Graph based method lets adversarial detectors work across neural networks
GraphRectify: Graph-Based Transfer of Adversarial Example Detectors Across Neural Networks
Computer Vision and Pattern Recognition
Summary
Adversarial example detectors usually only work with the neural network they were trained on, so when the network changes, you have to make a new detector. The authors created GraphRectify, a method that helps detectors transfer to different neural networks by comparing their inner workings in a structured way. They tested it on many datasets and attacks, and found it works better than making a new detector from scratch, especially when networks are very different or when enough data is available. This means we can reuse protection tools more easily when upgrading neural networks.
What this means in practice
- •For security engineers: Use GraphRectify to maintain adversarial protection when upgrading image classifiers without retraining detectors from scratch.
- •For machine learning platform teams: Integrate cross-backbone adversarial detection to save development time when deploying updated neural network models.
Authors
Arash Vashagh, Roozbeh Razavi-Far
Abstract
Adversarial example detectors are often tied to the classifier backbone they were trained on, limiting reuse when the protected model is replaced or upgraded. Directly transferring such detectors across backbones is challenging because different networks generally produce incompatible internal representations. We propose GraphRectify, a graph-based framework for transferring adversarial image detectors across classifier backbones. GraphRectify learns a structured representation of intermediate classifier features and adapts representations from a new backbone to the detector learned on the original model, enabling detector reuse. We evaluate GraphRectify across multiple datasets, backbone architectures, and adversarial attacks, including detector-aware adaptive attacks that jointly target the classifier and detector. Across the complete evaluation matrix, GraphRectify achieves higher aggregate ROC-AUC than training a detector from scratch on the new backbone and the evaluated transfer ablations. The gains are particularly strong for transfers between different backbone families and when sufficient data are available. In contrast, training from scratch remains competitive in the most data-limited settings. These results show that adversarial detection knowledge can transfer effectively across heterogeneous classifier architectures rather than being relearned whenever the protected backbone changes.