From Spatial to Spectral Domain, a New Perspective for Detecting Adversarial Examples

Table 1

Detection performance of AUC (in %) on CIFAR-10 using original samples. Detector is trained and evaluated on the specified adversarial examples. For example, 92.6 below represents that the detector is trained on BIM, whereas evaluated on adversarial examples generated by FGSM.

Dataset	Detector	FGSM	BIM	PGD	JSMA	CW	DF
CIFAR-10	FGSM	99.1	65.5	63.7	55.6	48.9	50.4
	BIM	92.6	91.6	91.7	73.5	52.2	54.7
	PGD	97.5	98.3	98.5	82.3	50.2	50.6
	JSMA	81.5	75.6	80.4	88.5	48.9	51.3
	CW	51.8	49.8	50.9	50.6	49.5	52.6
	DF	48.9	51.7	50.0	49.3	51.7	53.4