Fig. 1

The left shows a comparison of the model’s detection performance when subjected to different samples (clean vs. adversarial), in which we can see that there is almost no degradation in our accuracy for clean samples. In addition, we achieve the best detection performance against adversarial samples, realizing the smallest performance gap (highest vs. lowest performance difference). While the right figure shows a more intuitive comparison of the sum of performance detection, which shows that our proposed method achieves the highest performance