Adversarial attacks pose safety and security concerns for deep learning applications. Yet largely imperceptible, a strong PGD-like attack may leave strong trace in the adversarial example. Since attack triggers the local linearity of a network, we speculate network behaves in different extents of linearity for benign examples and adversarial examples. Thus, we construct Adversarial Response Characteristics (ARC) features to reflect the model's gradient consistency around the input to indicate the extent of linearity. Under certain conditions, it shows a gradually varying pattern from benign example to adversarial example, as the later leads to Sequel Attack Effect (SAE). ARC feature can be used for informed attack detection (perturbation magnitude is known) with binary classifier, or uninformed attack detection (perturbation magnitude is unknown) with ordinal regression. Due to the uniqueness of SAE to PGD-like attacks, ARC is also capable of inferring other attack details such as loss function, or the ground-truth label as a post-processing defense. Qualitative and quantitative evaluations manifest the effectiveness of ARC feature on CIFAR-10 w/ ResNet-18 and ImageNet w/ ResNet-152 and SwinT-B-IN1K with considerable generalization among PGD-like attacks despite domain shift. Our method is intuitive, light-weighted, non-intrusive, and data-undemanding.

翻译：由于攻击触发了网络的局部线性,因此我们推测网络在对立实例和对立例子的线性表现有不同程度的线性。因此,我们建立反反反应特征特征(ARC),以反映该模型在投入周围的梯度一致性,以表明线性程度。在某些条件下,它显示出一种逐渐不同的模式,从温和的范例到对抗性的范例,如后来的 Sequel攻击效应(SAE)的导线性(SAE),强烈的PGD式攻击可能留下强烈的痕迹。由于对网络进行二进制分类或不知情的攻击检测(Purburbation程度未知),因此,我们可以对网络进行不同程度的线性攻击(ARC)特征特征(ARC)特征,以反映该模型相对于PGD式攻击的独特性,还能够推断出其他攻击细节,例如损失功能,或地心线性标记为后处理后防御(SAE1552-Net-Net1)域网域域域网和SAR-10式攻击的不具有实质性评价,显示ART-SIR-S-C-S-C-RO-S-C-S-10-RO-S-S-C-C-SD-S-S-C-T-T-SD-SD-SD-T-T-S-SD-S-S-T-S-S-S-S-S-S-T-S-S-S-S-S-S-S-S-S-S-S-S-S-T-S-S-S-T-S-S-S-S-S-S-S-S-S-S-S-T-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-S-