🛡️ Viyog · first-conv detector

Telling adversarial attacks apart from out-of-distribution inputs

A deployed model should abstain on a novel-but-safe (OOD) input, but reject an adversarial (ADV) attack. Most detectors can't tell the two apart. Viyog reads a tiny roughness signal off the first conv layer — training-free, gradient-free, sub-KB.

–

adversarial-detection AUROC

–

OOD-vs-ADV AUROC (T3) — the headline task

–

detector state per model

–

architectures evaluated

–

lighter than Mahalanobis

OOD → abstain
Out-of-distribution: a novel but benign input (new scene, sensor). Flag for review.

ADV → reject
Adversarial: a crafted perturbation designed to fool the model. Raise an alarm.

Dataset (in-distribution):