Dual-Domain Adaptive Input Perturbation Sensitivity for Adversarial Example Detection.

Vision-sensor-based intelligent perception systems are increasingly used in safety-critical scenarios such as autonomous driving, edge surveillance, and Internet-of-Things (IoT) platforms. The vulnerability of deep neural networks to adversarial examples raises security concerns for sensor-acquired visual data in such systems, motivating the study of output-probability-based adversarial example detection methods under controlled benchmark settings. Existing input-level sensitivity detection methods generally rely on static perturbation scales or single-state metrics. When confronted with heterogeneous attacks, such as one-step attacks and iterative attacks, as well as complex tasks with high class density, these methods often suffer from unstable metric directions and insufficient boundary probing capability. To address these issues, this paper proposes a dual-domain adaptive adversarial example detection method based on Multi-scale Input Sensitivity (MSIS). The proposed method introduces a Manifold-Motivated Micro-scale Probing (MMP) mechanism and a Dual-State Sensitivity Fusion (DSF) mechanism. MMP adopts a task-level perturbation scaling strategy motivated by the compressed inter-class manifold structures observed in high-density classification tasks, thereby alleviating perturbation overflow and improving boundary probing effectiveness. DSF employs temperature scaling to extract sensitivity features under both the native state and the smoothed state, and alleviates the directional conflict of heterogeneous attacks under a single metric through dual-state joint modeling. Experimental results demonstrate that, without modifying the parameters of the target model, the proposed method achieves favorable detection performance against representative attacks, including FGSM, PGD, and C&W, on the CIFAR-10 and CIFAR-100 datasets. Taking the CIFAR-10 + ResNet-18 configuration as an example, the detection AUC of the proposed method against the PGD attack reaches 97.75%, an improvement of 24.32 percentage points over the best-performing non-intrusive baseline method, Energy Score (73.43%), with the lowest FPR@95TPR dropping to 7.75%. Under the CIFAR-10 + ResNet-50 configuration, the detection AUC against the PGD attack further reaches 99.14%. Meanwhile, even when compared with PASA (2024), the latest intrusive method requiring access to model gradients, the average AUC of the proposed method on CIFAR-10 + ResNet-18 (97.49%) is still 18.81 percentage points higher, and its inference latency is only 1/11th that of PASA. These results suggest that introducing task-level spatial-domain scaling and temperature-state adaptation can improve output-probability-based adversarial example detection under non-intrusive benchmark settings, providing algorithmic evidence for output-probability-based detection of adversarial perturbations in visual classification tasks.