to the application of DNNs, particularly in scenarios with high security requirements, such as license plate recognition systems. Current adversarial example defense and detection techniques are effective against specific types of attacks but generally lack universality across all attack types. To address adversarial attacks in real-world license plate recognition systems, we analyze the intrinsic variation of neural networks trained on clean samples and the dimensional complexity between clean samples and propose an unsupervised adversarial example detection system based on feature invariants derived from neural network invariants and local intrinsic dimensionality invariants, named Feature Invariant Detection (FID). We deploy the FID into the widelyused open-source license plate recognition systems HyperLPR and EasyPR, and conducts extensive experiments on FID with the real dataset, the Chinese license plate dataset (CCPD). Experiments are conducted on 11 different types of attacks, and the results show that FID can effectively detect all of these attacks at a lower false positive rate compared to the other four state-of-the-art detection methods, and the accuracy is always as high as $\mathbf{9 9 \%}$. Therefore, FID has good generalization to various types of adversarial attacks.