  As a defense strategy against adversarial attacks, adversarial detection aims
to identify and filter out adversarial data from the data flow based on
discrepancies in distribution and noise patterns between natural and
adversarial data. Although previous detection methods achieve high performance
in detecting gradient-based adversarial attacks, new attacks based on
generative models with imbalanced and anisotropic noise patterns evade
detection. Even worse, existing techniques either necessitate access to attack
data before deploying a defense or incur a significant time cost for inference,
rendering them impractical for defending against newly emerging attacks that
are unseen by defenders. In this paper, we explore the proximity relationship
between adversarial noise distributions and demonstrate the existence of an
open covering for them. By learning to distinguish this open covering from the
distribution of natural data, we can develop a detector with strong
generalization capabilities against all types of adversarial attacks. Based on
this insight, we heuristically propose Perturbation Forgery, which includes
noise distribution perturbation, sparse mask generation, and pseudo-adversarial
data production, to train an adversarial detector capable of detecting unseen
gradient-based, generative-model-based, and physical adversarial attacks, while
remaining agnostic to any specific models. Comprehensive experiments conducted
on multiple general and facial datasets, with a wide spectrum of attacks,
validate the strong generalization of our method.
