Wrapper-Based Adversarial Input Screening for Deep Image Classifiers Using Feature Squeezing and Logit-Space Inconsistency

Abstract

Adversarial perturbations pose a practical integrity risk to vision-based decision systems by causing image classifiers to misclassify inputs after visually subtle changes. This paper evaluates a wrapper-based adversarial input screening approach that compares a classifier’s output on an original image with its output after benign feature-squeezing transformations. The evaluated transformations include median filtering, non-local means denoising, and bit-depth reduction. Using a frozen-backbone ResNet50 on CIFAR-10, the detector is assessed under untargeted and targeted Fast Gradient Sign Method attacks, followed by stronger Projected Gradient Descent verification. Detection thresholds are calibrated only on clean data using a fixed 5% false positive rate protocol and are validated on held-out clean samples. The results show that softmax-space ℓ1 inconsistency provides moderate, transformation-dependent detection, whereas logit-space ℓ2 inconsistency yields a stronger, more stable screening signal. Median filtering with logit-space ℓ2 achieves near-complete detection at ε = 8/255 and remains the most reliable configuration across the perturbation sensitivity analysis, while non-local means denoising becomes effective mainly for large perturbations. An additional two-stage gate is evaluated for deployment-oriented alert triage; it does not replace the primary detector or override its screening decision, but ranks flagged inputs by risk severity. Further evaluations show that performance decreases on TinyImageNet and that targeted threshold-aware adaptive optimisation can substantially reduce detection recall. The findings support the use of median filtering with logit-space ℓ2 inconsistency as a tool for screening adversarial inputs to image classifiers, but its effectiveness depends on dataset complexity, classifier behaviour, and attack adaptivity.