Adversarial Attack Detection using Normalizing Flows

The deployment of Deep Neural Networks within the perception pipelines of autonomous driving
systems is critically hindered by their vulnerability to visually inconspicuous adversarial pertur-
bations. In safety-critical applications such as Traffic Sign Recognition, these mathematical ma-
nipulations can force highly confident misclassifications, bypassing traditional Out-of-Distribution
detection mechanisms that rely on compromised softmax probability distributions. To secure these
perception systems without degrading their baseline accuracy, this thesis proposes and engineers
an unsupervised, parallel runtime safety monitor based on exact density estimation utilizing the
multi-scale Glow Normalizing Flow architecture.
The central scientific contribution of this research is a comprehensive, mathematically grounded
ablation study investigating the optimal topological input space for generative anomaly detectors.
The study directly compares an Input-Only flow architecture, which models the exact log-likelihood
of the raw pixel space, against a novel Joint Input-Feature architecture. The joint configuration ex-
tracts intermediate semantic representations from the deep hidden layers of a frozen target classifier,
... mehr
spatially aligns them, and models the massively high-dimensional concatenated tensor, theoretically
attempting to fuse low-level statistical anomalies with high-level semantic inconsistencies.
Extensive empirical evaluations were conducted across multiple deep learning backbones and
highly diverse traffic sign datasets against optimal white-box L∞ attacks. The results conclusively
demonstrate that the Input-Only exact density estimator successfully identifies the high-frequency
structural disruptions induced by digital adversarial perturbations, achieving robust detection mar-
gins. Conversely, the Joint Input-Feature architecture exhibits a severe degradation in detection
efficacy. This counter-intuitive failure is formally attributed to the Semantic Alignment Paradox,
wherein successfully optimized adversarial features perfectly mimic the natural semantic profile of
the target class, thereby tricking the generative model into assigning a high likelihood score.
Furthermore, the computational overhead analysis proves that the massive quadratic inflation of
Floating Point Operations and inference latency required to process the concatenated semantic fea-
tures strictly prohibits real-time deployment. Ultimately, this thesis mathematically and empirically
establishes that the lightweight Input-Only topology is the strictly superior, computationally viable
paradigm for defending latency-constrained autonomous systems against digital adversarial threats.