  Although deep neural networks have shown promising performances on various
tasks, they are susceptible to incorrect predictions induced by imperceptibly
small perturbations in inputs. A large number of previous works proposed to
detect adversarial attacks. Yet, most of them cannot effectively detect them
against adaptive whitebox attacks where an adversary has the knowledge of the
model and the defense method. In this paper, we propose a new probabilistic
adversarial detector motivated by a recently introduced non-robust feature. We
consider the non-robust features as a common property of adversarial examples,
and we deduce it is possible to find a cluster in representation space
corresponding to the property. This idea leads us to probability estimate
distribution of adversarial representations in a separate cluster, and leverage
the distribution for a likelihood based adversarial detector.
