{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/characterizing-adversarial-subspaces-using","title":"Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality","arxiv_id":"1801.02613","date":"2018-01-08","proceeding":"ICLR 2018 1","authors":["Xingjun Ma","Bo Li","Yisen Wang","Sarah M. Erfani","Sudanthi Wijewickrema","Grant Schoenebeck","Dawn Song","Michael E. Houle","James Bailey"],"abstract":"Deep Neural Networks (DNNs) have recently been shown to be vulnerable against\nadversarial examples, which are carefully crafted instances that can mislead\nDNNs to make errors during prediction. To better understand such attacks, a\ncharacterization is needed of the properties of regions (the so-called\n'adversarial subspaces') in which adversarial examples lie. We tackle this\nchallenge by characterizing the dimensional properties of adversarial regions,\nvia the use of Local Intrinsic Dimensionality (LID). LID assesses the\nspace-filling capability of the region surrounding a reference example, based\non the distance distribution of the example to its neighbors. We first provide\nexplanations about how adversarial perturbation can affect the LID\ncharacteristic of adversarial regions, and then show empirically that LID\ncharacteristics can facilitate the distinction of adversarial examples\ngenerated using state-of-the-art attacks. As a proof-of-concept, we show that a\npotential application of LID is to distinguish adversarial examples, and the\npreliminary results show that it can outperform several state-of-the-art\ndetection measures by large margins for five attack strategies considered in\nthis paper across three benchmark datasets. Our analysis of the LID\ncharacteristic for adversarial regions not only motivates new directions of\neffective adversarial defense, but also opens up more challenges for developing\nnew attacks to better understand the vulnerabilities of DNNs.","url_abs":"http://arxiv.org/abs/1801.02613v3","url_pdf":"http://arxiv.org/pdf/1801.02613v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"characterizing-adversarial-subspaces-using","repo_url":"https://github.com/xingjunm/lid_adversarial_subspace_detection","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1801.02613","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1801.02613"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xingjunm/lid_adversarial_subspace_detection","reach":null}],"summary":{"ran_draft_wrong":1},"by_repo_kind":{"official":{"samples":1,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"5e422f2389baaddc","entry":"merge_and_generate_labels","repo":"xingjunm/lid_adversarial_subspace_detection","repo_kind":"official","path":"extract_characteristics.py","file_url":"https://github.com/xingjunm/lid_adversarial_subspace_detection/blob/HEAD/extract_characteristics.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5e422f2389baaddc"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}