The threat posed by adversarial examples (AEs) to deep learning applications has garnered significant attention from the academic community. In response, various defense strategies have been proposed, including adversarial example detection. A range of detection algorithms has been developed to differentiate between benign samples and adversarial examples. However, the detection accuracy of these algorithms is significantly influenced by the characteristics of the adversarial attacks, such as attack type and intensity. Furthermore, the impact of image preprocessing on detection robustness—a common step before adversarial example generation—has been largely overlooked in prior research. To address these challenges, this paper introduces a novel adversarial example detection algorithm based on high-level feature differences (HFDs), which is specifically designed to improve robustness against both attacks and preprocessing operations. For each test image, a counterpart image with the same predicted label is randomly selected from the training dataset. The high-level features of both images are extracted using an encoder and compared through a similarity measurement model. If the feature similarity is low, the test image is classified as an adversarial example. The proposed method was evaluated for detection accuracy against four comparison methods, showing significant improvements over FS, DF, and MD, with a performance comparable to ESRM. Therefore, the subsequent robustness experiments focused exclusively on ESRM. Our results demonstrate that the proposed method exhibits superior robustness against preprocessing operations, such as downsampling and common corruptions, applied by attackers before generating adversarial examples. It is also applicable to various target models. By exploiting semantic conflicts in high-level features between clean and adversarial examples with the same predicted label, the method achieves high detection accuracy across diverse attack types while maintaining resilience to preprocessing, providing a valuable new perspective in the design of adversarial example detection algorithms.

DNNs are highly vulnerable to adversarial examples (AEs). To achieve high transferability, traditional AEs often introduce unnatural artifacts that are easily perceptible to the human eye. Unrestricted attacks have emerged as a promising paradigm to generate more natural unrestricted adversarial examples (UAEs). However, existing UAEs struggle to balance visual fidelity and black-box transferability. Color-based attacks produce noticeable unnatural visual mutations, and diffusion-based attacks transfer poorly to unknown black-box models. We observe that directly injecting unconstrained random perturbations into the diffusion latent space destroys the normal distribution of data, thereby causing a distribution shift. Distribution shifts degrade adversarial perturbations into invalid noise and cause surrogate model overfitting. Furthermore, introducing elastic deformation during the denoising process forces surrogate models to focus on highly transferable features. As a result, we propose an unrestricted attack based on deformation-constrained diffusion, called DeDiAttack. Our method utilizes the manifold prior knowledge of diffusion models to translate elastic deformations into smooth fluid changes. The mechanism effectively eliminates unnatural artifacts and generates highly natural and transferable UAEs. Extensive black-box experiments demonstrate that DeDiAttack outperforms existing attacks and improves the black-box transferability of generated UAEs by 7.2% on the ViT-B surrogate model. The proposed method also provides a useful robustness evaluation tool for vision-based sensing and imaging systems.