Adversarial Detection via Multi‐Channel Feature Redistribution for Subcategory Classification

The subcategory classification problem subdivides a category into several finer categories after categorizing major categories. Sub‐categories usually share highly similar features, such as in cat species classification and COVID‐19 detection and classification based on chest X‐ray (CXR) images. They are likely to be attacked as another subcategory at a low cost by adversarial attacks. It is a challenge for detection methods to distinguish the adversaries from the normal samples of the same subcategory. We propose multi‐channel feature redistribution (MFR), a novel adversary detection mechanism based on the MFR, which disentangles the initial embedded features into three channels: (1) core feature —it guarantees the robustness and the precision of classification; (2) co-activation feature— it causes the prediction into the adjacent category; and (3) background noise— it introduces high‐frequency perturbations that distort the feature distribution. We design a new optimization goal to extract the corresponding features in each channel. A binary meta‐classifier is then built to further evaluate the balance among the three feature channels and detect adversarial samples. We combine the abstract visualization projection of the three channels as new inputs to train the meta‐classifier. The experiments are conducted on eight datasets, and all the results show that MFR can effectively enhance the meta‐classifier’s detection performance. We verify each channel’s utility by ablation analysis and test the transferability between classifiers. Furthermore, experimental results show that MFR can effectively detect adversarial samples in subcategory classification, even against secondary adversarial attacks.