File size: 24,269 Bytes
e83d3d6
 
 
 
 
5366905
 
e83d3d6
5366905
e83d3d6
 
 
 
 
 
 
 
 
 
 
1a23e33
e83d3d6
 
caaf80c
 
 
e83d3d6
 
 
 
344407b
93ef4d5
195942f
1a87ac9
93ef4d5
f6cc227
d17ac5b
50238de
f6cc227
 
4817884
a0a9740
f6cc227
 
 
 
 
 
75fab0b
ec73a31
 
 
 
 
 
 
 
 
 
 
 
 
d17ac5b
f6cc227
 
344407b
 
 
 
 
 
 
 
 
 
e83d3d6
 
 
 
 
 
 
 
5366905
e83d3d6
 
5366905
e83d3d6
5366905
e83d3d6
5366905
e83d3d6
 
5366905
e83d3d6
 
5366905
e83d3d6
 
 
 
5366905
 
 
e83d3d6
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
5366905
e83d3d6
5366905
e83d3d6
 
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
 
 
 
 
 
 
5366905
e83d3d6
 
 
 
 
 
 
 
 
 
 
5366905
 
 
 
 
 
 
 
 
 
 
 
67792b1
5366905
e83d3d6
 
 
 
 
 
 
b19c065
ae66a58
 
dcaee4d
ae66a58
75fab0b
344407b
75fab0b
dcaee4d
75fab0b
ae66a58
 
8f4ffcd
 
 
 
 
 
 
 
 
ae66a58
 
b19c065
ae66a58
b19c065
ae66a58
 
eade1a5
ae66a58
eade1a5
67792b1
8f4ffcd
eade1a5
 
 
ae66a58
 
 
 
b19c065
e83d3d6
b19c065
 
344407b
 
 
 
 
daa90fa
48c978d
cb39ab0
 
48c978d
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7885478
48c978d
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
7885478
48c978d
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
cf6eea8
344407b
 
 
 
b19c065
344407b
b19c065
344407b
b19c065
344407b
 
75fab0b
 
60eb8c9
75fab0b
 
bb478f7
870cc69
75fab0b
 
 
 
344407b
 
1a23e33
f6cc227
eca759a
 
 
f6cc227
 
acd5055
 
1a87ac9
f6cc227
75fab0b
1a87ac9
f6cc227
a0a9740
1a87ac9
34ab225
75fab0b
1a87ac9
f6cc227
a0a9740
75fab0b
93ef4d5
f6cc227
 
344407b
81ae1a7
dcaee4d
81ae1a7
773645f
a0a9740
bb478f7
81ae1a7
a0a9740
bb478f7
81ae1a7
 
a0a9740
870cc69
 
81ae1a7
dcaee4d
344407b
b19c065
 
bffd14d
7d3e9de
bffd14d
 
 
 
 
 
b19c065
f7a8088
 
 
ec73a31
3b31e56
ec73a31
3b31e56
38e1e05
c0ec803
ec73a31
431462c
 
 
 
 
 
3b31e56
 
ec73a31
 
 
 
 
 
 
 
 
 
3b31e56
 
 
 
 
 
 
2b13e72
bffd14d
431462c
b19c065
bffd14d
 
e5aeb44
b19c065
344407b
 
e83d3d6
b19c065
 
 
e83d3d6
 
 
5366905
ae66a58
5366905
 
 
e83d3d6
 
 
 
 
 
 
42805da
e83d3d6
 
 
 
 
 
 
42805da
e83d3d6
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <meta name="description"
        content="Demo Page of BEYOND ICML 2024.">
  <meta name="keywords" content="BEYOND, Adversarial Examples, Adversarial Detection">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Be Your Own Neighborhood: Detecting Adversarial Examples by the Neighborhood Relations Built on Self-Supervised Learning</title>

  <link href="https://fonts.googleapis.com/css?family=Google+Sans|Noto+Sans|Castoro"
        rel="stylesheet">

  <link rel="stylesheet" href="./static/css/bulma.min.css">
  <link rel="stylesheet" href="./static/css/bulma-carousel.min.css">
  <link rel="stylesheet" href="./static/css/bulma-slider.min.css">
  <link rel="stylesheet" href="./static/css/fontawesome.all.min.css">
  <link rel="stylesheet"
        href="https://cdn.jsdelivr.net/gh/jpswalsh/academicons@1/css/academicons.min.css">
  <link rel="stylesheet" href="./static/css/index.css">
  <link rel="stylesheet" href="./static/css/custom.css">
  <link rel="icon" href="./static/images/favicon.svg">

  <!-- <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script> -->
  <script src="https://code.jquery.com/jquery-3.6.0.js"></script>
  <script src="https://code.jquery.com/ui/1.13.2/jquery-ui.js"></script>
  <script defer src="./static/js/fontawesome.all.min.js"></script>
  <script src="./static/js/bulma-carousel.min.js"></script>
  <script src="./static/js/bulma-slider.min.js"></script>
  <script src="./static/js/index.js"></script>

  <!-- for mathjax support -->
  <!-- <script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script> -->
  <script id="MathJax-script" async src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script>

  <script>
  $(document).ready(function(){
    $('#adaptive-loss-formula-list').on('click', 'a', function(e) {
        e.preventDefault();
        if (!$(this).hasClass('selected')) {

            $('.formula-content').hide(200);
            $('.formula-list > a').removeClass('selected');
            $(this).addClass('selected');
            var target = $(this).attr('href');
            $(target).show(200);
        }
    });


    $('#adaptive-dataset').on('click', 'a', function(e) {
        e.preventDefault();
        if (!$(this).hasClass('selected')) {

            $('.interpolation-video-column').hide(200);
            $('#adaptive-dataset > a').removeClass('selected');
            $(this).addClass('selected');
            var target = $(this).attr('href');
            $(target).show(200);
        }
    });

  })
  </script>

  <style type="text/css">
    .tg  {border-collapse:collapse;border-spacing:0;}
    .tg td{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px;
      overflow:hidden;padding:10px 5px;word-break:normal;}
    .tg th{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px;
      font-weight:normal;overflow:hidden;padding:10px 5px;word-break:normal;}
    .tg .tg-baqh{text-align:center;vertical-align:top}
    .tg .tg-amwm{font-weight:bold;text-align:center;vertical-align:top}
    .tg .tg-2imo{font-style:italic;text-align:center;text-decoration:underline;vertical-align:top}
    </style>
</head>
<body>

<section class="hero">
  <div class="hero-body">
    <div class="container is-max-desktop">
      <div class="columns is-centered">
        <div class="column has-text-centered">
          <h1 class="title is-1 publication-title">Be Your Own Neighborhood: Detecting Adversarial Examples by the Neighborhood Relations Built on Self-Supervised Learning</h1>
          <div class="is-size-5 publication-authors">
            <span class="author-block">
              <a href="#" target="_blank">Zhiyuan He</a><sup>1*</sup>,</span>
            <span class="author-block">
              <a href="https://yangyijune.github.io/" target="_blank">Yijun Yang</a><sup>1*</sup>,</span>
            <span class="author-block">
              <a href="https://sites.google.com/site/pinyuchenpage/home" target="_blank">Pin-Yu Chen</a><sup>2</sup>,
            </span>
            <span class="author-block">
              <a href="https://cure-lab.github.io/" target="_blank">Qiang Xu</a><sup>1</sup>,
            </span>
            <span class="author-block">
              <a href="https://tsungyiho.github.io/" target="_blank">Tsung-Yi Ho</a><sup>1</sup>,
            </span>
          </div>

          <div class="is-size-5 publication-authors">
            <span class="author-block"><sup>*</sup>Equal contribution,</span>
            <span class="author-block"><sup>1</sup>The Chinese University of Hong Kong,</span>
            <span class="author-block"><sup>2</sup>IBM Research</span>
          </div>

          <div class="column has-text-centered">
            <div class="publication-links">
              <!-- PDF Link. -->
              <span class="link-block">
                <a href="https://arxiv.org/abs/2209.00005" target="_blank"
                   class="external-link button is-normal is-rounded is-dark">
                  <span class="icon">
                      <i class="fas fa-file-pdf"></i>
                  </span>
                  <span>Paper</span>
                </a>
              </span>
              <span class="link-block">
                <a href="https://arxiv.org/abs/2209.00005" target="_blank"
                   class="external-link button is-normal is-rounded is-dark">
                  <span class="icon">
                      <i class="ai ai-arxiv"></i>
                  </span>
                  <span>arXiv</span>
                </a>
              </span>
              <!-- Video Link. -->
              <!-- <span class="link-block">
                <a href="https://www.youtube.com/watch?v=MrKrnHhk8IA" target="_blank"
                   class="external-link button is-normal is-rounded is-dark">
                  <span class="icon">
                      <i class="fab fa-youtube"></i>
                  </span>
                  <span>Video</span>
                </a>
              </span> -->
              <!-- Code Link. -->
              <!-- <span class="link-block">
                <a href="https://github.com/google/nerfies" target="_blank"
                   class="external-link button is-normal is-rounded is-dark">
                  <span class="icon">
                      <i class="fab fa-github"></i>
                  </span>
                  <span>Code</span>
                  </a>
              </span> -->
            </div>

          </div>
        </div>
      </div>
    </div>
  </div>
</section>

<!-- <section class="hero teaser">
  <div class="container is-max-desktop">
    <div class="hero-body">
      <video id="teaser" autoplay muted loop playsinline height="100%">
        <source src="./static/videos/teaser.mp4"
                type="video/mp4">
      </video>
      <h2 class="subtitle has-text-centered">
        <span class="dnerf">Nerfies</span> turns selfie videos from your phone into
        free-viewpoint
        portraits.
      </h2>
    </div>
  </div>
</section> -->



<section class="section">
  <div class="container is-max-desktop">
    <!-- Abstract. -->
    <div class="columns is-centered has-text-centered">
      <div class="column is-four-fifths">
        <h2 class="title is-3">Abstract</h2>
        <div class="content has-text-justified">
          <p>
            Deep Neural Networks (DNNs) have achieved excellent performance in various fields. However, DNNs’ vulnerability to 
            Adversarial Examples (AE) hinders their deployments to safety-critical applications. In this paper, we present <strong>BEYOND</strong>, 
            an innovative AE detection frameworkdesigned for reliable predictions. BEYOND identifies AEs by distinguishing the AE’s 
            abnormal relation with its augmented versions, i.e. neighbors, from two prospects: representation similarity and label 
            consistency. An off-the-shelf Self-Supervised Learning (SSL) model is used to extract the representation and predict the 
            label for its highly informative representation capacity compared to supervised learning models. We found clean samples 
            maintain a high degree of representation similarity and label consistency relative to their neighbors, in contrast to AEs 
            which exhibit significant discrepancies. We explain this obser vation and show that leveraging this discrepancy BEYOND can 
            accurately detect AEs. Additionally, we develop a rigorous justification for the effectiveness of BEYOND. Furthermore, as a 
            plug-and-play model, BEYOND can easily cooperate with the Adversarial Trained Classifier (ATC), achieving state-of-the-art 
            (SOTA) robustness accuracy. Experimental results show that BEYOND outperforms baselines by a large margin, especially under 
            adaptive attacks. Empowered by the robust relationship built on SSL, we found that BEYOND outperforms baselines in terms 
            of both detection ability and speed.
          </p>
        </div>
      </div>
    </div>
    <!--/ Abstract. -->
  </div>
</section>

<!-- Relations -->
<section class="section">
  <div class="container is-max-desktop">
    <h2 class="title is-3">Neighborhood Relations of AEs and Clean Samples</h2>
    <div class="columns is-centered">
      <div class="column container-centered">
          <img src="./static/images/relations.jpg" alt="Neighborhood Relations of Benign Examples and AEs"/>
          <p>
            <strong>Figure 1. Neighborhood Relations of AEs and Clean Samples.</strong>
          </p>
      </div>
    </div>
    <div class="columns is-centered">
      <div class="column has-text-justified">
        <p>
          Latent Neighborhood Graph (LNG) represents the relationship between the input sample and the reference sample as a graph, 
          whose nodes are embeddings extracted by DDN and edges are built according to distances between the input node and reference nodes, 
          and train a graph neural network to detect AEs.
        </p>
      </div>
    </div>
  </div>
</section>
<!-- Relations -->

<!-- Overview -->
<section class="section">
  <div class="container is-max-desktop">
    <h2 class="title is-3">Method Overview of BEYOND</h2>
    <div class="columns is-centered">
      <div class="column container-centered">
        <img src="./static/images/overview.png" alt="Method Overview of BEYOND"/>
        <p><strong>Figure 2. Overview of BEYOND.</strong> First, we augment the input image to obtain a bunch of its neighbors. Then, we
          perform the label consistency detection mechanism on the classifier’s prediction of the input image and that of neighbors predicted by
          SSL’s classification head. Meanwhile, the representation similarity mechanism employs cosine distance to measure the similarity among
          the input image and its neighbors. Finally, The input image with poor label consistency or representation similarity is flagged as AE.</p>
      </div>
    </div>
  </div>
</section>
<!-- Overview -->


<!-- Results -->
<section class="section">
  <div class="container is-max-desktop">
    <h2 class="title is-3">Detection Performance</h2>
    <div class="columns is-centered">
      <div class="column container-centered">
        <table class="tg" border="1" style="width:100%;">
          <caption><strong>Table 1.</strong>The Area Under the ROC Curve (AUC) of Different Adversarial Detection Approaches on CIFAR-10. LNG 
            is not open-sourced and the data comes from its report. To align with baselines, classifier: ResNet110, FGSM: &epsilon; = 0.05, PGD:
            &epsilon; = 0.02. Note that BEYOND needs no AE for training, leading to the same value on both seen and unseen settings. The <strong>bold</strong> values
            are the best performance, and the <u><i>underlined italicized</i></u> values are the second-best performanc</caption>
          <thead>
            <tr>
              <th class="tg-amwm" rowspan="2">AUC(%)</th>
              <th class="tg-baqh" colspan="4"><span style="font-weight:bold;font-style:italic">Unse</span><span style="font-weight:bold">e</span><span style="font-weight:bold;font-style:italic">n</span><span style="font-weight:bold">: </span>Attacks used in training are preclude from tests</th>
              <th class="tg-baqh" colspan="5"><span style="font-weight:bold;font-style:italic">Seen</span><span style="font-weight:bold">:</span> Attacks used in training are included in tests</th>
            </tr>
            <tr>
              <th class="tg-baqh">FGSM</th>
              <th class="tg-baqh">PGD</th>
              <th class="tg-baqh">AutoAttack</th>
              <th class="tg-baqh">Square</th>
              <th class="tg-baqh">FGSM</th>
              <th class="tg-baqh">PGD</th>
              <th class="tg-baqh">CW</th>
              <th class="tg-baqh">AutoAttack</th>
              <th class="tg-baqh">Square</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="tg-baqh">DkNN</td>
              <td class="tg-baqh">61.55</td>
              <td class="tg-baqh">51.22</td>
              <td class="tg-baqh">52.12</td>
              <td class="tg-baqh">59.46</td>
              <td class="tg-baqh">61.55</td>
              <td class="tg-baqh">51.22</td>
              <td class="tg-baqh">61.52</td>
              <td class="tg-baqh">52.12</td>
              <td class="tg-baqh">59.46</td>
            </tr>
            <tr>
              <td class="tg-baqh">kNN</td>
              <td class="tg-baqh">61.83</td>
              <td class="tg-baqh">54.52</td>
              <td class="tg-baqh">52.67</td>
              <td class="tg-baqh">73.39</td>
              <td class="tg-baqh">61.83</td>
              <td class="tg-baqh">54.52</td>
              <td class="tg-baqh">62.23</td>
              <td class="tg-baqh">52.67</td>
              <td class="tg-baqh">73.39</td>
            </tr>
            <tr>
              <td class="tg-baqh">LID</td>
              <td class="tg-baqh">71.08</td>
              <td class="tg-baqh">61.33</td>
              <td class="tg-baqh">55.56</td>
              <td class="tg-baqh">66.18</td>
              <td class="tg-baqh">73.61</td>
              <td class="tg-baqh">67.98</td>
              <td class="tg-baqh">55.68</td>
              <td class="tg-baqh">56.33</td>
              <td class="tg-baqh">85.94</td>
            </tr>
            <tr>
              <td class="tg-baqh">Hu</td>
              <td class="tg-baqh">84.51</td>
              <td class="tg-baqh">58.59</td>
              <td class="tg-baqh">53.55</td>
              <td class="tg-2imo">95.82</td>
              <td class="tg-baqh">84.51</td>
              <td class="tg-baqh">58.59</td>
              <td class="tg-2imo">91.02</td>
              <td class="tg-baqh">53.55</td>
              <td class="tg-baqh">95.82</td>
            </tr>
            <tr>
              <td class="tg-baqh">Mao</td>
              <td class="tg-baqh">95.33</td>
              <td class="tg-2imo">82.61</td>
              <td class="tg-2imo">81.95</td>
              <td class="tg-baqh">85.76</td>
              <td class="tg-baqh">95.33</td>
              <td class="tg-baqh">82.61</td>
              <td class="tg-baqh">83.10</td>
              <td class="tg-baqh">81.95</td>
              <td class="tg-baqh">85.76</td>
            </tr>
            <tr>
              <td class="tg-baqh">LNG</td>
              <td class="tg-2imo">98.51 </td>
              <td class="tg-baqh">63.14 </td>
              <td class="tg-baqh">58.47 </td>
              <td class="tg-baqh">94.71 </td>
              <td class="tg-amwm">99.88 </td>
              <td class="tg-2imo">91.39 </td>
              <td class="tg-baqh">89.74 </td>
              <td class="tg-2imo">84.03 </td>
              <td class="tg-2imo">98.82 </td>
            </tr>
            <tr>
              <td class="tg-baqh">BEYOND</td>
              <td class="tg-amwm">98.89</td>
              <td class="tg-amwm">99.28</td>
              <td class="tg-amwm">99.16</td>
              <td class="tg-amwm">99.27</td>
              <td class="tg-2imo">98.89</td>
              <td class="tg-amwm">99.28</td>
              <td class="tg-amwm">99.20</td>
              <td class="tg-amwm">99.16</td>
              <td class="tg-amwm">99.27</td>
            </tr>
          </tbody>
      </table>
      </div>
    </div>
  </div>
</section>
<!-- Results -->

<!-- Adaptive Attack -->
<section class="section">

  <div class="container is-max-desktop">
    <h2 class="title is-3">Adaptive Attack</h2>

    <div class="columns is-centered">
      <div class="column container formula">
        <p>
          Attackers can design adaptive attacks to try to bypass BEYOND when the attacker knows all the parameters of the model 
          and the detection strategy. For an SSL model with a feature extractor <i>f</i>, a projector <i>h</i>, and a classification head <i>g</i>, 
          the classification branch can be formulated as <strong>C</strong>= <i>f</i> &deg; <i>g</i> and the representation branch as <strong>R</strong> = <i>f</i> &deg; <i>h</i>. 
          To attack effectively, the adversary must deceive the target model while guaranteeing the label consistency and representation similarity of the SSL model. 
      </div>
    </div>

    <div class="columns is-centered">
      <div class="column container-centered">
        <div id="adaptive-loss-formula" class="container">
          <div id="adaptive-loss-formula-list" class="row align-items-center formula-list">
            <a href=".label-loss" class="selected">Label Consistency Loss</a>
            <a href=".representation-loss">Representation Similarity Loss</a>
            <a href=".total-loss">Total Loss</a>
            <div style="clear: both"></div>
          </div>
          <div class="row align-items-center adaptive-loss-formula-content">
            <span class="formula label-loss formula-content">
              $$
              \displaystyle 
              Loss_{label} = \frac{1}{k} \sum_{i=1}^{k} \mathcal{L}\left(\mathbb{C}\left(W^i(x+\delta)  \right), y_t\right)
              $$
            </span>
            <span class="formula representation-loss formula-content" style="display: none;">
              $$
              \displaystyle
              Loss_{repre} = \frac{1}{k} \sum_{i=1}^{k}\mathcal{S}(\mathbb{R}(W^i(x+\delta)), \mathbb{R}(x+\delta))
              $$
            </span>
            <span class="formula total-loss formula-content" style="display: none;">
              $$\displaystyle \mathcal{L}_C(x+\delta, y_t) + Loss_{label} - \alpha \cdot Loss_{repre}$$
            </span>
          </div>
          </div>
      </div>
    </div>

    <div class="columns is-centered">
      <div class="column container adaptive-loss-formula-content">
        <p class="formula label-loss formula-content">
          where k represents the number of generated neighbors, <i>y</i><sub><i>t</i></sub> is the target class, and <strong><i>L</i></strong> is the cross entropy loss function.
        </p>
        <p class="formula representation-loss formula-content" style="display: none">
          where k represents the number of generated neighbors, and <strong><i>S</i></strong> is the cosine similarity.
        </p>
          
        <p class="formula total-loss formula-content" style="display: none;">
          where <strong><i>L</i></strong><sub>C</sub> indicates classifier's loss function, <i>y</i><sub><i>t</i></sub> is the targeted class, and &alpha; refers to a hyperparameter, 
          which is a trade-off parameter between label consistency and representation similarity..
        </p>
      </div>
    </div>

    <div class="columns is-centered">
      <div class="column is-full-width">
        <h3 class="title is-4">Performance of BEYOND against Adaptive Attacks</h3>
        <div class="content has-text-justified">
          <p>
            We can also animate the scene by interpolating the deformation latent codes of two input
            frames. Use the slider here to linearly interpolate between the left frame and the right
            frame.
          </p>
        </div>

        <div class="columns is-vcentered interpolation-panel">

            <div id="adaptive-dataset" class="column is-3 align-items-center" style="width: 30%;">
              <a href="#c10" class="selected">CIFAR-10</a>
              <!-- <a href="#c100" class="selected">CIFAR-100</a> -->
              <a href="#imgnet" >ImageNet</a>
              <div style="clear: both"></div>
            </div>
            <div id="c10" class="column interpolation-video-column" style="width: 70%;">
              <div id="interpolation-image-wrapper" >
                Loading...
              </div>
              <input class="slider is-full-width is-large is-info"
                id="interpolation-slider"
                step="1" min="0" max="6" value="0" type="range">
              <label for="interpolation-slider"><strong>Perturbation Budget &Epsilon;</strong> from 2/255 to 128/255</label>
            </div>
            <!-- <div id="c100" class="column interpolation-video-column" style="width: 70%; display: none;">
              <div id="interpolation-image-wrapper" >
                Loading...
              </div>
              <input class="slider is-full-width is-large is-info"
                id="interpolation-slider"
                step="1" min="0" max="6" value="0" type="range">
              <label for="interpolation-slider"><strong>Perturbation Budget &Epsilon;</strong> from 2/255 to 128/255</label>
            </div> -->
            <div id="imgnet" class="column interpolation-video-column" style="width: 70%; display: none;">
              <div id="interpolation-image-wrapper" >
                Loading...
              </div>
              <input class="slider is-full-width is-large is-info"
                id="interpolation-slider"
                step="1" min="0" max="6" value="0" type="range">
              <label for="interpolation-slider"><strong>Perturbation Budget &Epsilon;</strong> from 2/255 to 128/255</label>

            </div>

        </div>
        <br/>

      
    </div>
  </div>


</section>
<!-- Adaptive Attack -->

<section class="section" id="BibTeX">
  <div class="container is-max-desktop content">
    <h2 class="title">BibTeX</h2>
    <pre><code>@article{he2024beyond,
  author    = {Zhiyuan, He and Yijun, Yang and Pin-Yu, Chen and Qiang, Xu and Tsung-Yi, Ho},
  title     = {Be your own neighborhood: Detecting adversarial example by the neighborhood relations built on self-supervised learning},
  journal   = {ICML},
  year      = {2024},
}</code></pre>
  </div>
</section>


<footer class="footer">
  <div class="container">
    <!-- <div class="content has-text-centered">
      <a class="icon-link" target="_blank"
         href="./static/videos/nerfies_paper.pdf">
        <i class="fas fa-file-pdf"></i>
      </a>
      <a class="icon-link" href="https://github.com/keunhong" target="_blank" class="external-link" disabled>
        <i class="fab fa-github"></i>
      </a>
    </div> -->
    <div class="columns is-centered">
      <div class="column is-8">
        <div class="content">
          <p>
            This website is licensed under a <a rel="license" target="_blank"
                                                href="http://creativecommons.org/licenses/by-sa/4.0/">Creative
            Commons Attribution-ShareAlike 4.0 International License</a>.
          </p>
          <p>
            This means you are free to borrow the <a target="_blank"
              href="https://github.com/nerfies/nerfies.github.io">source code</a> of this website,
            we just ask that you link back to this page in the footer.
            Please remember to remove the analytics code included in the header of the website which
            you do not want on your website.
          </p>
        </div>
      </div>
    </div>
  </div>
</footer>

</body>
</html>