Unveiling distinguishing properties of adversarial examples through neural tangent kernels

Deep neural networks (DNNs), in addition to great power, exhibit significant weaknesses, with one of the most notable being the susceptibility to adversarial attacks by carefully crafted, minimally perturbed, adversarial examples. Despite numerous efforts towards creating reliable detectors and defense mechanisms, the underlying factors that make such attacks possible have not yet been fully understood. In this paper, we further explore the use of local intrinsic dimensionality (LID), and, for the first time, hubness, as indicators for detection of adversarial examples. Furthermore, we involve neural tangent kernels (NTKs) in this task, showing that NTK-induced distance measures offer more information on how to detect adversarial examples, through both LID and hubness, than distances computed on raw input data or one network layer. Furthermore, we combine LID and hubness as features into a well-performing classifier that exhibits better detection accuracy than any of the two features used on their own. Finally, we combine the LID and hubness features with state-of-the-art adversarial attack detectors, demonstrating their general usefulness for the task. Our findings offer insight into the properties and nature of adversarial examples of various types, paving the way to the construction of better detectors and, possibly, the construction of models that are more robust to such attacks.