USAD: Uncertainty-aware Statistical Adversarial Detection

# 1 Introduction
Source: [https://arxiv.org/html/2606.27832](https://arxiv.org/html/2606.27832)
marginparsep has been altered\. topmargin has been altered\. marginparpush has been altered\. The page layout violates the ICML style\.Please do not change the page layout, or include packages like geometry, savetrees, or fullpage, which change it for you\. We’re not able to reliably undo arbitrary changes to the style\. Please remove the offending package\(s\), or layout\-changing commands and try again\.

USAD: Uncertainty\-aware Statistical Adversarial Detection

Zhijian Zhou\*1Xunye Tian\*1Jiacheng Zhang\*1Zesheng Ye1

Yiyi Guo1Donghao Zhang1Liuhua Peng1Feng Liu1

††footnotetext:\*Equal contribution1The University of Melbourne\. Correspondence to: Feng Liu <fengliu\.ml@gmail\.com\>, Zesheng Ye <zesheng\.ye@unimelb\.edu\.au\>\.
ICML 2026 Workshop on Hypothesis Testing, Seoul, South Korea, 2026\. Copyright 2026 by the author\(s\)\.###### Abstract

*Statistical adversarial detection*\(SAD\) treats detection as a two\-sample test\. Given a reference set of clean examples \(CEs\) and a batch of queries, potentially containing an unknown mixture of CEs and adversarial examples \(AEs\), SAD decides whether the query distribution drifts away from the CE distribution while controlling the false\-alarm rate\. Existing SAD\-based methods mainly use*maximum mean discrepancy*\(MMD\) to measure the distributional discrepancy\. However, MMD’s distributional properties limit its ability to capture characteristic uncertainty patterns of AEs that are crucial for detection: AEs typically exhibit abnormal feature spread \(i\.e\., global uncertainty\) and instability under perturbations \(i\.e\., local uncertainty\)\. To close the gap, we propose*Uncertainty\-aware Statistical Adversarial Detection*\(USAD\), which explicitly captures these uncertainty patterns with two new statistics: \(1\)VarianceDiscrepancy\(VD\), which measures the difference in feature spread between AEs and CEs to capture global uncertainty differences, and \(2\)Perturbation\-basedCovarianceDiscrepancy\(PCD\), which compares feature covariance under Gaussian perturbations to capture local uncertainty differences\. By aggregating VD and PCD, USAD achieves superior detection performances over baseline methods against various adversarial attacks, highlighting the importance of considering characteristic behaviors of AEs for effective SAD\. Our code is available at:[https://github\.com/tmlr\-group/USAD](https://github.com/tmlr-group/USAD)\.

Defending against*adversarial examples*\(AEs\) remains a long\-standing challenge in deep learning\(Szegedy et al\.,[2014](https://arxiv.org/html/2606.27832#bib.bib49); Goodfellow et al\.,[2015](https://arxiv.org/html/2606.27832#bib.bib18); Madry et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib38); Carlini & Wagner,[2017b](https://arxiv.org/html/2606.27832#bib.bib6); Zhang et al\.,[2019](https://arxiv.org/html/2606.27832#bib.bib54); Croce & Hein,[2020b](https://arxiv.org/html/2606.27832#bib.bib11); Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17); Cao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib4); Jing et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib29); Zhang et al\.,[2024](https://arxiv.org/html/2606.27832#bib.bib55); Sun et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib48); Han et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib21)\)\. The most lightweight defense against adversarial attacks is adversarial detection, which identifies AEs in input data before they reach target systems\(Ma et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib37); Deng et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib13); Zhang et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib57); Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\. Existing methods often consider adversarial detection as a binary classification task\(Ma et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib37); Deng et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib13); Zhang et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib57)\)\. They typically train a binary detector tailored to specific classifiers or attack types, which limits the effectiveness against unknown attacks\(Tramèr,[2022](https://arxiv.org/html/2606.27832#bib.bib50); Bryniarski et al\.,[2022](https://arxiv.org/html/2606.27832#bib.bib3)\)\. Although a study leverages diffusion models\(Song & Ermon,[2019](https://arxiv.org/html/2606.27832#bib.bib46); Song et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib47); Huang et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib27)\)to remove such dependency\(Zhang et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib57)\), it is vulnerable to diffusion\-based adaptive attacks\(Xue et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib52); Kang et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib30)\)\. These limitations motivate us to pursue a model\- and attack\-agnostic detection framework\.

*Statistical adversarial detection*\(SAD\) offers a complementary direction by formulating adversarial detection as a two\-sample hypothesis test: given a reference pool of CEs and a set of queries, SAD asks whether the querydistributionhas drifted away from the clean one \(see Section[2\.1](https://arxiv.org/html/2606.27832#S2.SS1)for formal setup\)\. Concretely, the defender needs to maintain a reference setXXof CEs and, for a windowYYof incoming queries, compute a test statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)that measures their distributional discrepancy\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\. A permutation test then determines a thresholdtαt\_\{\\alpha\}such thatPr⁡\(T​\(X,Y\)\>tα\|Y is clean\)≤α\\Pr\(T\(X,Y\)\>t\_\{\\alpha\}\|\\text\{Y is clean\}\)\\leq\\alpha, providing guarantees on statistically\-controlled Type\-I error, which is often desired in high\-stakes contexts\. Operationally, this corresponds to maintaining a queue of recent queries and running tests whenever a window has accumulated, or in a sliding\-window over the stream; each such window may contain anunknown mixtureof CEs and AEs\(Zhang et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib56)\)\. This way SAD acts as a statistical monitoring layer: once a query set is flagged as suspicious, the defending system can trigger other defenses or route the traffic for human inspection, all while keeping the rate of spurious alarms under control\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\. See Appendix[A](https://arxiv.org/html/2606.27832#A1)for further discussions on the practicality of SAD\.

![Refer to caption](https://arxiv.org/html/2606.27832v1/x1.png)\(a\)Distribution of MMD values for AE batch sizes\.
![Refer to caption](https://arxiv.org/html/2606.27832v1/x2.png)\(b\)MMD–variance relationship for CE and AE batches\.

Figure 1:Statistical characteristics of MMD\-based SAD using semantic features\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\.\(a\):Kernel density estimates of MMD values for three AE batch sizes \(n=\{20,50,100\}n=\\\{20,50,100\\\}\)\. The vertical dashed line denotes the test threshold\. The shaded regions to the right of the threshold indicate detection power, quantified by the area percentages shown in the legend \(91\.43% forn=100n=100, 78\.21% forn=50n=50, and 59\.30% forn=20n=20\)\. It clearly illustrates that MMD\-based SAD exhibits diminishing detection power as the batch size decreases\.\(b\):Sensitivity of MMD to uncertainty differences between AEs \(red crosses\) and CEs \(blue circles\), with projections onto the x\- and y\-axes for comparison\. Despite the markedly higher variance of AEs and their clear separation from CEs, the MMD values exhibit substantial overlap along the y\-axis, indicating the insensitivity of MMD\-based SAD to variance differences\.Current SAD mainly use*maximum mean discrepancy*\(MMD\)\(Gretton et al\.,[2012](https://arxiv.org/html/2606.27832#bib.bib19)\)as the test statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17); Zhang et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib56)\)\. They have shown strong performance againstunknownand evenadaptiveattacks, while inheriting rigorous false\-alarm control\. However, existing MMD\-based SAD methods aresample\-inefficient: they often require query windows with a sufficiently large sample size \(and non\-trivial fraction AE\) for thetest statisticto reliably identify the distributional discrepancy with high test power\. As Figure[1\(a\)](https://arxiv.org/html/2606.27832#S1.F1.sf1)shows, we confirm that the test power of MMD\-based SAD degrades rapidly as the window size of queries shrinks\. This limits practical deployment, as waiting for large query sets is often unrealistic and attack volume is inherently uncontrollable\.

To understand this limitation, we examine which distributional properties thetest statisticcaptures\. Since MMD captures mean\-embedding shifts \(see Eq\. \([2\.1](https://arxiv.org/html/2606.27832#S2.Ex1)\)\), we hypothesize that it is insensitive to geometric properties, such as feature spread\(Ma et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib37)\)and local instability\(Li et al\.,[2019](https://arxiv.org/html/2606.27832#bib.bib35)\), that distinguish AEs from CEs\. These geometric cues are closely related to*uncertainty*: AEs often reside near decision boundaries and exhibit higher feature variance and predictive uncertainty than CEs\(Feinman et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib16)\)\. To validate this hypothesis, we test whether MMD captures AE–CE uncertainty differences, using*variance*as the uncertainty measure\. As shown in Figure[1\(b\)](https://arxiv.org/html/2606.27832#S1.F1.sf2), CE and AE MMD values largely overlap despite substantial variance differences, indicating that MMD is insensitive to this uncertainty measurement\. This finding reveals a fundamental mismatch:*MMD is not tailored for SAD, and therefore, MMD\-based SAD methods are insensitive to distinguish AEs from CEs when AEs display their characteristic uncertainty patterns rather than mean embedding shifts\.*This motivates new*test statistics*directly sensitive to AE uncertainty patterns\.

To close the gap, this paper proposes*Uncertainty\-awareStatisticalAdversarialDetection*\(USAD\), which explicitly accounts for two well\-established uncertainty\-induced patterns, namely \(1\) AEs are displaced off the clean data manifold, causing abnormal spread in their semantic feature distributions\(Feinman et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib16); Ma et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib37)\)\(i\.e\.,*global uncertainty*\), and \(2\) norm\-bounded AEs are generated by small perturbations that cross local decision boundariesMoosavi\-Dezfooli et al\. \([2016](https://arxiv.org/html/2606.27832#bib.bib39)\); Fawzi et al\. \([2016](https://arxiv.org/html/2606.27832#bib.bib15)\)and often exploit brittle non\-robust featuresIlyas et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib28)\), leading to atypical local response patterns under added perturbationsHuang et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib26)\); Roth et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib43)\)\(i\.e\.,*local uncertainty*\), with two newtest statistics: \(1\)*VarianceDiscrepancy*\(VD\), which measures the difference in feature spread between AEs and CEs \(see Section[3\.1](https://arxiv.org/html/2606.27832#S3.SS1)\), and \(2\)*Perturbation\-basedCovarianceDiscrepancy*\(PCD\), which compares feature covariance under Gaussian perturbations to capture local stability differences \(see Section[3\.2](https://arxiv.org/html/2606.27832#S3.SS2)\)\. VD is designed to capture*global uncertainty differences*arising from manifold displacement, whereas PCD seeks to capture*local uncertainty differences*induced by perturbation sensitivity\. To capture both global and local uncertainty differences, we followZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\)and aggregate VD and PCD while accounting for their mutual dependencies \(see Section[4](https://arxiv.org/html/2606.27832#S4)\)\. The false alarm rate of USAD is theoretically controlled \(see Section[5](https://arxiv.org/html/2606.27832#S5)\)\.

Section[6](https://arxiv.org/html/2606.27832#S6)evaluates the effectiveness of USAD on benchmark image datasets such as CIFAR\-10\(Krizhevsky et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib33)\)and ImageNet\-1K\(Deng et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib12)\)\. Specifically, USAD*consistently*outperforms baseline SAD methods by a notable margin against various unseen adversarial attacks under different threat models, including different norms \(e\.g\.,ℓ∞\\ell\_\{\\infty\}andℓ2\\ell\_\{2\}\), perturbation budgets \(e\.g\.,ϵ\\epsilonfrom8/2558/255to1/2551/255\), batch sizes \(e\.g\., from 80 to 10\), and ratio of AEs in the query batch \(e\.g\., from100%100\\%to20%20\\%\)\. Notably, even with a query batch size as small as\|Y\|=10\|Y\|=10, our method achieves test power essentially equal to 1 atϵ=4/255\\epsilon=4/255, outperforming baselines by at least 24\.8%\. This marks a substantial step toward overcoming the sample\-size limitations that constrain detection power in hypothesis\-testing\-based methods\. More importantly, our method remains robust against a well\-designed adaptive attack\.

Our contributions are: \(1\) We identify that MMD\-based SADs fail to capture the distributional uncertainty differences crucial for distinguishing AEs from CEs; \(2\) To address this, we propose*Uncertainty\-awareStatisticalAdversarialDetection*\(USAD\) with new test statistics, i\.e\.,*VarianceDiscrepancy*\(VD\) and*Perturbation\-basedCovarianceDiscrepancy*\(PCD\), to explicitly capture*global*and*local*uncertainty differences between AEs and CEs; \(3\) Theoretically, we prove that USAD guarantees valid false\-alarm rate control\. Empirically, we show that USAD consistently outperforms strong baseline methods across diverse unseen, transfer, and adaptive attacks, under small query window sizes and when AEs are sparselymixedwith CEs within each query batch\.

## 2Statistical Adversarial Detection

We begin by formalizingstatistical adversarial detection\(SAD\) as a hypothesis testing task for distinguishingadversarial examples\(AEs\) fromclean examples\(CEs\) by measuring their distributional discrepancy \([Section2\.1](https://arxiv.org/html/2606.27832#S2.SS1)\)\. We then identify limitations of existing SAD practices and motivate the need for new measures \([Section2\.2](https://arxiv.org/html/2606.27832#S2.SS2)\)\.

### 2\.1Detecting AEs from a Statistical Perspective

Adversarial Attacks\.The algorithms for generating AEs are commonly referred to as adversarial attacks\(Szegedy et al\.,[2014](https://arxiv.org/html/2606.27832#bib.bib49); Goodfellow et al\.,[2015](https://arxiv.org/html/2606.27832#bib.bib18)\)\. Given a well\-trained classifierf:𝒳→𝒞f:\\mathcal\{X\}\\to\\mathcal\{C\}on a datasetD=\{\(𝒙i,ci\)\}i=1ND=\\\{\(\\bm\{x\}\_\{i\},c\_\{i\}\)\\\}^\{N\}\_\{i=1\}with𝒙i\\bm\{x\}\_\{i\}being a sample from the input space𝒳⊆ℝd\\mathcal\{X\}\\subseteq\\mathbb\{R\}^\{d\}andcic\_\{i\}being its ground\-truth label defined in a label space𝒞\\mathcal\{C\}, an AE𝒚i\\bm\{y\}\_\{i\}regarding𝒙i\\bm\{x\}\_\{i\}with perturbation𝜻i\\bm\{\\zeta\}\_\{i\}can be generated by solving the optimization:

𝒚i=𝒙i\+argmax𝜻iℒ​\(f​\(𝒙i\+𝜻i\),ci\),s\.t\.​‖𝜻i‖p≤ϵ,\\bm\{y\}\_\{i\}=\\bm\{x\}\_\{i\}\+\\operatorname\*\{argmax\}\_\{\\bm\{\\zeta\}\_\{i\}\}\\mathcal\{L\}\(f\(\\bm\{x\}\_\{i\}\+\\bm\{\\zeta\}\_\{i\}\),c\_\{i\}\),\\text\{~s\.t\.~\}\|\|\\bm\{\\zeta\}\_\{i\}\|\|\_\{p\}\\leq\\epsilon,\(1\)whereϵ\\epsilonis the perturbation budget,\|\|⋅\|\|p\|\|\\cdot\|\|\_\{p\}is theℓp\\ell\_\{p\}\-norm \(e\.g\.,ℓ∞\\ell\_\{\\infty\}orℓ2\\ell\_\{2\}\) andℒ\\mathcal\{L\}is an objective function\.

Eq\. \([1](https://arxiv.org/html/2606.27832#S2.E1)\) can be solved by many methods to generate AEs\. For example, the*fast gradient sign method*\(FGSM\) is a one\-step attack that perturbs clean data in the direction of the loss gradient\(Goodfellow et al\.,[2015](https://arxiv.org/html/2606.27832#bib.bib18)\)\. Building on FGSM, the*basic iterative method*\(BIM\) applies iterative perturbations along the gradient direction, updating the input at each step to generate stronger AEs\(Kurakin et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib34)\)\.*Projected gradient descent*\(PGD\) further enhances BIM by introducing random initialization prior to iterative gradient\-based updates\(Madry et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib38)\)\. Beyond non\-targeted attacks, the*Carlini & Wagner*\(C&W\) attack generates targeted AEs by optimizing a carefully designed objective function that explicitly encourages misclassification toward a chosen label\(Carlini & Wagner,[2017b](https://arxiv.org/html/2606.27832#bib.bib6)\)\.*AutoAttack*\(AA\)\(Croce & Hein,[2020b](https://arxiv.org/html/2606.27832#bib.bib11)\)aggregates multiple attacks, which include three non\-targeted white\-box attacks\(Croce & Hein,[2020b](https://arxiv.org/html/2606.27832#bib.bib11),[a](https://arxiv.org/html/2606.27832#bib.bib10)\)and one targeted black\-box attack\(Andriushchenko et al\.,[2020](https://arxiv.org/html/2606.27832#bib.bib1)\), which makes AA widely adopted for evaluating adversarial robustness\.

SAD Problem Setup\.Given a reference set of CEsX=\{𝒙j\}i=1n∼ℙX=\\\{\\bm\{x\}\_\{j\}\\\}\_\{i=1\}^\{n\}\\sim\\mathbb\{P\}and a query setY=\{𝒚j\}j=1mY=\\\{\\bm\{y\}\_\{j\}\\\}\_\{j=1\}^\{m\}drawn from some distributionℚ\\mathbb\{Q\}, we aim to decide whether the queriesYYfollow the same distribution as CEs\. Under the null hypothesis𝑯0\\bm\{H\}\_\{0\},allqueries are clean andℙ=ℚ\\mathbb\{P\}=\\mathbb\{Q\}\. Under the alternative𝑯1\\bm\{H\}\_\{1\}, at least anon\-zero fractionof queries inYYare AEs generated byunseenadversarial attacks againstff\. SAD therefore tests

𝑯0:ℙ=ℚand𝑯1:ℙ≠ℚ,\\bm\{H\}\_\{0\}:\\mathbb\{P\}=\\mathbb\{Q\}\\ \\ \\ \\text\{and\}\\ \\ \\ \\bm\{H\}\_\{1\}:\\mathbb\{P\}\\neq\\mathbb\{Q\},\(2\)and reject𝑯0\\bm\{H\}\_\{0\}at significance levelα\\alphawhen the chosentest statisticexceeds a threshold, providing Type\-I control\. Here, Type\-I error means falsely declaring a clean query set as adversarial\.

SAD as Hypothesis Test\.The SAD starts from designing atest statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)to measure the discrepancy betweenℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}\(by observingXXandYY\)\. At a chosen levelα\\alpha,𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)is then compared against atesting thresholdtαt\_\{\\alpha\}defined as the\(1−α\)\(1\-\\alpha\)\-quantile of thenull distribution, which characterizes the sampling behavior of𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)under𝑯0\\bm\{H\}\_\{0\}, satisfyingPr⁡\(𝒯​\(X,Y\)\>tα\|𝑯0\)=α\\Pr\(\\mathcal\{T\}\(X,Y\)\>t\_\{\\alpha\}\|\\bm\{H\}\_\{0\}\)=\\alpha\. It means that𝑯0\\bm\{H\}\_\{0\}is rejected \(i\.e\., declareYYadversarial\) if𝒯​\(X,Y\)\>tα\\mathcal\{T\}\(X,Y\)\>t\_\{\\alpha\}\.

As the null distribution is rarely known analytically, we typically estimatetαt\_\{\\alpha\}using apermutation test, which builds an empirical null distribution by randomly re\-partitioning the pooled examplesX∪YX\\cup Yinto new sets\(X\(r\),Y\(r\)\)\(X\_\{\(r\)\},Y\_\{\(r\)\}\), and computing𝒯​\(X\(r\),Y\(r\)\)\\mathcal\{T\}\(X\_\{\(r\)\},Y\_\{\(r\)\}\)for each permutationr=1,…,Rr=1,\\dots,R\. The empirical thresholdtαt\_\{\\alpha\}is then set to the adjusted\(1−α\)\(1\-\\alpha\)\-quantile of these permuted statistic values, ensuring the probability of falsely rejecting𝑯0\\bm\{H\}\_\{0\}is controlled at the chosen levelα\\alpha\(see Appendix[B](https://arxiv.org/html/2606.27832#A2)for details\)\.

MMD as Test Statistic\.Critically, the effectiveness of SAD relies on whether the chosen test statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)can capture the distributional discrepancy ifXXindeed comes from a distribution different fromYY\(i\.e\.,ℙ≠ℚ\\mathbb\{P\}\\neq\\mathbb\{Q\}\)\. Existing SAD practices\(Grosse et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib20); Carlini & Wagner,[2017a](https://arxiv.org/html/2606.27832#bib.bib5); Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17); Zhang et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib56)\)have predominantly employed the MMD\(Gretton et al\.,[2012](https://arxiv.org/html/2606.27832#bib.bib19)\), which measures the distance betweenℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}by mapping their elements to a*reproducing kernel Hilbert space*\(RKHS\) and comparing thekernel mean embeddings\(Muandet et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib41)\)therein\. Formally, for a characteristic kernelκ:𝒳×𝒳→ℝ\\kappa:\\mathcal\{X\}\\times\\mathcal\{X\}\\to\\mathbb\{R\}with RKHSℋκ\\mathcal\{H\}\_\{\\kappa\}and its corresponding mapκ​\(⋅,𝒙\)∈ℋκ\\kappa\(\\cdot,\\bm\{x\}\)\\in\\mathcal\{H\}\_\{\\kappa\}, we have the kernel mean embeddings ofℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}given by𝝁ℙ=E𝒙∼ℙ​\[κ​\(⋅,𝒙\)\]\\bm\{\\mu\}\_\{\\mathbb\{P\}\}=E\_\{\\bm\{x\}\\sim\\mathbb\{P\}\}\[\\kappa\(\\cdot,\\bm\{x\}\)\]and𝝁ℚ=E𝒚∼ℚ​\[κ​\(⋅,𝒚\)\]\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}=E\_\{\\bm\{y\}\\sim\\mathbb\{Q\}\}\[\\kappa\(\\cdot,\\bm\{y\}\)\], respectively\. The MMD\-based SAD\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17); Zhang et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib56)\)then instantiates Eqn\.\([2](https://arxiv.org/html/2606.27832#S2.E2)\) on testing the equality of such embeddings, namely𝑯0M:𝝁ℙ=𝝁ℚ\\bm\{H\}\_\{0\}^\{\\text\{M\}\}:\\bm\{\\mu\}\_\{\\mathbb\{P\}\}=\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}versus𝑯1M:𝝁ℙ≠𝝁ℚ\\bm\{H\}\_\{1\}^\{\\text\{M\}\}:\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\\neq\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}via squared distance between𝝁ℙ\\bm\{\\mu\}\_\{\\mathbb\{P\}\}and𝝁ℚ\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}:

MMD2​\(ℙ,ℚ,κ\)\\displaystyle\\textnormal\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\},\\kappa\)≜\\displaystyle\\triangleq‖𝝁ℙ−𝝁ℚ‖ℋκ2\\displaystyle\\\|\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\-\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\\|\_\{\\mathcal\{H\}\_\{\\kappa\}\}^\{2\}=\\displaystyle=E​\[κ​\(𝒙,𝒙′\)\+κ​\(𝒚,𝒚′\)−2​κ​\(𝒙,𝒚\)\],\\displaystyle E\[\\kappa\(\\bm\{x\},\\bm\{x\}^\{\\prime\}\)\+\\kappa\(\\bm\{y\},\\bm\{y\}^\{\\prime\}\)\-2\\kappa\(\\bm\{x\},\\bm\{y\}\)\],where𝒙,𝒙′∼i\.i\.d\.ℙ\\bm\{x\},\\bm\{x\}^\{\\prime\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{P\},𝒚,𝒚′∼i\.i\.d\.ℚ\\bm\{y\},\\bm\{y\}^\{\\prime\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{Q\}, and∥⋅∥ℋκ2=⟨⋅,⋅⟩ℋκ\\\|\\cdot\\\|\_\{\\mathcal\{H\}\_\{\\kappa\}\}^\{2\}=\\langle\\cdot,\\cdot\\rangle\_\{\\mathcal\{H\}\_\{\\kappa\}\}defines the inner product in RKHSℋκ\\mathcal\{H\}\_\{\\kappa\}\. In practice, we empirically estimateMMD2​\(ℙ,ℚ,κ\)\\textnormal\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\},\\kappa\)with samplesXXandYY, using unbiased U\-statisticsGretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\)\(Appendix[C](https://arxiv.org/html/2606.27832#A3)\)\. Recently, SAMMDGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\)showed that applying MMD to semantic features from the target classifierff, combined with propertesting threshold, can elevate the detection power of MMD\-based SAD\.

### 2\.2SAD Needs Uncertainty\-Aware Statistics

When MMD\-based SAD Fails\.Despite maintaining Type\-I error control, MMD\-based SAD methods exhibit diminishing power as query size\|Y\|\|Y\|decreases \(Fig\.[1\(a\)](https://arxiv.org/html/2606.27832#S1.F1.sf1)\)\. Such small\-sample weakness is problematic for SAD: practical defense requires early detection when only a few query examples have been observed\. It is often unrealistic to wait for large query sets to accumulateZhang et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib56)\)\. Moreover, this degradation persists even with carefully tuned kernel embeddings and thresholdsGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\), implying that the bottleneck is not merely kernel choice or threshold but in which distributional properties thetest statisticitself targets\.

MMD \(and its variant SAMMD\), by construction, is most sensitive to mean shifts‖𝝁ℙ−𝝁ℚ‖ℋκ2\\\|\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\-\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\\|\_\{\\mathcal\{H\}\_\{\\kappa\}\}^\{2\}, capturing where distributions are centered \(i\.e\., first\-order moments\) in the RKHSℋκ\\mathcal\{H\}\_\{\\kappa\}, yet providing less information about their internal structures, such as spread and local geometry\(Harchaoui et al\.,[2008](https://arxiv.org/html/2606.27832#bib.bib22); Zhou et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib59)\)\. These second\-order properties, however, are precisely where adversarial attacks leave strong artifacts that can be valuable in distinguishing AEs\.

Adversarial Artifacts as Distributional Uncertainty\.AEs result from solving \([1](https://arxiv.org/html/2606.27832#S2.E1)\), where adversarial perturbations are crafted to enforce AEs to cross target classifierff’s decision boundaries\. This exploits two geometric properties, leading to two well\-established characteristic behaviors of AEs:

###### Factor 1\(Global Uncertainty from Manifold Displacement\)\.

AEs are systematically pushed off clean data manifoldFeinman et al\. \([2017](https://arxiv.org/html/2606.27832#bib.bib16)\)\. This displacement alters the spread of AEs’ semantic feature distributionMa et al\. \([2018](https://arxiv.org/html/2606.27832#bib.bib37)\)\. Consequently, AEs may become more or less dispersed than CEs, without necessarily shifting the mean embedding, reflecting a shift in theglobal uncertaintyover the distribution\.

###### Factor 2\(Local Uncertainty from Perturbation Sensitivity\)\.

AEs tend to reside near classifierff’s decision boundaries and exploit non\-robust featuresMoosavi\-Dezfooli et al\. \([2016](https://arxiv.org/html/2606.27832#bib.bib39)\); Ilyas et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib28)\), making them sensitive to local isotropic perturbations\. Under random Gaussian noises, AEs show larger and more directionally varied feature changes than CEsLi et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib35)\)\. This instability marks elevatedlocal uncertaintyat individual examples\.

Bridging the Gap\.These findings suggest a practical sensitivity gap in existing MMD\-based SAD methods\. MMD compares distributions through differences between their kernel mean embeddings, which can be viewed as first\-order moment differences in the chosen RKHS\. Although a characteristic kernel enables MMD, in principle, to distinguish any two distributions, its finite\-sample power still depends on the kernel choice and on how strongly a particular distributional change is reflected in the empirical mean\-embedding difference\. Consequently, existing MMD\-based detectors may be less effective when adversarial artifacts appear as second\-order structural changes \(i\.e\., uncertainty pattern shifts\) without substantially moving mean embeddings of AEs\. This calls for new discrepancy measures that are directly sensitive to these changes in distributional uncertainty caused by adversarial attacks\. We introduce two suchtest statisticsto close the gap\.

## 3Uncertainty\-Aware Test Statistics

We now developtest statisticsthat target how adversarial perturbations affect uncertainty in the classifierff’s semantic feature space identified in[Section2](https://arxiv.org/html/2606.27832#S2)\.

For clarity, we denotef​\(⋅\)∈ℱ⊆ℝqf\(\\cdot\)\\in\\mathcal\{F\}\\subseteq\\mathbb\{R\}^\{q\}as semantic features of an input⋅∈𝒳\\cdot\\in\\mathcal\{X\}extracted byff, whereℱ\\mathcal\{F\}is aqq\-dimensional semantic feature space \(often from the penultimate layer offf\)\.[Section3\.1](https://arxiv.org/html/2606.27832#S3.SS1)introducesvariance discrepancy\(VD\) that quantifiesglobal uncertaintyby comparing within\-distribution variances, detecting altered concentration in query distributionℚ\\mathbb\{Q\}relative to clean distributionℙ\\mathbb\{P\}\.[Section3\.2](https://arxiv.org/html/2606.27832#S3.SS2)introducesperturbation\-based covariance discrepancy\(PCD\) that measures whether query examples \(suspected to be AEs\) exhibit higherlocal uncertaintyto small, random isotropic noise compared to CEs, encoded by Gaussian\-noise\-induced covariance at each example\.

![Refer to caption](https://arxiv.org/html/2606.27832v1/x3.png)

Figure 2:Uncertainty\-awareStatisticalAdversarialDetection\(USAD\)\. The semantic features of CEsX∼ℙX\\sim\\mathbb\{P\}and queriesY∼ℚY\\sim\\mathbb\{Q\}\(suspected AEs\) are extracted by using the penultimate layer of classifierff\. From these features, USAD estimates \(i\)variance discrepancy\(VD\) measuring shifts in feature\-spread betweenXXandYYand \(ii\)perturbation\-based covariance discrepancy\(PCD\) comparing their covariance mean\-embeddings under Gaussian perturbations\. These VD and PCD statistics are adaptively aggregated viacorrelation\-aware weightinginto a singletest statistic, and apermutation testdetermines, at levelα\\alpha, whetherYYis adversarial\.### 3\.1Variance Discrepancy

Global Uncertainty as Variance\.We quantify the variance of semantic features within\-distribution to detect whetherYY’s features spread differently from those ofXXin the RKHS\. Letℓ:ℱ×ℱ→ℝ\\ell:\\mathcal\{F\}\\times\\mathcal\{F\}\\rightarrow\\mathbb\{R\}be a kernel with RKHSℋℓ\\mathcal\{H\}\_\{\\ell\}\(which also defines mapℓ​\(⋅,f​\(𝒙\)\)∈ℋℓ\\ell\(\\cdot,f\(\\bm\{x\}\)\)\\in\\mathcal\{H\}\_\{\\ell\}\)\. For distributionsℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}, the semantic feature variances are

Vℙ\\displaystyle V\_\{\\mathbb\{P\}\}≜E𝒙∼ℙ​\[ℓ​\(f​\(𝒙\),f​\(𝒙\)\)\]−E𝒙,𝒙′∼ℙ2​\[ℓ​\(f​\(𝒙\),f​\(𝒙′\)\)\],\\displaystyle\\triangleq E\_\{\\bm\{x\}\\sim\\mathbb\{P\}\}\\left\[\\ell\(f\(\\bm\{x\}\),f\(\\bm\{x\}\)\)\\right\]\-E\_\{\\bm\{x\},\\bm\{x\}^\{\\prime\}\\sim\\mathbb\{P\}^\{2\}\}\[\\ell\(f\(\\bm\{x\}\),f\(\\bm\{x\}^\{\\prime\}\)\)\],Vℚ\\displaystyle V\_\{\\mathbb\{Q\}\}≜E𝒚∼ℚ​\[ℓ​\(f​\(𝒚\),f​\(𝒚\)\)\]−E𝒚,𝒚′∼ℚ2​\[ℓ​\(f​\(𝒚\),f​\(𝒚′\)\)\]\.\\displaystyle\\triangleq E\_\{\\bm\{y\}\\sim\\mathbb\{Q\}\}\\left\[\\ell\(f\(\\bm\{y\}\),f\(\\bm\{y\}\)\)\\right\]\-E\_\{\\bm\{y\},\\bm\{y\}^\{\\prime\}\\sim\\mathbb\{Q\}^\{2\}\}\[\\ell\(f\(\\bm\{y\}\),f\(\\bm\{y\}^\{\\prime\}\)\)\]\.The first term ofVℙV\_\{\\mathbb\{P\}\}establishes the self\-similarity of examples withinℙ\\mathbb\{P\}, while the second captures their pairwise similarity\. Thus, smallVℙV\_\{\\mathbb\{P\}\}indicates tight clustering, while largeVℙV\_\{\\mathbb\{P\}\}reflects greater dispersion \(likewise forVℚV\_\{\\mathbb\{Q\}\}\)\.

Test\.We formalize the comparison of variancesVℙV\_\{\\mathbb\{P\}\}andVℚV\_\{\\mathbb\{Q\}\}by instantiating Eq\.\([2](https://arxiv.org/html/2606.27832#S2.E2)\) as the following hypothesis test:

𝑯0V:Vℙ=Vℚvs\.𝑯1V:Vℙ≠Vℚ,\\bm\{H\}^\{\\textnormal\{V\}\}\_\{0\}:V\_\{\\mathbb\{P\}\}=V\_\{\\mathbb\{Q\}\}\\quad\\text\{vs\.\}\\quad\\bm\{H\}^\{\\textnormal\{V\}\}\_\{1\}:V\_\{\\mathbb\{P\}\}\\neq V\_\{\\mathbb\{Q\}\}\\ ,\(4\)withtest statisticdefined as thevariance discrepancyVD​\(ℙ,ℚ;ℓ\)=\(Vℙ−Vℚ\)2\\textnormal\{VD\}\(\\mathbb\{P\},\\mathbb\{Q\};\\ell\)=\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)^\{2\}betweenℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}\.

Estimator\.Sinceℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}are analytically unknown, we empirically estimateVD​\(ℙ,ℚ;ℓ\)\\textnormal\{VD\}\(\\mathbb\{P\},\\mathbb\{Q\};\\ell\)usingXXandYY, such that

VD^​\(X,Y;ℓ\)=\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)\)2,\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)=\\left\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\\right\)^\{2\}\\ ,\(5\)where forZ∈\{X,Y\}Z\\in\\\{X,Y\\\}, we define

V^​\(Z;ℓ\)=∑𝒛∈Zℓ​\(f​\(𝒛\),f​\(𝒛\)\)\|Z\|−∑𝒛i≠𝒛jZℓ​\(f​\(𝒛i\),f​\(𝒛j\)\)\|Z\|​\(\|Z\|−1\)\.\\widehat\{V\}\(Z;\\ell\)=\\sum\_\{\\bm\{z\}\\in Z\}\\frac\{\\ell\(f\(\\bm\{z\}\),f\(\\bm\{z\}\)\)\}\{\|Z\|\}\-\\sum\_\{\\bm\{z\}\_\{i\}\\neq\\bm\{z\}\_\{j\}\}^\{Z\}\\frac\{\\ell\(f\(\\bm\{z\}\_\{i\}\),f\(\\bm\{z\}\_\{j\}\)\)\}\{\|Z\|\(\|Z\|\-1\)\}\\ \.\\\\IfVD^​\(X,Y;ℓ\)\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)exceeds thethresholdestimated viapermutation test, we considerℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}to be significantly different\.

This way VD completes our response to[1](https://arxiv.org/html/2606.27832#Thmfactor1): it detects uncertainty shifts at thegloballevel, comparing how tightlyℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}concentrate across their support in the RKHS\. Next, we will examinelocaluncertainty shifts\-how features fluctuate around individual examples under small, isotropic perturbations, which differ between CEs and AEs as noted in[2](https://arxiv.org/html/2606.27832#Thmfactor2)\)\. This motivates a perturbation\-based covariance comparison that complements VD\.

### 3\.2Perturbation\-based Covariance Discrepancy

Recall that CEs often show consistent responses to isotropic perturbationsCohen et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib9)\), while AEs are constructed to be near the decision boundaries offf\(to cause mis\-classification\)Moosavi\-Dezfooli et al\. \([2016](https://arxiv.org/html/2606.27832#bib.bib39),[2018](https://arxiv.org/html/2606.27832#bib.bib40)\); Ilyas et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib28)\)\. Accordingly, AEs are expected to exhibit less stable feature responses to even small perturbations, especially in directions that matter forff’s decisions, indicating higher local sensitivity than CEs\(Li et al\.,[2019](https://arxiv.org/html/2606.27832#bib.bib35)\)\.

Local Uncertainty as Perturbation\-Induced\-Covariance\.To probe local sensitivity, we specifically compare the distributions of per‑example feature covariances under isotropic Gaussian noises\. For each example𝒙∈𝒳\\bm\{x\}\\in\\mathcal\{X\}, we drawKKrandom perturbations\{𝜹i\}k=1K∼i\.i\.d\.𝒩​\(𝟎,σ2​I\)\\\{\\bm\{\\delta\}\_\{i\}\\\}\_\{k=1\}^\{K\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathcal\{N\}\(\\bm\{0\},\\sigma^\{2\}I\), extract features\{f​\(𝒙\+𝜹i\)\}k=1K\\\{f\(\\bm\{x\}\+\\bm\{\\delta\}\_\{i\}\)\\\}\_\{k=1\}^\{K\}, and compute the covariance matrix of𝒙\\bm\{x\}:

Σ𝒙=1K−1​∑k=1K\(f​\(𝒙\+𝜹k\)−f𝒙¯\)​\(f​\(𝒙\+𝜹k\)−f𝒙¯\)⊤,\\Sigma\_\{\\bm\{x\}\}=\\frac\{1\}\{K\-1\}\\sum\_\{k=1\}^\{K\}\(f\(\\bm\{x\}\+\\bm\{\\delta\}\_\{k\}\)\-\\overline\{f\_\{\\bm\{x\}\}\}\)\(f\(\\bm\{x\}\+\\bm\{\\delta\}\_\{k\}\)\-\\overline\{f\_\{\\bm\{x\}\}\}\)^\{\\top\},\(6\)wheref𝒙¯≜k−1​∑i=1kf​\(𝒙\+𝜹i\)\\overline\{f\_\{\\bm\{x\}\}\}\\triangleq k^\{\-1\}\\sum\_\{i=1\}^\{k\}f\(\\bm\{x\}\+\\bm\{\\delta\}\_\{i\}\)\. The covariance matrixΣ𝒙\\Sigma\_\{\\bm\{x\}\}encodeslocal uncertaintyvia its eigenstructure: large eigenvalues indicate directions where features vary substantially under Gaussian perturbation, small eigenvalues indicate stabilityZhang et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib57)\); Yang et al\. \([2022](https://arxiv.org/html/2606.27832#bib.bib53)\)\.

Test\.To compare differences inlocal uncertainty\(as distributional discrepancy\) betweenℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}, we instantiate Eq\.\([2](https://arxiv.org/html/2606.27832#S2.E2)\) regarding the perturbation–induced covariance embeddings by testing the equality of the corresponding kernel mean embeddings with null and alternative hypotheses as:

𝑯0C:𝝁Σℙ=𝝁Σℚvs\.𝑯1C:𝝁Σℙ≠𝝁Σℚ,\\bm\{H\}^\{\\textnormal\{C\}\}\_\{0\}:\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}=\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}\\ \\ \\ \\text\{vs\.\}\\ \\ \\ \\bm\{H\}^\{\\textnormal\{C\}\}\_\{1\}:\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}\\neq\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}\\ ,\(7\)where𝝁Σℙ≜E𝒙∼ℙ​\[ρ​\(Σ𝒙,⋅\)\]\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}\\triangleq E\_\{\\bm\{x\}\\sim\\mathbb\{P\}\}\\left\[\\rho\(\\Sigma\_\{\\bm\{x\}\},\\cdot\)\\right\]and𝝁Σℚ≜E𝒚∼ℚ​\[ρ​\(Σ𝒚,⋅\)\]\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}\\triangleq E\_\{\\bm\{y\}\\sim\\mathbb\{Q\}\}\\left\[\\rho\(\\Sigma\_\{\\bm\{y\}\},\\cdot\)\\right\]are mean embeddings of the covariance distributions forℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}in the RKHSℋρ\\mathcal\{H\}\_\{\\rho\}111Mathematically, the covariance matrixΣ𝒙∈𝒮\+​\(ℱ\)\\Sigma\_\{\\bm\{x\}\}\\in\\mathcal\{S\}\_\{\+\}\(\\mathcal\{F\}\)defines a positive semi\-definite \(PSD\) covariance operator on the semantic feature spaceℱ\\mathcal\{F\}, with𝒮\+​\(ℱ\)\\mathcal\{S\}\_\{\+\}\(\\mathcal\{F\}\)being the cone of PSD operators onℱ\\mathcal\{F\}\. Thus, the RKHSℋρ\\mathcal\{H\}\_\{\\rho\}where we embedΣ𝒙\\Sigma\_\{\\bm\{x\}\}into and definePCD​\(ℙ,ℚ,ρ\)\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\rho\)is characterized by the kernelρ:𝒮\+​\(ℱ\)×𝒮\+​\(ℱ\)→ℝ\\rho:\\mathcal\{S\}\_\{\+\}\(\\mathcal\{F\}\)\\times\\mathcal\{S\}\_\{\+\}\(\\mathcal\{F\}\)\\rightarrow\\mathbb\{R\}and corresponding mapρ​\(⋅,Σ𝒙\)∈ℋρ\\rho\(\\cdot,\\Sigma\_\{\\bm\{x\}\}\)\\in\\mathcal\{H\}\_\{\\rho\}\.\. We defineperturbation\-based covariance discrepancy\(PCD\) asPCD​\(ℙ,ℚ,ρ\)≜‖𝝁Σℙ−𝝁Σℚ‖ℋρ2\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\rho\)\\triangleq\\\|\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}\-\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}\\\|\_\{\\mathcal\{H\}\_\{\\rho\}\}^\{2\}, which serves astest statistic\. Equivalently,PCD​\(ℙ,ℚ,ρ\)\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\rho\)mirrors Eq\.\([2\.1](https://arxiv.org/html/2606.27832#S2.Ex1)\) but measures the difference between distributions of covariance matrices under kernelρ\\rho\.

Estimator\.In line with Eq\.\([2\.1](https://arxiv.org/html/2606.27832#S2.Ex1)\), we empirically estimatePCD​\(ℙ,ℚ,ρ\)\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\rho\)with finite examplesXXandYY, such that

PCD^​\(X,Y;ρ\)=\\displaystyle\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)=\(8\)∑i≠jn\\displaystyle\\sum\_\{i\\neq j\}^\{n\}ρ​\(Σ𝒙i,Σ𝒙j\)n​\(n−1\)−∑i=1n∑j=1m2​ρ​\(Σ𝒙i,Σ𝒚j\)n​m\+∑i≠jmρ​\(Σ𝒚i,Σ𝒚j\)m​\(m−1\)\.\\displaystyle\\frac\{\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{x\}\_\{j\}\}\)\}\{n\(n\-1\)\}\-\\sum\_\{i=1\}^\{n\}\\sum\_\{j=1\}^\{m\}\\frac\{2\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\}\{nm\}\+\\sum\_\{i\\neq j\}^\{m\}\\frac\{\\rho\(\\Sigma\_\{\\bm\{y\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\}\{m\(m\-1\)\}\.This completes our response to[2](https://arxiv.org/html/2606.27832#Thmfactor2): PCD detects uncertainty shifts betweenℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}at thelocallevel by comparing how semantic features fluctuate under isotropic noise around individual examples\. Together with VD’sglobalspread comparison, we now possess two complementary lenses through which adversarial artifacts manifest as measurable distributional uncertainty signals\.

## 4Making SAD Aware of Local and Global Uncertainty, Adaptively

While VD and PCD quantify complementary uncertainty patterns in the semantic feature space, attacks vary in how strongly they activate each effect: some primarily displace AEs from the clean manifold \(i\.e\., strong VD signal\)\(Feinman et al\.,[2017](https://arxiv.org/html/2606.27832#bib.bib16)\); others tend to exploit local gradients near boundaries \(i\.e\., strong PCD signal\)Ilyas et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib28)\)\. For SAD detection to be effective across diverse attacks, it should adapt to the uncertainty present in the data based on each statistic’s informativeness for the query data rather than treat each statistic uniformly\.

In light of this, we aggregate VD and PCD intoa unified testthat accounts for their joint correlation structureZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\), yielding an adaptive detector sensitive to both global and local adversarial artifacts, termed*Uncertainty\-awareStatisticalAdversarialDetection*\(USAD\)\.

USAD as Hypothesis Test\.Still, USAD instantiates Eq\.\([2](https://arxiv.org/html/2606.27832#S2.E2)\) by testing distributional equality:

𝑯0A:ℙ=ℚvs\.𝑯1A:ℙ≠ℚ,\\bm\{H\}\_\{0\}^\{\\mathrm\{A\}\}:\\ \\mathbb\{P\}=\\mathbb\{Q\}\\quad\\text\{vs\.\}\\quad\\bm\{H\}\_\{1\}^\{\\mathrm\{A\}\}:\\ \\mathbb\{P\}\\neq\\mathbb\{Q\},and defining the corresponding aggregatedtest statisticas

𝒯A​\(X,Y;ℓ,ρ\)=𝒯​\(X,Y;ℓ,ρ\)⊤​Σ^A−1​𝒯​\(X,Y;ℓ,ρ\),\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)=\\mathcal\{T\}\(X,Y;\\ell,\\rho\)^\{\\top\}\\widehat\{\\Sigma\}\_\{\\rm A\}^\{\-1\}\\mathcal\{T\}\(X,Y;\\ell,\\rho\),\(9\)where𝒯​\(X,Y;ℓ,ρ\)≜\(VD^​\(X,Y;ℓ\),PCD^​\(X,Y;ρ\)\)⊤\\mathcal\{T\}\(X,Y;\\ell,\\rho\)\\triangleq\\left\(\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\),\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)\\right\)^\{\\top\}andΣ^A\\widehat\{\\Sigma\}\_\{\\rm A\}denotes the correlation between the VD and PCD\.

Weighted Statistics Aggregation\.𝒯A​\(X,Y;ℓ,ρ\)\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)combines both globalVD^​\(X,Y;ℓ\)\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)and local uncertainty shifts measurePCD^​\(X,Y;ρ\)\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\), followingcorrelation\-awarestatistics ensemblingZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\), with the key idea to weightVD^​\(X,Y;ℓ\)\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)andPCD^​\(X,Y;ρ\)\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)according to their empirical dependence, so that redundant components are down\-weighted while complementary ones are emphasized\.

Statistics Correlation Estimation\.In practice, we estimate their correlation structure under the null hypothesis𝑯0A\\bm\{H\}\_\{0\}^\{\\rm A\}using an auxiliary clean calibration setXcal∼ℙX\_\{\\rm cal\}\\sim\\mathbb\{P\}that is independent of the reference and query sets\(X,Y\)\(X,Y\), which characterizes how the component statistics in𝒯A​\(X,Y;ℓ,ρ\)\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)behave jointly under𝑯0A\\bm\{H\}\_\{0\}^\{\\rm A\}Chatterjee & Bhattacharya \([2025](https://arxiv.org/html/2606.27832#bib.bib7)\); Zhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\)\. Specifically, we performBBrepeated resampling iterations usingXcalX\_\{\\rm cal\}\. In each iterationbb, we draw two disjoint subsetsXbX\_\{b\}andYbY\_\{b\}from the clean calibration pool \(with\|Xb\|=n\|X\_\{b\}\|=nand\|Yb\|=m\|Y\_\{b\}\|=m\), and compute the statistics vector𝒯b≡𝒯​\(Xb,Yb;ℓ,ρ\)\\mathcal\{T\}\_\{b\}\\equiv\\mathcal\{T\}\(X\_\{b\},Y\_\{b\};\\ell,\\rho\)\. From\{𝒯b\}b=1B\\\{\\mathcal\{T\}\_\{b\}\\\}\_\{b=1\}^\{B\}, we estimate their covariance structure as

Σ^A=1B−1​∑b=1B\(𝒯b−𝒯𝝁^\)​\(𝒯b−𝒯𝝁^\)⊤,\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}=\\frac\{1\}\{B\-1\}\\sum\_\{b=1\}^\{B\}\\bigl\(\\mathcal\{T\}\_\{b\}\-\\widehat\{\\mathcal\{T\}\_\{\\bm\{\\mu\}\}\}\\bigr\)\\bigl\(\\mathcal\{T\}\_\{b\}\-\\widehat\{\\mathcal\{T\}\_\{\\bm\{\\mu\}\}\}\\bigr\)^\{\\\!\\top\},\(10\)where𝒯𝝁^=B−1​∑b=1B𝒯b\\widehat\{\\mathcal\{T\}\_\{\\bm\{\\mu\}\}\}=B^\{\-1\}\\sum\_\{b=1\}^\{B\}\\mathcal\{T\}\_\{b\}is the mean estimated with allBBiterations\. The diagonal entries ofΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}capture individual variabilities of VD and PCD, while off\-diagonal entries reflect their correlation under the null\. Additionally, by estimating this from CEs only, we ensure the aggregation weights reflect behavior when𝑯0A\\bm\{H\}\_\{0\}^\{\\mathrm\{A\}\}holdsZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\)\.

Permutation Test\.Following the SAD pipeline \([Section2](https://arxiv.org/html/2606.27832#S2)\), we apply apermutation testwithRRrandom permutations to𝒯A​\(X,Y;ℓ,ρ\)\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)\(Eq\.\([9](https://arxiv.org/html/2606.27832#S4.E9)\)\)\. For eachr=1,…,Rr=1,\\dots,R, we compute𝒯\(r\)A\\mathcal\{T\}^\{\\rm A\}\_\{\(r\)\}while keepingΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}fixed at Eq\.\([10](https://arxiv.org/html/2606.27832#S4.E10)\), so the aggregation weights reflect the null covariance structure across permutations\. At significance levelα\\alpha, we reject𝑯0A\\bm\{H\}\_\{0\}^\{\\rm A\}when𝒯A\>tα\\mathcal\{T\}^\{\\rm A\}\>t\_\{\\alpha\}, wheretαt\_\{\\alpha\}is the adjusted\(1−α\)\(1\-\\alpha\)\-quantile of the permuted statistic values, as defined in Appendix[B](https://arxiv.org/html/2606.27832#A2)\.

Detection\.We reject𝑯0A\\bm\{H\}\_\{0\}^\{\\rm A\}\(i\.e\., classifyingYYas adversarial\) if and only if𝒯A​\(X,Y,ℓ,ρ\)\>tα\\mathcal\{T\}^\{\\rm A\}\(X,Y,\\ell,\\rho\)\>t\_\{\\alpha\}\.

![Refer to caption](https://arxiv.org/html/2606.27832v1/x4.png)

Figure 3:Results\(a−h\)\(a\\\!\-\\\!h\)are test power \(detection rate\) under different adversarial attacks with differentϵ\\epsilon, the given adversarial samples all share the same sample size\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions and the ideal test power is11\. The target model is ResNet\-50 trained onImageNetdataset in\(a−d\)\(a\\\!\-\\\!d\), and ResNet\-18 trained onCIFAR\-10dataset in\(e−h\)\(e\\\!\-\\\!h\)\.![Refer to caption](https://arxiv.org/html/2606.27832v1/x5.png)

Figure 4:Results\(a−d\)\(a\\\!\-\\\!d\)are test power \(detection rate\) under different adversarial attacks with differentϵ\\epsilonunderL2L\_\{2\}norm, given adversarial samples all share the same sample size\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions and the ideal test power is11\(the same as100%100\\%detection rate\)\. The target model is ResNet\-18 trained onCIFAR\-10dataset\.Table 1:Test power for different input example sizesm=\|Y\|m=\|Y\|decreasing from 50 to 10 under PGD attack withϵ=4/255\\epsilon=4/255\. The test power results are averaged over1,0001,000repetitions\. The target model is ResNet\-18 trained onCIFAR\-10dataset\.Methodm=10m=10m=20m=20m=30m=30m=40m=40m=50m=50SAMMD\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)0\.292±0\.0290\.292\\pm 0\.0290\.486±0\.0220\.486\\pm 0\.0220\.650±0\.0080\.650\\pm 0\.0080\.756±0\.0190\.756\\pm 0\.0190\.832±0\.0090\.832\\pm 0\.009\\cellcolororLPCD \(ours\)\\cellcolororL0\.486±0\.0240\.486\\pm 0\.024\\cellcolororL0\.828±0\.0130\.828\\pm 0\.013\\cellcolororL0\.958±0\.0070\.958\\pm 0\.007\\cellcolororL0\.998±0\.0020\.998\\pm 0\.002\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMDAgg\(Schrab et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib45)\)0\.342±0\.0160\.342\\pm 0\.0160\.476±0\.0220\.476\\pm 0\.0220\.632±0\.0200\.632\\pm 0\.0200\.816±0\.0170\.816\\pm 0\.0170\.912±0\.0090\.912\\pm 0\.009MMD\-FUSE\(Biggs et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib2)\)0\.524±0\.0170\.524\\pm 0\.0170\.892±0\.0140\.892\\pm 0\.0140\.994±0\.0040\.994\\pm 0\.0041\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMD\-DUAL\(Zhou et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib60)\)0\.752±0\.0220\.752\\pm 0\.0220\.978±0\.0030\.978\\pm 0\.0031\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}

Table 2:Test power under adaptive attack withϵ=4/255\\epsilon=4/255\. We increase the input example sizesm=\|Y\|m=\|Y\|from 10 to 50 to show that all the SAD methods can gain power from example size, even though the adaptive attack can effectively avoid the detection with insufficient examples\. The test power results are averaged over1,0001,000repetitions\. The target model is ResNet\-18 trained onCIFAR\-10dataset\.MethodAttackm=10m=10m=20m=20m=30m=30m=40m=40m=50m=50PCDPGD0\.486±0\.0240\.486\\pm 0\.0240\.828±0\.0130\.828\\pm 0\.0130\.958±0\.0070\.958\\pm 0\.0070\.998±0\.0020\.998\\pm 0\.0021\.000±0\.0001\.000\\pm 0\.000Adaptive0\.388±0\.0270\.388\\pm 0\.0270\.714±0\.0200\.714\\pm 0\.0200\.768±0\.0330\.768\\pm 0\.0330\.882±0\.0100\.882\\pm 0\.0100\.914±0\.0140\.914\\pm 0\.014VDPGD1\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000Adaptive0\.186±0\.0230\.186\\pm 0\.0230\.326±0\.0070\.326\\pm 0\.0070\.416±0\.0220\.416\\pm 0\.0220\.546±0\.0210\.546\\pm 0\.0210\.614±0\.0110\.614\\pm 0\.011USADPGD1\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000Adaptive0\.818±0\.0130\.818\\pm 0\.0130\.998±0\.0020\.998\\pm 0\.0021\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000Avg\. Decrease−0\.365±0\.207\-0\.365\\pm 0\.207−0\.263±0\.193\-0\.263\\pm 0\.193−0\.258±0\.168\-0\.258\\pm 0\.168−0\.190±0\.131\-0\.190\\pm 0\.131−0\.157±0\.111\-0\.157\\pm 0\.111

Table 3:Rejection rates for different*clean examples*\(CE\) mixing levels from0%0\\%to100%100\\%with\|Y\|=50\|Y\|=50, under PGD attack withϵ=4/255\\epsilon=4/255\. The results are averaged over1,0001,000repetitions\. The target model is ResNet\-18 trained onCIFAR\-10dataset\.Method02020404060608080100100SAMMD0\.828±0\.0160\.828\\pm 0\.0160\.620±0\.0130\.620\\pm 0\.0130\.344±0\.0100\.344\\pm 0\.0100\.196±0\.0120\.196\\pm 0\.0120\.052±0\.0100\.052\\pm 0\.0100\.040±0\.0090\.040\\pm 0\.009\\cellcolororLPCD \(ours\)\\cellcolororL0\.996±0\.0020\.996\\pm 0\.002\\cellcolororL0\.952±0\.0050\.952\\pm 0\.005\\cellcolororL0\.356±0\.0200\.356\\pm 0\.020\\cellcolororL0\.142±0\.0100\.142\\pm 0\.010\\cellcolororL0\.066±0\.0110\.066\\pm 0\.011\\cellcolororL0\.056±0\.0040\.056\\pm 0\.004\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL0\.998±0\.002\\mathbf\{0\.998\\pm 0\.002\}\\cellcolorgoL0\.778±0\.016\\mathbf\{0\.778\\pm 0\.016\}\\cellcolorgoL0\.060±0\.0060\.060\\pm 0\.006MMDAgg1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.992±0\.0030\.992\\pm 0\.0030\.548±0\.0250\.548\\pm 0\.0250\.096±0\.0050\.096\\pm 0\.0050\.050±0\.0090\.050\\pm 0\.009MMD\-FUSE0\.908±0\.0100\.908\\pm 0\.0100\.682±0\.0130\.682\\pm 0\.0130\.330±0\.0220\.330\\pm 0\.0220\.168±0\.0150\.168\\pm 0\.0150\.050±0\.0060\.050\\pm 0\.0060\.030±0\.0090\.030\\pm 0\.009MMD\-DUAL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.990±0\.0030\.990\\pm 0\.0030\.806±0\.0120\.806\\pm 0\.0120\.274±0\.0120\.274\\pm 0\.0120\.068±0\.0090\.068\\pm 0\.0090\.040±0\.0060\.040\\pm 0\.006\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL0\.900±0\.0140\.900\\pm 0\.014\\cellcolorgrL0\.350±0\.0180\.350\\pm 0\.018\\cellcolorgrL0\.038±0\.0070\.038\\pm 0\.007

## 5Theoretical Analysis

In this section, we present theoretical guarantees for our test statistics, with full proofs in Appendix[D](https://arxiv.org/html/2606.27832#A4)\. We first establish Type\-I error control as follows\.

###### Theorem 1\.

Given the test batchYYconsists of clean data, the VD, PCD, or USAD, when combined with a permutation test at significance levelα∈\(0,1\)\\alpha\\in\(0,1\), controls the Type I error at levelα\\alpha; that is, the probability of falsely identifying the test batchYYas adversarial is at mostα\\alpha\.

We next study the test power of VD as follows\.

###### Theorem 2\.

Letℓ\\ellbe a bounded kernel\. Under the alternative hypothesis𝐇1V\\bm\{H\}^\{\\textnormal\{V\}\}\_\{1\}, the power of the VD test, that is, the probability of correctly rejecting the null hypothesis𝐇0V\\bm\{H\}^\{\\textnormal\{V\}\}\_\{0\}, converges to11asn,m→∞n,m\\rightarrow\\inftywithn/m→c∈\(0,∞\)n/m\\rightarrow c\\in\(0,\\infty\)\.

This guarantees that VD is a consistent statistical test; a similar result hold for PCD, as below\.

###### Theorem 3\.

Letρ\\rhobe a bounded kernel\. Under the alternative hypothesis𝐇1C\\bm\{H\}^\{\\textnormal\{C\}\}\_\{1\}, the power of the PCD test converges to11asn,m→∞n,m\\rightarrow\\inftywithn/m→c∈\(0,∞\)n/m\\rightarrow c\\in\(0,\\infty\)\.

We now extend these results to the USAD\.

###### Corollary 4\.

Ifeither or boththe alternative hypotheses𝐇1V\\bm\{H\}^\{\\textnormal\{V\}\}\_\{1\}and𝐇1C\\bm\{H\}^\{\\textnormal\{C\}\}\_\{1\}hold, the power of the USAD test converges to11asn,m→∞n,m\\rightarrow\\inftywithn/m→c∈\(0,∞\)n/m\\rightarrow c\\in\(0,\\infty\)\.

In Theorem[1](https://arxiv.org/html/2606.27832#Thmtheorem1)and Corollary[4](https://arxiv.org/html/2606.27832#Thmtheorem4), although our analysis focuses on USAD, the aggregation framework is general and can incorporate additional statistics such as MMD\.

## 6Experiments

We evaluate our approaches on ResNet\-18/50\(He et al\.,[2016](https://arxiv.org/html/2606.27832#bib.bib23)\)and ViT\-B\-16\(Dosovitskiy et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib14)\)trained onCIFAR\-10\(Krizhevsky et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib33)\)andImageNet\-1K\(Deng et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib12)\)\. We report the main detection results underℓ∞\\ell\_\{\\infty\}andℓ2\\ell\_\{2\}attacks, adaptive attacks, CE\-mixing settings, and empirical Type\-I error control in the main text\. Full experimental details are deferred to Appendix[F](https://arxiv.org/html/2606.27832#A6)and[E](https://arxiv.org/html/2606.27832#A5)\.

Baselines\.We compare our methods against the state\-of\-the\-art SAD method:SAMMDGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\), a MMD\-based detector that uses semantic features, which significantly outperforms all the single MMD\-based two\-sample testing methods \(e\.g\., MMD\-DLiu et al\. \([2020](https://arxiv.org/html/2606.27832#bib.bib36)\), C2STCheng & Cloninger \([2019](https://arxiv.org/html/2606.27832#bib.bib8)\)\), we refer readers interested in these experimental results to SAMMD\.

![Refer to caption](https://arxiv.org/html/2606.27832v1/x6.png)

Figure 5:Results\(a−b\)\(a\\\!\-\\\!b\)are type I error \(false alarm rate\) control check where given examples are actually drawn from clean examples under different clean example sizes\. The results are averaged over1,0001,000repetitions and the ideal type I error is around the significance levelα=0\.05\\alpha=0\.05\(onlyα\\alpha% of the chance to reject clean examples\)\. The target model is ResNet\-18 trained onCIFAR\-10dataset in\(a\)\(a\), and the target model is ResNet\-50 trained onImageNet\-1Kdataset in\(b\)\(b\)\.Evaluation Metric\.We evaluate detection performance using test power, which measures the ability to correctly identify adversarial examples while maintaining a significance level ofα=0\.05\\alpha=0\.05\. Figure[3](https://arxiv.org/html/2606.27832#S4.F3)\(a–d\) and Figure[3](https://arxiv.org/html/2606.27832#S4.F3)\(e–h\) report the test power under five attacks, where the query batches consist entirely of adversarial examples:*AutoAttack*\(AA\)Croce & Hein \([2020b](https://arxiv.org/html/2606.27832#bib.bib11)\),*basic iterative method*\(BIM\)Kurakin et al\. \([2017](https://arxiv.org/html/2606.27832#bib.bib34)\),*Carlini & Wagner*\(CW\) attackCarlini & Wagner \([2017b](https://arxiv.org/html/2606.27832#bib.bib6)\),*fast gradient sign method*\(FGSM\)Goodfellow et al\. \([2015](https://arxiv.org/html/2606.27832#bib.bib18)\)and*projected gradient descent*\(PGD\)Madry et al\. \([2018](https://arxiv.org/html/2606.27832#bib.bib38)\)under different target models that trained on eitherCIFAR\-10orImageNet\-1K\.

Adaptive Attack Formulation\.To evaluate robustness under adaptive attacks, we follow the strategy ofGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\)and generate adversarial examples on CIFAR\-10 and ImageNet using a PGD\-based white\-box attack, where both the classifier and our detector are fully accessible to the attacker\. The attack is designed to optimize two competing objectives: it increases the classification loss to ensure the generated examples remain adversarial, while simultaneously suppressing the detector’s test statistic so that the adversarial batch appears statistically closer to the clean reference batch\. Implementation details of the proposed adaptive attack can be found in Appendix[E\.3](https://arxiv.org/html/2606.27832#A5.SS3)\.

Overall Result\.Our results demonstrate that USAD consistently achieves superior performance across all attacks\. Notably, for all attacks, USAD reaches perfect detection \(test power≈1\.0\\approx 1\.0\) whenever the perturbation budgetϵ≥4/255\\epsilon\\geq 4/255under a relatively small example size\|Y\|=50\|Y\|=50, and even our proposed single uncertainty\-aware methods PCD and VD can reach perfect detection wheneverϵ≥6/255\\epsilon\\geq 6/255, all three significantly outperforming the baseline SAMMD\. Additional results in Figures[4](https://arxiv.org/html/2606.27832#S4.F4)further show that USAD remains effective underℓ2\\ell\_\{2\}attacks\.

Impact of Sample Size\.To study robustness to varying example sizes, we compare PCD and VD to the single\-kernel MMD baseline \(SAMMD\), and compare USAD to representative multi\-kernel MMD tests \(e\.g\.,MMDAggSchrab et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib45)\),MMD\-FUSEBiggs et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib2)\), andMMD\-DUALZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\)\) that boost power in small\-sample regimes via kernel aggregation\. Table[1](https://arxiv.org/html/2606.27832#S4.T1)reports results as the query size ranges from 10 to 50\. PCD and VD consistently outperform SAMMD, and USAD consistently outperforms MMD\-based kernel aggregation methods, maintaining power1\.01\.0even with*only 10 query examples*\.

Performance against Adaptive Attack\.Inspired byGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\); Kaya et al\. \([2022](https://arxiv.org/html/2606.27832#bib.bib31)\), we evaluate adaptive attacks designed to evade SAD methods\. Specifically, we use adaptive PGD variants that maximize the adversarial cross\-entropy loss while minimizing the discrepancy measured by the target statistic \(VD, PCD, or USAD; see Eqs\. \([5](https://arxiv.org/html/2606.27832#S3.E5)\), \([8](https://arxiv.org/html/2606.27832#S3.E8)\), and \([9](https://arxiv.org/html/2606.27832#S4.E9)\)\)\. Table[2](https://arxiv.org/html/2606.27832#S4.T2)shows that although power drops compared to non\-adaptive attacks, USAD still achieves0\.8180\.818power with only1010examples, indicating strong robustness\. The results further suggest that PCD better retains power under adaptive attacks: such attacks can suppress the global spread signal used by VD, whereas reducing the local instability captured by PCD is harder while preserving adversarial effectiveness\. More importantly, these results highlight a key advantage of SAD over single\-example detectors \(e\.g\., LID\(Ma et al\.,[2018](https://arxiv.org/html/2606.27832#bib.bib37)\)and EPS\-AD\(Zhang et al\.,[2023](https://arxiv.org/html/2606.27832#bib.bib57)\)\): adaptive attacks can reduce power in small batches, but as batch size grows, SAD consistently separates AEs from CEs\.

Impact of CE mixing levels\.We evaluate all methods as the fraction of*clean examples \(CEs\)*in the query batch increases from0%0\\%to100%100\\%\. As reported in Table[3](https://arxiv.org/html/2606.27832#S4.T3), detection becomes harder as the CE proportion grows \(the induced shift weakens\), yet our method attains the highest power across mixing levels\. In particular, a non\-negligible adversarial fraction induces a detectable shift, whereas a vanishing fraction \(i\.e\.,100%100\\%CE\) can become effectively indistinguishable from clean data, in which case the rejection rate \(Type\-I error\) stays around the significance levelα=0\.05\\alpha=0\.05\. Notably, even at a high CE mixing level of80%80\\%, our VD statistic retains strong detection power \(0\.778\), while USAD achieves 0\.350 and remains the strongest aggregated method; in contrast, the MMD\-based baselines achieve at most 0\.096 power\. We provide a more detailed discussion of this distribution\-level perspective and the mixture regimes in Remark[1](https://arxiv.org/html/2606.27832#Thmremark1)\. Figure[5](https://arxiv.org/html/2606.27832#S6.F5)further verifies that USAD maintains Type\-I error close to the prescribed significance levelα=0\.05\\alpha=0\.05on clean query batches\.

Additional Results\.Beyond the main experiments, Appendix[F](https://arxiv.org/html/2606.27832#A6)provides further evaluations under transfer attacks, additional architectures, sparseℓ0/ℓ1\\ell\_\{0\}/\\ell\_\{1\}attacks, adversarial video detection, and computational efficiency\. These experiments test whether the observed gains persist beyond the standardℓ∞\\ell\_\{\\infty\}image\-attack setting, including cases where AEs are generated from surrogate models or induce different geometric perturbation patterns\. Overall, the results show that USAD remains effective across diverse threat models, architectures, and data modalities, while maintaining practical inference\-time efficiency\.

## 7Conclusion

This work reveals that the general\-purpose metric, MMD, is insensitive to how adversarial perturbations actually manifest as distributional uncertainty changes\. We addressed this by developing two statistics to measure global and local uncertainties and combining them into an uncertainty\-aware SAD detector, achieving high power in the small\-sample regime with theoretically false alarm control\. Our formulation offers a practical template: task‑aligned features, statistics that encode the relevant geometry, and principled aggregation to discount redundancy\. We expect this recipe to extend beyond SAD to general distribution shift testing\.

## Acknowledgements

This research was supported by the University of Melbourne’s Research Computing Services and the Petascale Campus Initiative\. ZJZ and XYT are supported by the Melbourne Research Scholarship and the ARC with grant number DE240101089\. JCZ and YYG are supported by the Melbourne Research Scholarship\. LHP is supported by the ARC with grant number LP240100101\. FL is supported by the ARC with grant number DE240101089, LP240100101, DP230101540 and the NSF&CSIRO Responsible AI program with grant number 2303037\.

## Impact Statement

This work on uncertainty\-aware statistical adversarial detection raises important considerations regarding the reliability and robustness of machine learning systems deployed in security\-critical settings\. We carefully evaluate the proposed method on widely adopted benchmark datasets, multiple model architectures, and diverse adversarial attacks, following established hypothesis\-testing protocols that ensure controlled false\-alarm rates and fair comparison with prior statistical detection approaches\. Our experimental results demonstrate that explicitly modeling distributional uncertainty can substantially improve detection power in small\-sample regimes, addressing a key limitation of existing MMD\-based SAD methods\.

From a broader perspective, our method operates entirely at inference time and does not rely on adversarial training, attack\-specific assumptions, or external supervision, reducing the risk of overfitting to known threats or amplifying unintended biases\. We hope this work contributes to the development of more reliable and trustworthy defenses against adversarial attacks, and encourages further research into uncertainty\-aware and statistically principled approaches for safe and robust machine learning deployment\.

## References

- Andriushchenko et al\. \(2020\)Andriushchenko, M\., Croce, F\., Flammarion, N\., and Hein, M\.Square attack: A query\-efficient black\-box adversarial attack via random search\.In*ECCV*, 2020\.
- Biggs et al\. \(2023\)Biggs, F\., Schrab, A\., and Gretton, A\.MMD\-Fuse: Learning and combining kernels for two\-sample testing without data splitting\.In*NeurIPS*, 2023\.
- Bryniarski et al\. \(2022\)Bryniarski, O\., Hingun, N\., Pachuca, P\., Wang, V\., and Carlini, N\.Evading adversarial example detection defenses with orthogonal projected gradient descent\.In*ICLR*, 2022\.
- Cao et al\. \(2021\)Cao, Y\., Wang, N\., Xiao, C\., Yang, D\., Fang, J\., Yang, R\., Chen, Q\. A\., Liu, M\., and Li, B\.Invisible for both camera and lidar: Security of multi\-sensor fusion based perception in autonomous driving under physical\-world attacks\.In*IEEE Symposium on Security and Privacy*, pp\. 176–194, 2021\.
- Carlini & Wagner \(2017a\)Carlini, N\. and Wagner, D\.Adversarial examples are not easily detected: Bypassing ten detection methods\.In*AISec*, 2017a\.
- Carlini & Wagner \(2017b\)Carlini, N\. and Wagner, D\. A\.Towards evaluating the robustness of neural networks\.In*IEEE Symposium on Security and Privacy*, pp\. 39–57\. IEEE, 2017b\.
- Chatterjee & Bhattacharya \(2025\)Chatterjee, A\. and Bhattacharya, B\. B\.Boosting the power of kernel two\-sample tests\.*Biometrika*, 112\(1\):asae048, 2025\.
- Cheng & Cloninger \(2019\)Cheng, X\.\-Y\. and Cloninger, A\.Classification logit two\-sample testing by neural networks\.*arXiv*, 2019\.
- Cohen et al\. \(2019\)Cohen, J\., Rosenfeld, E\., and Kolter, Z\.Certified adversarial robustness via randomized smoothing\.In*ICML*, 2019\.
- Croce & Hein \(2020a\)Croce, F\. and Hein, M\.Minimally distorted adversarial examples with a fast adaptive boundary attack\.In*ICML*, 2020a\.
- Croce & Hein \(2020b\)Croce, F\. and Hein, M\.Reliable evaluation of adversarial robustness with an ensemble of diverse parameter\-free attacks\.In*ICML*, 2020b\.
- Deng et al\. \(2009\)Deng, J\., Dong, W\., Socher, R\., Li, L\.\-J\., Li, K\., and Fei\-Fei, L\.Imagenet: A large\-scale hierarchical image database\.In*CVPR*, 2009\.
- Deng et al\. \(2021\)Deng, Z\., Yang, X\., Xu, S\., Su, H\., and Zhu, J\.LiBRe: A practical Bayesian approach to adversarial detection\.In*CVPR*, 2021\.
- Dosovitskiy et al\. \(2021\)Dosovitskiy, A\., Beyer, L\., Kolesnikov, A\., Weissenborn, D\., Zhai, X\., Unterthiner, T\., Dehghani, M\., Minderer, M\., Heigold, G\., Gelly, S\., Uszkoreit, J\., and Houlsby, N\.An image is worth 16x16 words: Transformers for image recognition at scale\.In*ICLR*, 2021\.
- Fawzi et al\. \(2016\)Fawzi, A\., Moosavi\-Dezfooli, S\.\-M\., and Frossard, P\.Robustness of classifiers: from adversarial to random noise\.In*NeurIPS*, 2016\.
- Feinman et al\. \(2017\)Feinman, R\., Curtin, R\. R\., Shintre, S\., and Gardner, A\. B\.Detecting adversarial samples from artifacts\.*arXiv*, 2017\.
- Gao et al\. \(2021\)Gao, R\., Liu, F\., Zhang, J\., Han, B\., Liu, T\., Niu, G\., and Sugiyama, M\.Maximum mean discrepancy test is aware of adversarial attacks\.In*ICML*, 2021\.
- Goodfellow et al\. \(2015\)Goodfellow, I\. J\., Shlens, J\., and Szegedy, C\.Explaining and harnessing adversarial examples\.In*ICLR*, 2015\.
- Gretton et al\. \(2012\)Gretton, A\., Borgwardt, K\. M\., Rasch, M\. J\., Schölkopf, B\., and Smola, A\.A kernel two\-sample test\.*Journal of Machine Learning Research*, 13\(1\):723–773, 2012\.
- Grosse et al\. \(2017\)Grosse, K\., Manoharan, P\., Papernot, N\., Backes, M\., and McDaniel, P\.On the \(statistical\) detection of adversarial examples\.*arXiv*, 2017\.
- Han et al\. \(2025\)Han, B\., Yao, J\., Liu, T\., Li, B\., Koyejo, S\., and Liu, F\.*Trustworthy Machine Learning: From Data to Models*\.Now Foundations and Trends, 2025\.
- Harchaoui et al\. \(2008\)Harchaoui, Z\., Moulines, E\., and Bach, F\.Kernel change\-point analysis\.In*NeurIPS*, 2008\.
- He et al\. \(2016\)He, K\., Zhang, X\., Ren, S\., and Sun, J\.Deep residual learning for image recognition\.In*CVPR*, 2016\.
- Hemerik & Goeman \(2018\)Hemerik, J\. and Goeman, J\.Exact testing with random permutations\.*Test*, 27\(4\):811–825, 2018\.
- Hoeffding \(1994\)Hoeffding, W\.Probability inequalities for sums of bounded random variables\.In*The Collected Works of Wassily Hoeffding*, pp\. 409–426, New York, NY, 1994\. Springer\.
- Huang et al\. \(2019\)Huang, B\., Wang, Y\., and Wang, W\.Model\-agnostic adversarial detection by random perturbations\.In*IJCAI*, 2019\.
- Huang et al\. \(2021\)Huang, C\., Lim, J\. H\., and Courville, A\. C\.A variational perspective on diffusion\-based generative models and score matching\.In*NeurIPS*, 2021\.
- Ilyas et al\. \(2019\)Ilyas, A\., Santurkar, S\., Tsipras, D\., Engstrom, L\., Tran, B\., and Madry, A\.Adversarial examples are not bugs, they are features\.In*NeurIPS*, 2019\.
- Jing et al\. \(2021\)Jing, P\., Tang, Q\., Du, Y\., Xue, L\., Luo, X\., Wang, T\., Nie, S\., and Wu, S\.Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations\.In*USENIX Security Symposium*, pp\. 3237–3254, 2021\.
- Kang et al\. \(2023\)Kang, M\., Song, D\., and Li, B\.Diffattack: Evasion attacks against diffusion\-based adversarial purification\.In*NeurIPS*, 2023\.
- Kaya et al\. \(2022\)Kaya, Y\., Zafar, M\. B\., Aydore, S\., Rauschmayr, N\., and Kenthapadi, K\.Generating distributional adversarial examples to evade statistical detectors\.In*ICML*, 2022\.
- Kim et al\. \(2022\)Kim, I\., Balakrishnan, S\., and Wasserman, L\.Minimax optimality of permutation tests\.*Annals of Statistics*, 50\(1\):225–251, 2022\.
- Krizhevsky et al\. \(2009\)Krizhevsky, A\., Nair, V\., and Hinton, G\.CIFAR\-10 \(canadian institute for advanced research\)\.2009\.URL[http://www\.cs\.toronto\.edu/~kriz/cifar\.html](http://www.cs.toronto.edu/~kriz/cifar.html)\.
- Kurakin et al\. \(2017\)Kurakin, A\., Goodfellow, I\. J\., and Bengio, S\.Adversarial examples in the physical world\.In*ICLR, Workshop Track Proceedings*, 2017\.
- Li et al\. \(2019\)Li, B\., Chen, C\., Wang, W\., and Carin, L\.Certified adversarial robustness with additive noise\.In*NeurIPS*, 2019\.
- Liu et al\. \(2020\)Liu, F\., Xu, W\., Lu, J\., Zhang, G\., Gretton, A\., and Sutherland, D\. J\.Learning deep kernels for non\-parametric two\-sample tests\.In*ICML*, 2020\.
- Ma et al\. \(2018\)Ma, X\., Li, B\., Wang, Y\., Erfani, S\. M\., Wijewickrema, S\. N\. R\., Schoenebeck, G\., Song, D\., Houle, M\. E\., and Bailey, J\.Characterizing adversarial subspaces using local intrinsic dimensionality\.In*ICLR*, 2018\.
- Madry et al\. \(2018\)Madry, A\., Makelov, A\., Schmidt, L\., Tsipras, D\., and Vladu, A\.Towards deep learning models resistant to adversarial attacks\.In*ICLR*, 2018\.
- Moosavi\-Dezfooli et al\. \(2016\)Moosavi\-Dezfooli, S\.\-M\., Fawzi, A\., and Frossard, P\.DeepFool: A simple and accurate method to fool deep neural networks\.In*CVPR*, 2016\.
- Moosavi\-Dezfooli et al\. \(2018\)Moosavi\-Dezfooli, S\.\-M\., Fawzi, A\., Fawzi, O\., Frossard, P\., and Soatto, S\.Robustness of classifiers to universal perturbations: A geometric perspective\.In*ICLR*, 2018\.
- Muandet et al\. \(2017\)Muandet, K\., Fukumizu, K\., Sriperumbudur, B\., and Schölkopf, B\.Kernel mean embedding of distributions: A review and beyond\.*Foundations and Trends® in Machine Learning*, 10\(1\-2\):1–141, 2017\.
- Papoulis & Pillai \(2001\)Papoulis, A\. and Pillai, S\. U\.*Probability, Random Variables and Stochastic Processes*\.McGraw Hill, 2001\.
- Roth et al\. \(2019\)Roth, K\., Kilcher, Y\., and Hofmann, T\.The odds are odd: A statistical test for detecting adversarial examples\.In*ICML*, 2019\.
- Schrab et al\. \(2022\)Schrab, A\., Kim, I\., Guedj, B\., and Gretton, A\.Efficient aggregated kernel tests using incomplete U\-statistics\.In*NeurIPS*, 2022\.
- Schrab et al\. \(2023\)Schrab, A\., Kim, I\., Albert, M\., Laurent, B\., Guedj, B\., and Gretton, A\.MMD aggregated two\-sample test\.*Journal of Machine Learning Research*, 24:194:1–194:81, 2023\.
- Song & Ermon \(2019\)Song, Y\. and Ermon, S\.Generative modeling by estimating gradients of the data distribution\.In*NeurIPS*, 2019\.
- Song et al\. \(2021\)Song, Y\., Sohl\-Dickstein, J\., Kingma, D\. P\., Kumar, A\., Ermon, S\., and Poole, B\.Score\-based generative modeling through stochastic differential equations\.In*ICLR*, 2021\.
- Sun et al\. \(2025\)Sun, Y\., Zhang, J\., Ye, Z\., Xiao, C\., and Liu, F\.Sample\-specific noise injection for diffusion\-based adversarial purification\.In*ICML*, 2025\.
- Szegedy et al\. \(2014\)Szegedy, C\., Zaremba, W\., Sutskever, I\., Bruna, J\., Erhan, D\., Goodfellow, I\. J\., and Fergus, R\.Intriguing properties of neural networks\.In*ICLR*, 2014\.
- Tramèr \(2022\)Tramèr, F\.Detecting adversarial examples is \(nearly\) as hard as classifying them\.In*ICML*, 2022\.
- Wei et al\. \(2019\)Wei, X\., Zhu, J\., Yuan, S\., and Su, H\.Sparse adversarial perturbations for videos\.In*AAAI*, 2019\.
- Xue et al\. \(2023\)Xue, H\., Araujo, A\., Hu, B\., and Chen, Y\.Diffusion\-based adversarial sample generation for improved stealthiness and controllability\.In*NeurIPS*, 2023\.
- Yang et al\. \(2022\)Yang, Z\., Li, L\., Xu, X\., Kailkhura, B\., Xie, T\., and Li, B\.On the certified robustness for ensemble models and beyond\.In*ICLR*, 2022\.
- Zhang et al\. \(2019\)Zhang, H\., Yu, Y\., Jiao, J\., Xing, E\. P\., Ghaoui, L\. E\., and Jordan, M\. I\.Theoretically principled trade\-off between robustness and accuracy\.In*ICML*, 2019\.
- Zhang et al\. \(2024\)Zhang, J\., Liu, F\., Zhou, D\., Zhang, J\., and Liu, T\.Improving accuracy\-robustness trade\-off via pixel reweighted adversarial training\.In*ICML*, 2024\.
- Zhang et al\. \(2025\)Zhang, J\., Rubinstein, B\. I\. P\., Zhang, J\., and Liu, F\.One stone, two birds: Enhancing adversarial defense through the lens of distributional discrepancy\.In*ICML*, 2025\.
- Zhang et al\. \(2023\)Zhang, S\., Liu, F\., Yang, J\., Yang, Y\., Li, C\., Han, B\., and Tan, M\.Detecting adversarial data by probing multiple perturbations using expected perturbation score\.In*ICML*, 2023\.
- Zhong & Liu \(2025\)Zhong, X\. and Liu, C\.Sparse\-pgd: A unified framework for sparse adversarial perturbations generation\.*IEEE Transactions on Pattern Analysis and Machine Intelligence*, 2025\.
- Zhou et al\. \(2023\)Zhou, Z\., Ni, J\., Yao, J\.\-H\., and Gao, W\.On the exploration of local significant differences for two\-sample test\.In*NeurIPS*, 2023\.
- Zhou et al\. \(2025\)Zhou, Z\., Tian, X\., Peng, L\., Lei, C\., Schrab, A\., Sutherland, D\. J\., and Liu, F\.DUAL: Learning diverse kernels for aggregated two\-sample and independence testing\.In*NeurIPS*, 2025\.

## Appendix AMore Discussions on the Scope, Position, and Limitations of SAD

This paper focuses onstatistical adversarial detection\(SAD\) as an active research area and a promising paradigm complementary to existing adversarial defense strategies\. We have identified the fundamental limitation of existing SAD practices and proposed a concrete variant termedUncertainty\-aware Statistical Adversarial Detection\(USAD\) accordingly\.

Scope of SAD\.By framing adversarial detection as a two\-sample hypothesis test, SAD offers two practical advantages: it treats the classifier as a black box without requiring attack\-specific training, and it provides a*lightweight monitoring primitive*\. Once a query window is flagged as distributionally suspicious, the system can throttle the source, trigger more expensive defenses, or route the traffic for human inspection, while maintaining controlled false\-alarm rates\. Beyond test\-time monitoring, the same batch\-level tests can also support*data cleaning*in large\-scale training pipelines, where coordinated manipulation may contaminate entire mini\-batches from distributed or third\-party data sources\. In this scope, USAD strengthens SAD by substantially improving detection reliability in small and early\-stage windows, where MMD\-based methods often lack sufficient power\. This makes USAD particularly well\-suited for timely monitoring and data vetting in realistic deployment settings\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\.

Position of USAD\.We emphasize that USAD \(and other SAD variants\) isnot intended to replace per\-example detectors\. Rather, it serves as a statistical monitor operating on short query windows\. Detecting individual AEs in isolation is known to be nearly as hard as robust classification and typically relies on strong attack\-specific assumptions\(Tramèr,[2022](https://arxiv.org/html/2606.27832#bib.bib50)\)\. In contrast, SAD deliberately trades per\-example granularity for rigorous false\-alarm control and reliable detection power at the window level, making it a natural building block for monitoring and throttling in deployed systems\. In Section[6](https://arxiv.org/html/2606.27832#S6), we further show that USAD maintains high power even when AEs are sparsely mixed with CEs within each window\.

Limitations of SAD\.That said, we acknowledge the limitations of SAD in its current forms\. Prior to USAD, SAD is instantiated almost exclusively with*maximum mean discrepancy*\(MMD\)\(Gretton et al\.,[2012](https://arxiv.org/html/2606.27832#bib.bib19)\)as the test statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)\(Gao et al\.,[2021](https://arxiv.org/html/2606.27832#bib.bib17); Zhang et al\.,[2025](https://arxiv.org/html/2606.27832#bib.bib56)\)\. These MMD\-based SAD methods have shown strong performance againstunknownand evenadaptiveattacks, while enjoying rigorous false\-alarm control through hypothesis testing\. However, they are inherentlysample\-inefficient: reliable detection typically requires query windows with sufficiently large effective sample sizes and non\-trivial adversarial fractions to achieve high test power\. This limitation stems from the fact that MMD primarily captures discrepancies in kernel mean embeddings, whose estimation variance can be substantial in small\-sample regimes\. As shown in Figure[1\(a\)](https://arxiv.org/html/2606.27832#S1.F1.sf1), the test power of MMD\-based SAD degrades rapidly as the query window size decreases, even under strong adversarial perturbations, where the induced distributional shift is often overwhelmed by statistical noise\. This sample inefficiency critically limits practical deployment, since defenders cannot realistically wait for large query windows to accumulate in streaming or online settings, and attackers inherently control the number and timing of adversarial queries\. As a result, MMD\-based SAD methods can fail precisely in early\-stage or low\-volume attack regimes where timely detection is most important\.

## Appendix BPermutation Test

We detail the permutation test used throughoutstatistical adversarial detection\(SAD\) to calibrate the decision thresholdtαt\_\{\\alpha\}for our proposed statistics \(VD, PCD, and their aggregate USAD\)\.

#### From SAD to Calibration\.

For completeness, we briefly review the problem setup of SAD and the reason for conducting the permutation test\.[Section2\.1](https://arxiv.org/html/2606.27832#S2.SS1)formulates SAD as a two\-sample hypothesis testing problem: given a reference set ofclean examples\(CEs\)X=\{𝒙i\}i=1n∼i\.i\.d\.ℙX=\\\{\\bm\{x\}\_\{i\}\\\}\_\{i=1\}^\{n\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{P\}and a query setY=\{𝒚j\}j=1m∼i\.i\.d\.ℚY=\\\{\\bm\{y\}\_\{j\}\\\}\_\{j=1\}^\{m\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{Q\}, we test

𝑯0:ℙ=ℚvs\.𝑯1:ℙ≠ℚ\.\\bm\{H\}\_\{0\}:\\mathbb\{P\}=\\mathbb\{Q\}\\quad\\text\{vs\.\}\\quad\\bm\{H\}\_\{1\}:\\mathbb\{P\}\\neq\\mathbb\{Q\}\.At significance levelα\\alpha, we want atest statistic𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)and atesting thresholdtαt\_\{\\alpha\}such that

Pr⁡\(𝒯​\(X,Y\)\>tα∣𝑯0\)≤α,\\Pr\\\!\\left\(\\mathcal\{T\}\(X,Y\)\>t\_\{\\alpha\}\\mid\\bm\{H\}\_\{0\}\\right\)\\leq\\alpha,so that rejecting𝑯0\\bm\{H\}\_\{0\}\(declaringYYadversarial\) has a controlled false\-alarm rate\. That is, the probability of falsely identifying the query dataYYas adversarial is at mostα\\alpha\. In this paper,𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)can be instantiated by VD \([Section3\.1](https://arxiv.org/html/2606.27832#S3.SS1)and Eq\. \([5](https://arxiv.org/html/2606.27832#S3.E5)\)\), PCD \([Section3\.2](https://arxiv.org/html/2606.27832#S3.SS2)and Eq\. \([8](https://arxiv.org/html/2606.27832#S3.E8)\)\), or their aggregate USAD \([Section4](https://arxiv.org/html/2606.27832#S4)and Eq\. \([9](https://arxiv.org/html/2606.27832#S4.E9)\)\)\.

Here, the missing piece istαt\_\{\\alpha\}, which may be defined as an upper\(1−α\)\(1\-\\alpha\)\-quantile of the null distribution of𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)under𝑯0\\bm\{H\}\_\{0\}\. For most SAD methods and modern statistics \(including MMD, VD, PCD, and USAD\), this distribution is not available in closed form\. We therefore exploit theexchangeabilityproperty of the SAD setup:under𝐇0:ℙ=ℚ\\bm\{H\}\_\{0\}:\\mathbb\{P\}=\\mathbb\{Q\}, samples fromXXandYYare i\.i\.d\., so the labels “reference” and “query” are exchangeable, and construct an empirical null distribution using apermutation testwithXXandYY\. We finally determine thetesting thresholdtαt\_\{\\alpha\}calibrated using this empirical null distribution\.

#### Statistics Under Test\.

For notational convenience, we write

STAT∈\{VD^​\(⋅,⋅;ℓ\),PCD^​\(⋅,⋅;ρ\),𝒯A​\(⋅,⋅;ℓ,ρ\)\}\\mathrm\{STAT\}\\in\\Big\\\{\\widehat\{\\mathrm\{VD\}\}\(\\cdot,\\cdot;\\ell\),\\;\\widehat\{\\mathrm\{PCD\}\}\(\\cdot,\\cdot;\\rho\),\\;\\mathcal\{T\}^\{\\rm A\}\(\\cdot,\\cdot;\\ell,\\rho\)\\Big\\\}and useϕ\\phito denote the corresponding kernel choice \(ϕ=ℓ\\phi=\\ellfor VD,ϕ=ρ\\phi=\\rhofor PCD, andϕ=\{ℓ,ρ\}\\phi=\\\{\\ell,\\rho\\\}for USAD\)\.

For USAD,Σ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}is estimated as in Eq\. \([10](https://arxiv.org/html/2606.27832#S4.E10)\) using an auxiliary clean calibration setXcal∼ℙX\_\{\\rm cal\}\\sim\\mathbb\{P\}that is independent of\(X,Y\)\(X,Y\)\. Let𝒜\\mathcal\{A\}denoteXcalX\_\{\\rm cal\}and the randomness used in estimatingΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}\. Conditional on𝒜\\mathcal\{A\},Σ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}is fixed, and the same matrix is used to compute both the observed and all permuted USAD statistics\. For VD and PCD,𝒜\\mathcal\{A\}may be taken to be empty\. For PCD and USAD, each sample\-specific covariance matrixΣ𝒛\\Sigma\_\{\\bm\{z\}\}is constructed using perturbation randomness independent of the reference/query labels, and the pair\(𝒛,Σ𝒛\)\(\\bm\{z\},\\Sigma\_\{\\bm\{z\}\}\)is permuted together\.

#### Permutation Null Construction\.

We have previously mentioned thatXXandYYare exchangeable under𝑯0\\bm\{H\}\_\{0\}and construct the empirical null distribution using the pooled samples

Z≜\(𝒙1,…,𝒙n,𝒚1,…,𝒚m\)=\(𝒛1,…,𝒛n\+m\)\.Z\\triangleq\(\\bm\{x\}\_\{1\},\\dots,\\bm\{x\}\_\{n\},\\bm\{y\}\_\{1\},\\dots,\\bm\{y\}\_\{m\}\)=\(\\bm\{z\}\_\{1\},\\dots,\\bm\{z\}\_\{n\+m\}\)\.Let𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}be the set of permutations of\{1,…,n\+m\}\\\{1,\\dots,n\+m\\\}\. For each permutation𝝅=\(π1,…,πn\+m\)∈𝚷n\+m\\bm\{\\pi\}=\(\\pi\_\{1\},\\dots,\\pi\_\{n\+m\}\)\\in\\bm\{\\Pi\}\_\{n\+m\}, we form

X𝝅=\{𝒛πi\}i=1nandY𝝅=\{𝒛πi\}i=n\+1n\+m,X\_\{\\bm\{\\pi\}\}=\\\{\\bm\{z\}\_\{\\pi\_\{i\}\}\\\}\_\{i=1\}^\{n\}\\quad\\text\{and\}\\quad Y\_\{\\bm\{\\pi\}\}=\\\{\\bm\{z\}\_\{\\pi\_\{i\}\}\\\}\_\{i=n\+1\}^\{n\+m\},and define

STAT​\(𝝅​Z;ϕ\)≜STAT​\(X𝝅,Y𝝅;ϕ\),\\mathrm\{STAT\}\(\\bm\{\\pi\}Z;\\phi\)\\triangleq\\mathrm\{STAT\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\phi\),where𝝅​Z=\(𝒛π1,…,𝒛πn\+m\)\\bm\{\\pi\}Z=\(\\bm\{z\}\_\{\\pi\_\{1\}\},\\dots,\\bm\{z\}\_\{\\pi\_\{n\+m\}\}\)denotes the shuffled pooled samples\.

Under𝑯0\\bm\{H\}\_\{0\}, the entries ofZZare i\.i\.d\., soZZis exchangeable: permuting its indices does not change its distribution\. Let

𝒪​\(Z\)≜\{𝝅​Z:𝝅∈𝚷n\+m\}\\mathcal\{O\}\(Z\)\\triangleq\\\{\\bm\{\\pi\}Z:\\bm\{\\pi\}\\in\\bm\{\\Pi\}\_\{n\+m\}\\\}denote the permutation orbit ofZZ\. Conditional on𝒜\\mathcal\{A\}and𝒪​\(Z\)\\mathcal\{O\}\(Z\), the observed reference/query assignment is uniformly distributed over the assignments induced by𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}\. Because the same statistic, including the same fixedΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}for USAD, is applied to every assignment, the resulting permutation distribution is a valid conditional null distribution\.

#### Monte\-Carlo Approximation\.

Enumerating all\(n\+mn\)\\binom\{n\+m\}\{n\}distinct reference/query partitions is usually impossible, so we approximate the permutation distribution by samplingRRpermutations\. Let

STAT\(0\)≜STAT​\(X,Y;ϕ\)\\mathrm\{STAT\}^\{\(0\)\}\\triangleq\\mathrm\{STAT\}\(X,Y;\\phi\)denote the observed statistic\. For eachr=1,…,Rr=1,\\dots,R, we

1. 1\.draw𝝅\(r\)​∼i\.i\.d\.​Unif​\(𝚷n\+m\)\\bm\{\\pi\}\_\{\(r\)\}\\overset\{\\mathrm\{i\.i\.d\.\}\}\{\\sim\}\\mathrm\{Unif\}\(\\bm\{\\Pi\}\_\{n\+m\}\), independently ofZZand𝒜\\mathcal\{A\};
2. 2\.constructX\(r\)=X𝝅\(r\)X\_\{\(r\)\}=X\_\{\\bm\{\\pi\}\_\{\(r\)\}\}andY\(r\)=Y𝝅\(r\)Y\_\{\(r\)\}=Y\_\{\\bm\{\\pi\}\_\{\(r\)\}\};
3. 3\.compute STAT\(r\)=STAT​\(𝝅\(r\)​Z;ϕ\)=STAT​\(X\(r\),Y\(r\);ϕ\)\.\\mathrm\{STAT\}^\{\(r\)\}=\\mathrm\{STAT\}\(\\bm\{\\pi\}\_\{\(r\)\}Z;\\phi\)=\\mathrm\{STAT\}\(X\_\{\(r\)\},Y\_\{\(r\)\};\\phi\)\.

This givesRRpermutation statistics\{STAT\(r\)\}r=1R\\\{\\mathrm\{STAT\}^\{\(r\)\}\\\}\_\{r=1\}^\{R\}\. Let

STAT\[1\]≤⋯≤STAT\[R\]\\mathrm\{STAT\}\_\{\[1\]\}\\leq\\cdots\\leq\\mathrm\{STAT\}\_\{\[R\]\}denote their ordered values, and define

kα,R=⌈\(1−α\)​\(R\+1\)⌉\.k\_\{\\alpha,R\}=\\left\\lceil\(1\-\\alpha\)\(R\+1\)\\right\\rceil\.The finite\-RRrank\-correctedtesting thresholdis

tα​\(Z,\{𝝅\(r\)\}r=1R\)=\{STAT\[kα,R\],kα,R≤R,\+∞,kα,R=R\+1\.t\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)=\\begin\{cases\}\\mathrm\{STAT\}\_\{\[k\_\{\\alpha,R\}\]\},&k\_\{\\alpha,R\}\\leq R,\\\\\[2\.0pt\] \+\\infty,&k\_\{\\alpha,R\}=R\+1\.\\end\{cases\}\(11\)Equivalently, the corresponding Monte\-Carlo permutationpp\-value is

p^R=1\+∑r=1R𝕀​\[STAT\(r\)≥STAT\(0\)\]R\+1\.\\widehat\{p\}\_\{R\}=\\frac\{1\+\\sum\_\{r=1\}^\{R\}\\mathbb\{I\}\\\!\\left\[\\mathrm\{STAT\}^\{\(r\)\}\\geq\\mathrm\{STAT\}^\{\(0\)\}\\right\]\}\{R\+1\}\.\(12\)The additive one accounts for the observed assignment, while the use of “≥\\geq” makes the test conservative in the presence of ties\. By construction,

p^R≤α⟺STAT\(0\)\>tα​\(Z,\{𝝅\(r\)\}r=1R\)\.\\widehat\{p\}\_\{R\}\\leq\\alpha\\quad\\Longleftrightarrow\\quad\\mathrm\{STAT\}^\{\(0\)\}\>t\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)\.

#### Decision Rule\.

Finally, the test with observed statisticSTAT​\(X,Y;ϕ\)\\mathrm\{STAT\}\(X,Y;\\phi\)is defined as

δα=𝕀​\[STAT​\(X,Y;ϕ\)\>tα​\(Z,\{𝝅\(r\)\}r=1R\)\]=𝕀​\[p^R≤α\]\.\\begin\{split\}\\delta\_\{\\alpha\}&=\\mathbb\{I\}\\left\[\\mathrm\{STAT\}\(X,Y;\\phi\)\>t\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)\\right\]\\\\ &=\\mathbb\{I\}\\left\[\\widehat\{p\}\_\{R\}\\leq\\alpha\\right\]\.\\end\{split\}\(13\)Conditional on𝒜\\mathcal\{A\}and𝒪​\(Z\)\\mathcal\{O\}\(Z\), the observed labeling and theRRrandomly permuted labelings are exchangeable\. Therefore,p^R\\widehat\{p\}\_\{R\}is super\-uniform under𝑯0\\bm\{H\}\_\{0\}, yielding

Pr⁡\(δα=1∣𝒜\)≤α\.\\Pr\\left\(\\delta\_\{\\alpha\}=1\\mid\\mathcal\{A\}\\right\)\\leq\\alpha\.Averaging over the independent calibration set and its calibration randomness gives

Pr𝑯0⁡\(δα=1\)≤α\.\\Pr\_\{\\bm\{H\}\_\{0\}\}\(\\delta\_\{\\alpha\}=1\)\\leq\\alpha\.Thus, the false\-alarm probability is controlled at the prescribed significance level\.

## Appendix CMaximum Mean Discrepancy

[Section2\.1](https://arxiv.org/html/2606.27832#S2.SS1)frames SAD as a two\-sample testing \(TST\) between the reference clean distributionℙ\\mathbb\{P\}and a query distributionℚ\\mathbb\{Q\}of potentiallyadversarial examples\(AEs\)\. Themaximum mean discrepancy\(MMD\) is a popular kernel two\-sample statistic used by existing SAD methods and by the SAMMD baseline evaluated in this paper\. This section provides a self\-contained account of kernel\-based TST and of the population and empirical forms of MMD that underlie Eq\.\([2\.1](https://arxiv.org/html/2606.27832#S2.Ex1)\)\.

Kernel\-based Two\-sample Testing \(TST\)asks whether two independent samples are generated from the same distributionGretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\)\. Formally, let𝒳\\mathcal\{X\}be the input space andX=\{𝒙i\}i=1n∼i\.i\.d\.ℙX=\\\{\\bm\{x\}\_\{i\}\\\}\_\{i=1\}^\{n\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{P\}and a query setY=\{𝒚j\}j=1m∼i\.i\.d\.ℚY=\\\{\\bm\{y\}\_\{j\}\\\}\_\{j=1\}^\{m\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{Q\}\. The goal of TST is to decide whetherℙ=ℚ\\mathbb\{P\}=\\mathbb\{Q\}\(cf\.Eq\.\([2](https://arxiv.org/html/2606.27832#S2.E2)\)\)\. When inputs are in high\-dimensional spaces \(e\.g\., images\), directly estimating the densities ofℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}is fragile\. Kernel methods emerge as a widely used class of non\-parametric approaches to sidestep this fragility\. These methods map each distribution into areproducing kernel Hilbert space\(RKHS\) where distributions are represented by their mean embeddings, and differences between distributions become distances between points in that RKHSGretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\); Muandet et al\. \([2017](https://arxiv.org/html/2606.27832#bib.bib41)\)\. By definition, letκ:𝒳×𝒳→ℝ\\kappa:\\mathcal\{X\}\\times\\mathcal\{X\}\\rightarrow\\mathbb\{R\}be a positive definite kernel with RKHSℋκ\\mathcal\{H\}\_\{\\kappa\}and associated mapκ​\(⋅,𝒙\)∈ℋκ\\kappa\(\\cdot,\\bm\{x\}\)\\in\\mathcal\{H\}\_\{\\kappa\}\. For any probability measureℝ\\mathbb\{R\}on𝒳\\mathcal\{X\}withEr∼ℝ​\[κ​\(r,r\)\]<∞E\_\{r\\sim\\mathbb\{R\}\}\\left\[\\sqrt\{\\kappa\(r,r\)\}\\right\]<\\infty, its kernel mean embedding is

𝝁ℝ=Er∼ℝ​\[κ​\(⋅,r\)\]∈ℋκ\.\\bm\{\\mu\}\_\{\\mathbb\{R\}\}=E\_\{r\\sim\\mathbb\{R\}\}\\left\[\\kappa\(\\cdot,r\)\\right\]\\in\\mathcal\{H\}\_\{\\kappa\}\.Specializing toℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}gives

𝝁ℙ=E𝒙∼ℙ​\[κ​\(⋅,𝒙\)\]and𝝁ℚ=E𝒚∼ℚ​\[κ​\(⋅,𝒚\)\]\.\\bm\{\\mu\}\_\{\\mathbb\{P\}\}=E\_\{\\bm\{x\}\\sim\\mathbb\{P\}\}\\left\[\\kappa\(\\cdot,\\bm\{x\}\)\\right\]\\quad\\text\{and\}\\quad\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}=E\_\{\\bm\{y\}\\sim\\mathbb\{Q\}\}\\left\[\\kappa\(\\cdot,\\bm\{y\}\)\\right\]\.Ifκ\\kappaischaracteristic, this embedding is injectiveBiggs et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib2)\):

𝝁ℙ=𝝁ℚ​if and only if​ℙ=ℚ\.\\bm\{\\mu\}\_\{\\mathbb\{P\}\}=\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\;\\;\\textit\{ if and only if \}\\;\\;\\mathbb\{P\}=\\mathbb\{Q\}\.Kernel\-based TST, therefore, rephrases the hypotheses as

𝑯0M:𝝁ℙ=𝝁ℚand𝑯1M:𝝁ℙ≠𝝁ℚ,\\bm\{H\}^\{\\textnormal\{M\}\}\_\{0\}:\\bm\{\\mu\}\_\{\\mathbb\{P\}\}=\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\ \\ \\ \\text\{and\}\\ \\ \\ \\bm\{H\}^\{\\textnormal\{M\}\}\_\{1\}:\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\\neq\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\ ,\(14\)and bases the test on a norm of𝝁ℙ−𝝁ℚ\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\-\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\. Specifically, themean maximum discrepancy\(MMD\) statisticGretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\)uses the squared RKHS distance \(i\.e\.,ℓ2\\ell\_\{2\}norm\) between these mean embeddings, which admits a simple expression in terms of kernel evaluations\.

Maximum Mean Discrepancy \(MMD\)Gretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\)is a popular kernel\-based metric that assesses the kernel mean embedding equality with kernelκ\\kappa:

MMD2​\(ℙ,ℚ,κ\)=‖𝝁ℙ−𝝁ℚ‖ℋκ2\.\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\},\\kappa\)=\\\|\\bm\{\\mu\}\_\{\\mathbb\{P\}\}\-\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\\\|\_\{\\mathcal\{H\}\_\{\\kappa\}\}^\{2\}\.Using the reproducing property⟨κ​\(⋅,𝒙\),κ​\(⋅,𝒙′\)⟩ℋκ=κ​\(𝒙,𝒙′\)\\langle\\kappa\(\\cdot,\\bm\{x\}\),\\kappa\(\\cdot,\\bm\{x\}^\{\\prime\}\)\\rangle\_\{\\mathcal\{H\}\_\{\\kappa\}\}=\\kappa\(\\bm\{x\},\\bm\{x\}^\{\\prime\}\)and expanding the square gives us the following:

MMD2​\(ℙ,ℚ;κ\)=E𝒙,𝒙′∼i\.i\.d\.ℙ​\[κ​\(𝒙,𝒙′\)\]\+E𝒚,𝒚′∼i\.i\.d\.ℚ​\[κ​\(𝒚,𝒚′\)\]−2​E𝒙∼ℙ,𝒚∼ℚ​\[κ​\(𝒙,𝒚\)\]\.\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\};\\kappa\)=E\_\{\\bm\{x\},\\bm\{x\}^\{\\prime\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{P\}\}\\left\[\\kappa\(\\bm\{x\},\\bm\{x\}^\{\\prime\}\)\\right\]\+E\_\{\\bm\{y\},\\bm\{y\}^\{\\prime\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{Q\}\}\\left\[\\kappa\(\\bm\{y\},\\bm\{y\}^\{\\prime\}\)\\right\]\-2E\_\{\\bm\{x\}\\sim\\mathbb\{P\},\\bm\{y\}\\sim\\mathbb\{Q\}\}\\left\[\\kappa\(\\bm\{x\},\\bm\{y\}\)\\right\]\.For a characteristic kernel,MMD2​\(ℙ,ℚ;κ\)=0\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\};\\kappa\)=0if and only ifℙ=ℚ\\mathbb\{P\}=\\mathbb\{Q\}Gretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\); Biggs et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib2)\)\.

Empirical Estimator\.In practice, the distributionsℙ\\mathbb\{P\}andℚ\\mathbb\{Q\}are rarely available in closed form, as well as the population embeddings𝝁ℙ\\bm\{\\mu\}\_\{\\mathbb\{P\}\}and𝝁ℚ\\bm\{\\mu\}\_\{\\mathbb\{Q\}\}\. For the samplesXXandYY, we can construct an unbiased estimator ofMMD2​\(ℙ,ℚ;κ\)\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\};\\kappa\)by the U\-statistic:

MMD^2​\(X,Y;κ\)=∑i≠jnκ​\(𝒙i,𝒙j\)n​\(n−1\)−∑i=1n∑j=1m2​κ​\(𝒙i,𝒚j\)n​m\+∑i≠jmκ​\(𝒚i,𝒚j\)m​\(m−1\)\.\\widehat\{\\textnormal\{MMD\}\}^\{2\}\(X,Y;\\kappa\)=\\sum\_\{i\\neq j\}^\{n\}\\frac\{\\kappa\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\}\)\}\{n\(n\-1\)\}\-\\sum\_\{i=1\}^\{n\}\\sum\_\{j=1\}^\{m\}\\frac\{2\\kappa\(\\bm\{x\}\_\{i\},\\bm\{y\}\_\{j\}\)\}\{nm\}\+\\sum\_\{i\\neq j\}^\{m\}\\frac\{\\kappa\(\\bm\{y\}\_\{i\},\\bm\{y\}\_\{j\}\)\}\{m\(m\-1\)\}\\ \.Under the sampling𝒙i∼i\.i\.d\.ℙ\\bm\{x\}\_\{i\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{P\}and𝒚i∼i\.i\.d\.ℚ\\bm\{y\}\_\{i\}\\stackrel\{\{\\scriptstyle\\text\{i\.i\.d\.\}\}\}\{\{\\sim\}\}\\mathbb\{Q\}, this estimator satisfiesE​\[MMD^2​\(X,Y;κ\)\]=MMD2​\(ℙ,ℚ;κ\)E\\left\[\\widehat\{\\textnormal\{MMD\}\}^\{2\}\(X,Y;\\kappa\)\\right\]=\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\};\\kappa\)Gretton et al\. \([2012](https://arxiv.org/html/2606.27832#bib.bib19)\)\.

In the main text, we denote the population quantity byMMD2​\(ℙ,ℚ;κ\)\\mathrm\{MMD\}^\{2\}\(\\mathbb\{P\},\\mathbb\{Q\};\\kappa\)\(Eq\.\([2\.1](https://arxiv.org/html/2606.27832#S2.Ex1)\)\)\. When MMD is used as a SADtest statistic, its empirical estimateMMD^2​\(X,Y;κ\)\\widehat\{\\textnormal\{MMD\}\}^\{2\}\(X,Y;\\kappa\)plays the role of𝒯​\(X,Y\)\\mathcal\{T\}\(X,Y\)in[Section2\.1](https://arxiv.org/html/2606.27832#S2.SS1)\. Then, a permutation test \(detailed in[AppendixB](https://arxiv.org/html/2606.27832#A2)\) is applied toMMD^2​\(X,Y;κ\)\\widehat\{\\textnormal\{MMD\}\}^\{2\}\(X,Y;\\kappa\)to obtain a thresholdtαt\_\{\\alpha\}such thatPr⁡\(𝒯​\(X,Y\)\>tα∣𝑯0\)≈α\\Pr\(\\mathcal\{T\}\(X,Y\)\>t\_\{\\alpha\}\\mid\\bm\{H\}\_\{0\}\)\\approx\\alpha\.

MMD on Semantic Features\.In existing SAD practicesGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\); Zhang et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib56)\), MMD\-based SAD methods do not work directly on raw pixels, but on semantic featuresf​\(𝒙\)∈ℱf\(\\bm\{x\}\)\\in\\mathcal\{F\}typically extracted from the penultimate layer of the threat classifier \(i\.e\., the classifier under attack\)\. This is equivalent to composing the kernel with the feature mapκ​\(f​\(𝒙\),f​\(𝒙′\)\)\\kappa\(f\(\\bm\{x\}\),f\(\\bm\{x\}^\{\\prime\}\)\)and computingMMD^2​\(X,Y;κ\)\\widehat\{\\textnormal\{MMD\}\}^\{2\}\(X,Y;\\kappa\)\. The SAMMD baseline used in our experiments applies this feature\-space MMD, together with calibrated thresholds, to detect adversarial deviations; the mathematical definitions above remain unchanged under this composition\.

## Appendix DProofs of Theoretical Analysis

We provide here the proofs of the theoretical results presented in the main text\. We begin by presenting several foundational concepts and concentration results forUU\-statistics, which serve as key tools in our analysis\.

###### Definition 5\.

Kim et al\.\([2022](https://arxiv.org/html/2606.27832#bib.bib32)\)Letg​\(𝐱,𝐲\)g\(\\bm\{x\},\\bm\{y\}\)be a bivariate function, which is symmetric in its arguments, i\.e\.,g​\(𝐱,𝐲\)=g​\(𝐲,𝐱\)g\(\\bm\{x\},\\bm\{y\}\)=g\(\\bm\{y\},\\bm\{x\}\)\. We define a function for a two\-sampleUU\-statistic ash​\(𝐱1,𝐱2;𝐲1,𝐲2\)h\(\\bm\{x\}\_\{1\},\\bm\{x\}\_\{2\};\\bm\{y\}\_\{1\},\\bm\{y\}\_\{2\}\), which is composed of evaluations ofggover the variables𝐱1,𝐱2,𝐲1\\bm\{x\}\_\{1\},\\bm\{x\}\_\{2\},\\bm\{y\}\_\{1\}and𝐲2\\bm\{y\}\_\{2\}, and is symmetric, i\.e\.,h​\(𝐱1,𝐱2;𝐲1,𝐲2\)=h​\(𝐱2,𝐱1;𝐲2,𝐲1\)h\(\\bm\{x\}\_\{1\},\\bm\{x\}\_\{2\};\\bm\{y\}\_\{1\},\\bm\{y\}\_\{2\}\)=h\(\\bm\{x\}\_\{2\},\\bm\{x\}\_\{1\};\\bm\{y\}\_\{2\},\\bm\{y\}\_\{1\}\)\. Suppose we have two samplesX=\{𝐱i\}i=1n∼ℙnX=\\\{\\bm\{x\}\_\{i\}\\\}\_\{i=1\}^\{n\}\\sim\\mathbb\{P\}^\{n\}andY=\{𝐲i\}i=1m∼ℚmY=\\\{\\bm\{y\}\_\{i\}\\\}\_\{i=1\}^\{m\}\\sim\\mathbb\{Q\}^\{m\}\. The two\-sample U\-statistic is given by:

Un,m​\(X,Y;ϕ\)=\(n2\)−1​\(m2\)−1​∑i<jn∑k<lmh​\(𝒙i,𝒙j;𝒚k,𝒚l\)\.U\_\{n,m\}\(X,Y;\\phi\)=\\binom\{n\}\{2\}^\{\-1\}\\binom\{m\}\{2\}^\{\-1\}\\sum\_\{i<j\}^\{n\}\\sum\_\{k<l\}^\{m\}h\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\};\\bm\{y\}\_\{k\},\\bm\{y\}\_\{l\}\)\\ \.

Next, we present a standard large\-deviation bound for boundedUU\-statistics\.

###### Theorem 6\.

Hoeffding\([1994](https://arxiv.org/html/2606.27832#bib.bib25)\)If the functionhhis bounded, that is,a≤h​\(𝐱1,𝐱2;𝐲1,𝐲2\)≤ba\\leq h\(\\bm\{x\}\_\{1\},\\bm\{x\}\_\{2\};\\bm\{y\}\_\{1\},\\bm\{y\}\_\{2\}\)\\leq b, and assumen≤mn\\leq m, then for anyt\>0t\>0,

Pr⁡\(\|Un,m​\(X,Y;ϕ\)−θ\|≥t\)≤2​exp⁡\(−2​⌊n/r⌋​t2/\(b−a\)2\),\\Pr\(\|U\_\{n,m\}\(X,Y;\\phi\)\-\\theta\|\\geq t\)\\leq 2\\exp\{\(\-2\\lfloor n/r\\rfloor t^\{2\}/\(b\-a\)^\{2\}\)\}\\ ,whereθ=E​\[h​\(𝐱1,𝐱2;𝐲1,𝐲2\)\]\\theta=E\[h\(\\bm\{x\}\_\{1\},\\bm\{x\}\_\{2\};\\bm\{y\}\_\{1\},\\bm\{y\}\_\{2\}\)\]\.

We now introduce the notation for permutation\-based statistics\. Let𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}denote the set of all possible permutations of\{1,…,n,n\+1,…,n\+m\}\\\{1,\\dots,n,n\+1,\\dots,n\+m\\\}over the pooled sampleZ=\{𝒙1,…,𝒙n,𝒚1,…,𝒚m\}=\{𝒛1,…,𝒛n,𝒛n\+1,…,𝒛n\+m\}Z=\\\{\\bm\{x\}\_\{1\},\\dots,\\bm\{x\}\_\{n\},\\bm\{y\}\_\{1\},\\dots,\\bm\{y\}\_\{m\}\\\}=\\\{\\bm\{z\}\_\{1\},\\dots,\\bm\{z\}\_\{n\},\\bm\{z\}\_\{n\+1\},\\dots,\\bm\{z\}\_\{n\+m\}\\\}\. Given a permutation𝝅=\(π1,…,πn,πn\+1,…,πn\+m\)∈𝚷n\+m\\bm\{\\pi\}=\\left\(\\pi\_\{1\},\\dots,\\pi\_\{n\},\\pi\_\{n\+1\},\\dots,\\pi\_\{n\+m\}\\right\)\\in\\bm\{\\Pi\}\_\{n\+m\}, defineX𝝅=\{𝒛πi\}i=1nX\_\{\\bm\{\\pi\}\}=\\\{\\bm\{z\}\_\{\\pi\_\{i\}\}\\\}\_\{i=1\}^\{n\}andY𝝅=\{𝒛πi\}i=n\+1n\+mY\_\{\\bm\{\\pi\}\}=\\\{\\bm\{z\}\_\{\\pi\_\{i\}\}\\\}\_\{i=n\+1\}^\{n\+m\}\.

We next state a useful concentration inequality for permutedUU\-statistics, which will be repeatedly used in the proofs below\.

###### Theorem 7\.

\(Kim et al\.,[2022](https://arxiv.org/html/2606.27832#bib.bib32), Theorem 6\.1\)Consider the permuted two\-sampleUU\-statisticU​\(X𝛑,Y𝛑;ϕ\)U\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\phi\)and assumen≤mn\\leq m\. Define

Σn,m2:=1n2​\(n−1\)2​sup𝝅∈𝚷n\+m\{∑i<jng2​\(𝒛πi,𝒛πj\)\}\.\\Sigma\_\{n,m\}^\{2\}:=\\frac\{1\}\{n^\{2\}\\left\(n\-1\\right\)^\{2\}\}\\sup\_\{\\bm\{\\pi\}\\in\\bm\{\\Pi\}\_\{n\+m\}\}\\left\\\{\\sum\_\{i<j\}^\{n\}g^\{2\}\\left\(\\bm\{z\}\_\{\\pi\_\{i\}\},\\bm\{z\}\_\{\\pi\_\{j\}\}\\right\)\\right\\\}\.Then, for everyt\>0t\>0and some constantC\>0C\>0, we have

Pr⁡\(U​\(X𝝅,Y𝝅;ϕ\)≥t\)≤exp⁡\(−C​min⁡\(t2Σn,m2,tΣn,m\)\)\.\\Pr\\left\(U\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\phi\)\\geq t\\right\)\\leq\\exp\\left\(\-C\\min\\left\(\\frac\{t^\{2\}\}\{\\Sigma\_\{n,m\}^\{2\}\},\\frac\{t\}\{\\Sigma\_\{n,m\}\}\\right\)\\right\)\\ \.

### D\.1Detailed Proofs of Theorem[1](https://arxiv.org/html/2606.27832#Thmtheorem1)

We begin with a useful definition as follows\.

###### Definition 8\.

\(Hemerik & Goeman,[2018](https://arxiv.org/html/2606.27832#bib.bib24)\)LetZZbe the sample taking values in the instance space𝒳\\mathcal\{X\}\. Let𝒢\\mathcal\{G\}be a finite set of transformationsg:𝒳→𝒳g:\\mathcal\{X\}\\rightarrow\\mathcal\{X\}, such that𝒢\\mathcal\{G\}is a group with respect to the operation of composition of transformations\. Letℋ0\\mathcal\{H\}\_\{0\}be any null hypothesis which implies that the joint distribution of the test statisticsT​\(g​Z\)T\(gZ\),g∈𝒢g\\in\\mathcal\{G\}, is invariant under all transformations in𝒢\\mathcal\{G\}ofZZ\. Denote byRRthe cardinality of the set𝒢\\mathcal\{G\}and write𝒢=\{g1,…,gR\}\\mathcal\{G\}=\\\{g\_\{1\},\.\.\.,g\_\{R\}\\\}\. We have, underℋ0\\mathcal\{H\}\_\{0\},

\(T​\(g1​Z\),…,T​\(gR​Z\)\)=d\(T​\(g⋅g1​Z\),…,T​\(g⋅gR​Z\)\)for all​g∈𝒢,\\left\(T\(g\_\{1\}Z\),\.\.\.,T\(g\_\{R\}Z\)\\right\)\\stackrel\{\{\\scriptstyle d\}\}\{\{=\}\}\\left\(T\(g\\cdot g\_\{1\}Z\),\.\.\.,T\(g\\cdot g\_\{R\}Z\)\\right\)\\ \\ \\ \\text\{for all\}\\ g\\in\\mathcal\{G\}\\ ,where=d\\stackrel\{\{\\scriptstyle d\}\}\{\{=\}\}denotes equality in distribution\.

We present the proofs of Theorem[1](https://arxiv.org/html/2606.27832#Thmtheorem1)as follows

###### Proof\.

For USAD, let𝒜\\mathcal\{A\}denote the auxiliary clean calibration setXcalX\_\{\\rm cal\}and the randomness used to estimateΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}\. By construction,𝒜\\mathcal\{A\}is independent of\(X,Y\)\(X,Y\)\. We condition throughout on𝒜\\mathcal\{A\}, under whichΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}is fixed and the same matrix is used for the observed statistic and all permuted statistics\. For VD and PCD,𝒜\\mathcal\{A\}may be taken to be trivial\. For PCD, each sample and its perturbation\-induced covariance matrix are treated as one augmented observation and are permuted together\.

It is easy to see that the permutation set𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}forms a group under the operation of composition of transformations\. Moreover, when the test batchYYconsists of clean data,XXandYYare drawn from the same distribution\. Hence, conditional on𝒜\\mathcal\{A\},ZZis exchangeable with respect to𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}, and the joint law of

\{STAT​\(𝝅​Z;ϕ\):𝝅∈𝚷n\+m\}\\left\\\{\\textnormal\{STAT\}\(\\bm\{\\pi\}Z;\\phi\):\\bm\{\\pi\}\\in\\bm\{\\Pi\}\_\{n\+m\}\\right\\\}is invariant under left composition by any𝝅∈𝚷n\+m\\bm\{\\pi\}\\in\\bm\{\\Pi\}\_\{n\+m\}\. Therefore, Definition[8](https://arxiv.org/html/2606.27832#Thmtheorem8)applies\.

Let

M=\|𝚷n\+m\|=\(n\+m\)\!M=\|\\bm\{\\Pi\}\_\{n\+m\}\|=\(n\+m\)\!and write𝚷n\+m=\{𝝅\(1\),…,𝝅\(M\)\}\\bm\{\\Pi\}\_\{n\+m\}=\\\{\\bm\{\\pi\}\_\{\(1\)\},\\dots,\\bm\{\\pi\}\_\{\(M\)\}\\\}\. The identity permutation is included, soSTAT​\(Z;ϕ\)=STAT​\(X,Y;ϕ\)\\textnormal\{STAT\}\(Z;\\phi\)=\\textnormal\{STAT\}\(X,Y;\\phi\)is one element of the multiset

\{STAT​\(𝝅\(1\)​Z;ϕ\),…,STAT​\(𝝅\(M\)​Z;ϕ\)\}\.\\left\\\{\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(1\)\}Z;\\phi\),\\dots,\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(M\)\}Z;\\phi\)\\right\\\}\.By Definition[8](https://arxiv.org/html/2606.27832#Thmtheorem8), for a uniformly distributed𝝅∼Unif​\(𝚷n\+m\)\\bm\{\\pi\}\\sim\\mathrm\{Unif\}\(\\bm\{\\Pi\}\_\{n\+m\}\)independent ofZZ,

\(STAT​\(𝝅\(1\)​Z;ϕ\),…,STAT​\(𝝅\(M\)​Z;ϕ\)\)=d\(STAT​\(𝝅⋅𝝅\(1\)​Z;ϕ\),…,STAT​\(𝝅⋅𝝅\(M\)​Z;ϕ\)\),\\begin\{split\}&\\big\(\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(1\)\}Z;\\phi\),\\dots,\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(M\)\}Z;\\phi\)\\big\)\\\\ &\\qquad\\stackrel\{\{\\scriptstyle d\}\}\{\{=\}\}\\big\(\\textnormal\{STAT\}\(\\bm\{\\pi\}\\cdot\\bm\{\\pi\}\_\{\(1\)\}Z;\\phi\),\\dots,\\textnormal\{STAT\}\(\\bm\{\\pi\}\\cdot\\bm\{\\pi\}\_\{\(M\)\}Z;\\phi\)\\big\),\\end\{split\}conditional on𝒜\\mathcal\{A\}\. Since left composition by𝝅\\bm\{\\pi\}is a bijection of𝚷n\+m\\bm\{\\Pi\}\_\{n\+m\}, conditional on the permutation orbit

𝒪​\(Z\)≜\{𝝅​Z:𝝅∈𝚷n\+m\},\\mathcal\{O\}\(Z\)\\triangleq\\\{\\bm\{\\pi\}Z:\\bm\{\\pi\}\\in\\bm\{\\Pi\}\_\{n\+m\}\\\},the observed labeling is uniformly distributed over the orbit\. Consequently, the full permutationpp\-value

pfull=1M​∑i=1M𝕀​\[STAT​\(𝝅\(i\)​Z;ϕ\)≥STAT​\(Z;ϕ\)\]p\_\{\\rm full\}=\\frac\{1\}\{M\}\\sum\_\{i=1\}^\{M\}\\mathbb\{I\}\\left\[\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(i\)\}Z;\\phi\)\\geq\\textnormal\{STAT\}\(Z;\\phi\)\\right\]is super\-uniform under𝑯0\\bm\{H\}\_\{0\}\. Equivalently, the permutation rank is uniform after random tie\-breaking; counting ties as exceedances makes the resulting test conservative\.

In practical implementation \(see Appendix[B](https://arxiv.org/html/2606.27832#A2)\), we approximate the full permutation distribution usingR<MR<Mindependently sampled permutations

𝝅\(1\),…,𝝅\(R\)​∼i\.i\.d\.​Unif​\(𝚷n\+m\),\\bm\{\\pi\}\_\{\(1\)\},\\dots,\\bm\{\\pi\}\_\{\(R\)\}\\overset\{\\mathrm\{i\.i\.d\.\}\}\{\\sim\}\\mathrm\{Unif\}\(\\bm\{\\Pi\}\_\{n\+m\}\),independently ofZZand𝒜\\mathcal\{A\}\. Define

STAT\(0\)=STAT​\(Z;ϕ\),STAT\(r\)=STAT​\(𝝅\(r\)​Z;ϕ\),r=1,…,R\.\\textnormal\{STAT\}^\{\(0\)\}=\\textnormal\{STAT\}\(Z;\\phi\),\\qquad\\textnormal\{STAT\}^\{\(r\)\}=\\textnormal\{STAT\}\(\\bm\{\\pi\}\_\{\(r\)\}Z;\\phi\),\\quad r=1,\\dots,R\.Conditional on𝒜\\mathcal\{A\}and𝒪​\(Z\)\\mathcal\{O\}\(Z\), the observed labeling and theRRrandomly permuted labelings are exchangeable\. Hence,

\(STAT\(0\),STAT\(1\),…,STAT\(R\)\)\\big\(\\textnormal\{STAT\}^\{\(0\)\},\\textnormal\{STAT\}^\{\(1\)\},\\dots,\\textnormal\{STAT\}^\{\(R\)\}\\big\)is exchangeable, and the Monte\-Carlo permutationpp\-value

p^R=1\+∑r=1R𝕀​\[STAT\(r\)≥STAT\(0\)\]R\+1\\widehat\{p\}\_\{R\}=\\frac\{1\+\\sum\_\{r=1\}^\{R\}\\mathbb\{I\}\\left\[\\textnormal\{STAT\}^\{\(r\)\}\\geq\\textnormal\{STAT\}^\{\(0\)\}\\right\]\}\{R\+1\}is super\-uniform under𝑯0\\bm\{H\}\_\{0\}\.

To express the same test using a threshold, let

STAT\[1\]≤⋯≤STAT\[R\]\\textnormal\{STAT\}\_\{\[1\]\}\\leq\\cdots\\leq\\textnormal\{STAT\}\_\{\[R\]\}be the ordered values of\{STAT\(r\)\}r=1R\\\{\\textnormal\{STAT\}^\{\(r\)\}\\\}\_\{r=1\}^\{R\}and define

kα,R=⌈\(1−α\)​\(R\+1\)⌉,k\_\{\\alpha,R\}=\\left\\lceil\(1\-\\alpha\)\(R\+1\)\\right\\rceil,and

τα​\(Z,\{𝝅\(r\)\}r=1R\)=\{STAT\[kα,R\],kα,R≤R,\+∞,kα,R=R\+1\.\\tau\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)=\\begin\{cases\}\\textnormal\{STAT\}\_\{\[k\_\{\\alpha,R\}\]\},&k\_\{\\alpha,R\}\\leq R,\\\\\[2\.0pt\] \+\\infty,&k\_\{\\alpha,R\}=R\+1\.\\end\{cases\}By construction,

p^R≤α⟺STAT​\(Z;ϕ\)\>τα​\(Z,\{𝝅\(r\)\}r=1R\)\.\\widehat\{p\}\_\{R\}\\leq\\alpha\\quad\\Longleftrightarrow\\quad\\textnormal\{STAT\}\(Z;\\phi\)\>\\tau\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)\.Therefore,

Pr⁡\(δα=1∣𝒜\)≡Pr⁡\(STAT​\(Z;ϕ\)\>τα​\(Z,\{𝝅\(r\)\}r=1R\)\|𝒜\)=Pr⁡\(p^R≤α∣𝒜\)≤α\.\\begin\{split\}\\Pr\(\\delta\_\{\\alpha\}=1\\mid\\mathcal\{A\}\)&\\equiv\\Pr\\left\(\\textnormal\{STAT\}\(Z;\\phi\)\>\\tau\_\{\\alpha\}\\bigl\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\bigr\)\\;\\middle\|\\;\\mathcal\{A\}\\right\)\\\\ &=\\Pr\(\\widehat\{p\}\_\{R\}\\leq\\alpha\\mid\\mathcal\{A\}\)\\leq\\alpha\.\\end\{split\}Finally, averaging over the independent calibration data and its calibration randomness yields

Pr𝑯0⁡\(δα=1\)≤α\.\\Pr\_\{\\bm\{H\}\_\{0\}\}\(\\delta\_\{\\alpha\}=1\)\\leq\\alpha\.∎

### D\.2Detailed Proofs of Theorem[2](https://arxiv.org/html/2606.27832#Thmtheorem2)

We present the proofs of Theorem[2](https://arxiv.org/html/2606.27832#Thmtheorem2)as follows

###### Proof\.

Recall the definition of VD as

VD​\(ℙ,ℚ;ℓ\)=\(Vℙ−Vℚ\)2\.\\textnormal\{VD\}\(\\mathbb\{P\},\\mathbb\{Q\};\\ell\)=\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)^\{2\}\\ \.The corresponding estimator is

VD^​\(X,Y;ℓ\)\\displaystyle\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)=\\displaystyle=\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)\)2,\\displaystyle\\left\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\\right\)^\{2\}\\ ,where

V^​\(X;ℓ\)=∑inℓ​\(f​\(𝒙i\),f​\(𝒙i\)\)n−∑i≠jnℓ​\(f​\(𝒙i\),f​\(𝒙j\)\)n​\(n−1\),\\displaystyle\\widehat\{V\}\(X;\\ell\)=\\sum\_\{i\}^\{n\}\\frac\{\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{i\}\)\)\}\{n\}\-\\sum\_\{i\\neq j\}^\{n\}\\frac\{\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{j\}\)\)\}\{n\(n\-1\)\}\\ ,V^​\(Y;ℓ\)=∑imℓ​\(f​\(𝒚i\),f​\(𝒚i\)\)m−∑i≠jmℓ​\(f​\(𝒚i\),f​\(𝒚j\)\)m​\(m−1\)\.\\displaystyle\\widehat\{V\}\(Y;\\ell\)=\\sum\_\{i\}^\{m\}\\frac\{\\ell\(f\(\\bm\{y\}\_\{i\}\),f\(\\bm\{y\}\_\{i\}\)\)\}\{m\}\-\\sum\_\{i\\neq j\}^\{m\}\\frac\{\\ell\(f\(\\bm\{y\}\_\{i\}\),f\(\\bm\{y\}\_\{j\}\)\)\}\{m\(m\-1\)\}\\ \.These two estimators can be equivalently written as second\-orderUU\-statistics:

V^​\(X;ℓ\)=\(n2\)−1​∑i<jnℓ​\(f​\(𝒙i\),f​\(𝒙i\)\)\+ℓ​\(f​\(𝒙j\),f​\(𝒙j\)\)2−ℓ​\(f​\(𝒙i\),f​\(𝒙j\)\),\\displaystyle\\widehat\{V\}\(X;\\ell\)=\\binom\{n\}\{2\}^\{\-1\}\\sum\_\{i<j\}^\{n\}\\frac\{\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{i\}\)\)\+\\ell\(f\(\\bm\{x\}\_\{j\}\),f\(\\bm\{x\}\_\{j\}\)\)\}\{2\}\-\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{j\}\)\)\\ ,V^​\(Y;ℓ\)=\(m2\)−1​∑i<jmℓ​\(f​\(𝒚i\),f​\(𝒚i\)\)\+ℓ​\(f​\(𝒚j\),f​\(𝒚j\)\)2−ℓ​\(f​\(𝒚i\),f​\(𝒚j\)\)\.\\displaystyle\\widehat\{V\}\(Y;\\ell\)=\\binom\{m\}\{2\}^\{\-1\}\\sum\_\{i<j\}^\{m\}\\frac\{\\ell\(f\(\\bm\{y\}\_\{i\}\),f\(\\bm\{y\}\_\{i\}\)\)\+\\ell\(f\(\\bm\{y\}\_\{j\}\),f\(\\bm\{y\}\_\{j\}\)\)\}\{2\}\-\\ell\(f\(\\bm\{y\}\_\{i\}\),f\(\\bm\{y\}\_\{j\}\)\)\\ \.Assumeℓ\\ellis bounded on the range offf:\|ℓ​\(f​\(𝒙\),f​\(𝒚\)\)\|≤K\|\\ell\(f\(\\bm\{x\}\),f\(\\bm\{y\}\)\)\|\\leq Kfor all𝒙,𝒚∈𝒳\\bm\{x\},\\bm\{y\}\\in\\mathcal\{X\}with the constantK\>0K\>0\. Then\|Vℙ\|,\|Vℚ\|,\|V^​\(X;ℓ\)\|,\|V^​\(Y;ℓ\)\|≤K\|V\_\{\\mathbb\{P\}\}\|,\|V\_\{\\mathbb\{Q\}\}\|,\|\\widehat\{V\}\(X;\\ell\)\|,\|\\widehat\{V\}\(Y;\\ell\)\|\\leq K, and hence

\|VD​\(ℙ,ℚ;ℓ\)−VD^​\(X,Y;ℓ\)\|\\displaystyle\\left\|\\textnormal\{VD\}\(\\mathbb\{P\},\\mathbb\{Q\};\\ell\)\-\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)\\right\|=\\displaystyle=\|\(Vℙ−Vℚ\)2−\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)\)2\|\\displaystyle\\left\|\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)^\{2\}\-\\left\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\\right\)^\{2\}\\right\|\(15\)=\\displaystyle=\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)−\(Vℙ−Vℚ\)\)​\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)\+\(Vℙ−Vℚ\)\)\\displaystyle\\left\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\-\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)\\right\)\\left\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\+\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)\\right\)≤\\displaystyle\\leq\|V^​\(X;ℓ\)−V^​\(Y;ℓ\)−\(Vℙ−Vℚ\)\|⋅\|V^​\(X;ℓ\)−V^​\(Y;ℓ\)\+\(Vℙ−Vℚ\)\|\\displaystyle\\left\|\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\-\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)\\right\|\\cdot\\left\|\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\+\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)\\right\|<\\displaystyle<4​K⋅\|V^​\(X;ℓ\)−V^​\(Y;ℓ\)−\(Vℙ−Vℚ\)\|\.\\displaystyle 4K\\cdot\\left\|\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\-\\left\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\right\)\\right\|\\ \.
Here, the estimator ofVℙ−VℚV\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}can be further present as a two\-sampleUU\-statistic as in Definition[5](https://arxiv.org/html/2606.27832#Thmtheorem5)

V^​\(X;ℓ\)−V^​\(Y;ℓ\)=\(n2\)−1​\(m2\)−1​∑i<jn∑k<lmhVD​\(𝒙i,𝒙j;𝒚k,𝒚l\),\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)=\\binom\{n\}\{2\}^\{\-1\}\\binom\{m\}\{2\}^\{\-1\}\\sum\_\{i<j\}^\{n\}\\sum\_\{k<l\}^\{m\}h\_\{\\textnormal\{VD\}\}\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\};\\bm\{y\}\_\{k\},\\bm\{y\}\_\{l\}\)\\ ,where

hVD​\(𝒙i,𝒙j;𝒚k,𝒚l\)\\displaystyle h\_\{\\textnormal\{VD\}\}\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\};\\bm\{y\}\_\{k\},\\bm\{y\}\_\{l\}\)=\\displaystyle=ℓ​\(f​\(𝒙i\),f​\(𝒙i\)\)\+ℓ​\(f​\(𝒙j\),f​\(𝒙j\)\)2−ℓ​\(f​\(𝒙i\),f​\(𝒙j\)\)\\displaystyle\\frac\{\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{i\}\)\)\+\\ell\(f\(\\bm\{x\}\_\{j\}\),f\(\\bm\{x\}\_\{j\}\)\)\}\{2\}\-\\ell\(f\(\\bm\{x\}\_\{i\}\),f\(\\bm\{x\}\_\{j\}\)\)−ℓ​\(f​\(𝒚k\),f​\(𝒚k\)\)\+ℓ​\(f​\(𝒚l\),f​\(𝒚l\)\)2\+ℓ​\(f​\(𝒚k\),f​\(𝒚l\)\)\.\\displaystyle\\qquad\\qquad\-\\frac\{\\ell\(f\(\\bm\{y\}\_\{k\}\),f\(\\bm\{y\}\_\{k\}\)\)\+\\ell\(f\(\\bm\{y\}\_\{l\}\),f\(\\bm\{y\}\_\{l\}\)\)\}\{2\}\+\\ell\(f\(\\bm\{y\}\_\{k\}\),f\(\\bm\{y\}\_\{l\}\)\)\\ \.Under the alternative hypothesis𝑯1V:Vℙ≠Vℚ\\bm\{H\}^\{\\textnormal\{V\}\}\_\{1\}:V\_\{\\mathbb\{P\}\}\\neq V\_\{\\mathbb\{Q\}\}, we have that

V^​\(X;ℓ\)−V^​\(Y;ℓ\)→𝑃Vℙ−Vℚ≠0,\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\\xrightarrow\{P\}V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\\neq 0\\ ,by Theorem[6](https://arxiv.org/html/2606.27832#Thmtheorem6), where→𝑃\\xrightarrow\{P\}denotes convergence in probability, and hence

VD^​\(X,Y;ℓ\)≡\(V^​\(X;ℓ\)−V^​\(Y;ℓ\)\)2→\(Vℙ−Vℚ\)2\>0,\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)\\equiv\(\\widehat\{V\}\(X;\\ell\)\-\\widehat\{V\}\(Y;\\ell\)\)^\{2\}\\rightarrow\(V\_\{\\mathbb\{P\}\}\-V\_\{\\mathbb\{Q\}\}\)^\{2\}\>0\\ ,by Eq\. \([15](https://arxiv.org/html/2606.27832#A4.E15)\)\.

Under a uniformly random permutation𝝅∈𝚷\\bm\{\\pi\}\\in\\bm\{\\Pi\}, the two\-sampleUU\-statistic with permuted samplesX𝝅X\_\{\\bm\{\\pi\}\}andY𝝅Y\_\{\\bm\{\\pi\}\}exhibit the convergence that

V^​\(X𝝅;ℓ\)−V^​\(Y𝝅;ℓ\)→𝑃0,\\widehat\{V\}\(X\_\{\\bm\{\\pi\}\};\\ell\)\-\\widehat\{V\}\(Y\_\{\\bm\{\\pi\}\};\\ell\)\\xrightarrow\{P\}0\\ ,based on Theorem[7](https://arxiv.org/html/2606.27832#Thmtheorem7)asn,m→∞n,m\\rightarrow\\inftywithn/m→c∈\(0,∞\)n/m\\rightarrow c\\in\(0,\\infty\)\. Consequently, the permutation distribution ofV^​\(X𝝅;ℓ\)−V^​\(Y𝝅;ℓ\)\\widehat\{V\}\(X\_\{\\bm\{\\pi\}\};\\ell\)\-\\widehat\{V\}\(Y\_\{\\bm\{\\pi\}\};\\ell\)concentrates at zero and

VD^​\(X𝝅,Y𝝅;ℓ\)=\(V^​\(X𝝅;ℓ\)−V^​\(Y𝝅;ℓ\)\)2→𝑃0\.\\widehat\{\\textnormal\{VD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell\)=\(\\widehat\{V\}\(X\_\{\\bm\{\\pi\}\};\\ell\)\-\\widehat\{V\}\(Y\_\{\\bm\{\\pi\}\};\\ell\)\)^\{2\}\\xrightarrow\{P\}0\\ \.The empirical adjusted\(1−α\)\(1\-\\alpha\)\-quantileτα​\(Z,\{𝝅\(r\)\}r=1R\)\\tau\_\{\\alpha\}\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\)\(See Appendix[B](https://arxiv.org/html/2606.27832#A2)withSTAT​\(X,Y;ϕ\)=VD^​\(X,Y;ℓ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)\) of VD statistic also converges to0\.

which implies, by Slutsky’s theoremPapoulis & Pillai \([2001](https://arxiv.org/html/2606.27832#bib.bib42)\),

Pr⁡\(δα=1\)≡Pr⁡\(VD^​\(X,Y;ℓ\)\>τα​\(Z,\{𝝅\(r\)\}r=1R\)\)⟶1,\\Pr\(\\delta\_\{\\alpha\}=1\)\\equiv\\Pr\(\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)\>\\tau\_\{\\alpha\}\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\)\)\\ \\longrightarrow\\ 1\\ ,where the testδα\\delta\_\{\\alpha\}is the permutation procedure \(see Eq\. \([13](https://arxiv.org/html/2606.27832#A2.E13)\) in Appendix[B](https://arxiv.org/html/2606.27832#A2)withSTAT​\(X,Y;ϕ\)=VD^​\(X,Y;ℓ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\widehat\{\\textnormal\{VD\}\}\(X,Y;\\ell\)\)\. ∎

### D\.3Detailed Proofs of Theorem[3](https://arxiv.org/html/2606.27832#Thmtheorem3)

We present the proofs of Theorem[3](https://arxiv.org/html/2606.27832#Thmtheorem3)as follows

###### Proof\.

Recall the definition of PCD as

PCD​\(ℙ,ℚ,κ\)=‖𝝁Σℙ−𝝁Σℚ‖ℋρ2=E​\[ρ​\(Σ𝒙,Σ𝒙′\)\+ρ​\(Σ𝒚,Σ𝒚′\)−2​ρ​\(Σ𝒙,Σ𝒚\)\]\.\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\kappa\)=\\\|\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}\-\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}\\\|\_\{\\mathcal\{H\}\_\{\\rho\}\}^\{2\}=E\[\\rho\(\\Sigma\_\{\\bm\{x\}\},\\Sigma\_\{\\bm\{x\}^\{\\prime\}\}\)\+\\rho\(\\Sigma\_\{\\bm\{y\}\},\\Sigma\_\{\\bm\{y\}^\{\\prime\}\}\)\-2\\rho\(\\Sigma\_\{\\bm\{x\}\},\\Sigma\_\{\\bm\{y\}\}\)\]\\ \.The corresponding estimator is

PCD^​\(X,Y;ρ\)=∑i≠jnρ​\(Σ𝒙i,Σ𝒙j\)n​\(n−1\)−∑in∑jmρ​\(Σ𝒙i,Σ𝒚j\)n​m\+∑i≠jmρ​\(Σ𝒚i,Σ𝒚j\)m​\(m−1\)\.\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)=\\sum\_\{i\\neq j\}^\{n\}\\frac\{\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{x\}\_\{j\}\}\)\}\{n\(n\-1\)\}\-\\sum\_\{i\}^\{n\}\\sum\_\{j\}^\{m\}\\frac\{\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\}\{nm\}\+\\sum\_\{i\\neq j\}^\{m\}\\frac\{\\rho\(\\Sigma\_\{\\bm\{y\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\}\{m\(m\-1\)\}\\ \.which can be further present as a two\-sampleUU\-statistic as in Definition[5](https://arxiv.org/html/2606.27832#Thmtheorem5)

PCD^​\(X,Y;ρ\)=\(n2\)−1​\(m2\)−1​∑i<jn∑k<lmhPCD​\(𝒙i,𝒙j;𝒚k,𝒚l\),\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)=\\binom\{n\}\{2\}^\{\-1\}\\binom\{m\}\{2\}^\{\-1\}\\sum\_\{i<j\}^\{n\}\\sum\_\{k<l\}^\{m\}h\_\{\\textnormal\{PCD\}\}\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\};\\bm\{y\}\_\{k\},\\bm\{y\}\_\{l\}\)\\ ,where

hPCD​\(𝒙i,𝒙j;𝒚k,𝒚l\)=ρ​\(Σ𝒙i,Σ𝒙j\)\+ρ​\(Σ𝒚i,Σ𝒚j\)−ρ​\(Σ𝒙i,Σ𝒚j\)−ρ​\(Σ𝒙j,Σ𝒚i\)\.h\_\{\\textnormal\{PCD\}\}\(\\bm\{x\}\_\{i\},\\bm\{x\}\_\{j\};\\bm\{y\}\_\{k\},\\bm\{y\}\_\{l\}\)=\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{x\}\_\{j\}\}\)\+\\rho\(\\Sigma\_\{\\bm\{y\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\-\\rho\(\\Sigma\_\{\\bm\{x\}\_\{i\}\},\\Sigma\_\{\\bm\{y\}\_\{j\}\}\)\-\\rho\(\\Sigma\_\{\\bm\{x\}\_\{j\}\},\\Sigma\_\{\\bm\{y\}\_\{i\}\}\)\\ \.Under the alternative hypothesis𝑯1C:𝝁Σℙ≠𝝁Σℚ\\bm\{H\}^\{\\textnormal\{C\}\}\_\{1\}:\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{P\}\}\}\\neq\\bm\{\\mu\}\_\{\\Sigma\_\{\\mathbb\{Q\}\}\}, we have that

PCD^​\(X,Y;ρ\)→𝑃PCD​\(ℙ,ℚ,κ\)\>0,\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)\\xrightarrow\{P\}\\textnormal\{PCD\}\(\\mathbb\{P\},\\mathbb\{Q\},\\kappa\)\>0\\ ,by Theorem[6](https://arxiv.org/html/2606.27832#Thmtheorem6)\.

Under a uniformly random permutation𝝅∈𝚷\\bm\{\\pi\}\\in\\bm\{\\Pi\}, the two\-sampleUU\-statistic with permuted samplesX𝝅X\_\{\\bm\{\\pi\}\}andY𝝅Y\_\{\\bm\{\\pi\}\}exhibit the convergence that

PCD^​\(X𝝅,Y𝝅;ρ\)→𝑃0,\\widehat\{\\textnormal\{PCD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\rho\)\\xrightarrow\{P\}0\\ ,based on Theorem[7](https://arxiv.org/html/2606.27832#Thmtheorem7)asn,m→∞n,m\\rightarrow\\inftywithn/m→c∈\(0,∞\)n/m\\rightarrow c\\in\(0,\\infty\)\. Consequently, the empirical adjusted\(1−α\)\(1\-\\alpha\)\-quantileτα​\(Z,\{𝝅\(r\)\}r=1R\)\\tau\_\{\\alpha\}\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\)\(See Appendix[B](https://arxiv.org/html/2606.27832#A2)withSTAT​\(X,Y;ϕ\)=PCD^​\(X,Y;ρ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)\) of PCD statistic also converges to0\. This implies, by Slutsky’s theoremPapoulis & Pillai \([2001](https://arxiv.org/html/2606.27832#bib.bib42)\),

Pr⁡\(δα=1\)≡Pr⁡\(PCD^​\(X,Y;ρ\)\>τα​\(Z,\{𝝅\(r\)\}r=1R\)\)⟶1,\\Pr\(\\delta\_\{\\alpha\}=1\)\\equiv\\Pr\(\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)\>\\tau\_\{\\alpha\}\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\)\)\\ \\longrightarrow\\ 1\\ ,where the testδα\\delta\_\{\\alpha\}is the permutation procedure \(see Eq\. \([13](https://arxiv.org/html/2606.27832#A2.E13)\) in Appendix[B](https://arxiv.org/html/2606.27832#A2)withSTAT​\(X,Y;ϕ\)=PCD^​\(X,Y;ρ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\widehat\{\\textnormal\{PCD\}\}\(X,Y;\\rho\)\)\. ∎

### D\.4Detailed Proofs of Corollary[4](https://arxiv.org/html/2606.27832#Thmtheorem4)

We present the proofs of Corollary[4](https://arxiv.org/html/2606.27832#Thmtheorem4)as follows

###### Proof\.

As shown in proofs of Theorems[2](https://arxiv.org/html/2606.27832#Thmtheorem2)and[3](https://arxiv.org/html/2606.27832#Thmtheorem3), under a uniformly random permutation𝝅∈𝚷\\bm\{\\pi\}\\in\\bm\{\\Pi\}, we have

VD^​\(X𝝅,Y𝝅;ℓ\)=\(V^​\(X𝝅;ℓ\)−V^​\(Y𝝅;ℓ\)\)2→𝑃0,\\widehat\{\\textnormal\{VD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell\)=\(\\widehat\{V\}\(X\_\{\\bm\{\\pi\}\};\\ell\)\-\\widehat\{V\}\(Y\_\{\\bm\{\\pi\}\};\\ell\)\)^\{2\}\\xrightarrow\{P\}0\\ ,and

PCD^​\(X𝝅,Y𝝅;ρ\)→𝑃0,\\widehat\{\\textnormal\{PCD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\rho\)\\xrightarrow\{P\}0\\ ,which imply that

𝒯​\(X𝝅,Y𝝅;ℓ,ρ\)≡\(VD^​\(X𝝅,Y𝝅;ℓ\),PCD^​\(X𝝅,Y𝝅;ρ\)\)⊤→𝑃\(0,0\)⊤\\mathcal\{T\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell,\\rho\)\\equiv\(\\widehat\{\\textnormal\{VD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell\),\\widehat\{\\textnormal\{PCD\}\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\rho\)\)^\{\\top\}\\xrightarrow\{P\}\(0,0\)^\{\\top\}\\by Slutsky’s theoremPapoulis & Pillai \([2001](https://arxiv.org/html/2606.27832#bib.bib42)\)\.

Then, we have

𝒯A​\(X𝝅,Y𝝅;ℓ,ρ\)=𝒯​\(X𝝅,Y𝝅;ℓ,ρ\)⊤​Σ^A−1​𝒯​\(X𝝅,Y𝝅;ℓ,ρ\)→𝑃0,\\mathcal\{T\}^\{\\rm A\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell,\\rho\)=\\mathcal\{T\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell,\\rho\)^\{\\top\}\\widehat\{\\Sigma\}^\{\-1\}\_\{\\textnormal\{A\}\}\\mathcal\{T\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell,\\rho\)\\xrightarrow\{P\}0\\ ,whereΣA\\Sigma\_\{\\textnormal\{A\}\}is fixed in the testing procedure\.

Consequently, the permutation distribution of𝒯A​\(X𝝅,Y𝝅;ℓ,ρ\)\\mathcal\{T\}^\{\\rm A\}\(X\_\{\\bm\{\\pi\}\},Y\_\{\\bm\{\\pi\}\};\\ell,\\rho\)concentrates at zero, and the empirical adjusted\(1−α\)\(1\-\\alpha\)\-quantileτα​\(Z,\{𝝅\(r\)\}r=1R\)\\tau\_\{\\alpha\}\\big\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\\big\)\(see Appendix[B](https://arxiv.org/html/2606.27832#A2), withSTAT​\(X,Y;ϕ\)=𝒯A​\(X,Y;ℓ,ρ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)\) converges to0\. Similarly, ifeither or bothof the alternatives𝑯1V\\bm\{H\}^\{\\textnormal\{V\}\}\_\{1\}and𝑯1C\\bm\{H\}^\{\\textnormal\{C\}\}\_\{1\}hold, then at least one of VD or PCD converges to a positive constant, and thus𝒯​\(X,Y;ℓ,ρ\)\\mathcal\{T\}\(X,Y;\\ell,\\rho\)converges to a nonzero vector\. It follows that the observed USAD value𝒯A​\(X,Y;ℓ,ρ\)\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)converges to a positive constant\.

Therefore, by Slutsky’s theoremPapoulis & Pillai \([2001](https://arxiv.org/html/2606.27832#bib.bib42)\),

Pr⁡\(δα=1\)≡Pr⁡\(𝒯A​\(X,Y;ℓ,ρ\)\>τα​\(Z,\{𝝅\(r\)\}r=1R\)\)⟶1,\\Pr\(\\delta\_\{\\alpha\}=1\)\\equiv\\Pr\(\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)\>\\tau\_\{\\alpha\}\(Z,\\\{\\bm\{\\pi\}\_\{\(r\)\}\\\}\_\{r=1\}^\{R\}\)\)\\ \\longrightarrow\\ 1\\ ,where the testδα\\delta\_\{\\alpha\}is the permutation procedure \(see Eq\. \([13](https://arxiv.org/html/2606.27832#A2.E13)\) in Appendix[B](https://arxiv.org/html/2606.27832#A2)withSTAT​\(X,Y;ϕ\)=𝒯A​\(X,Y;ℓ,ρ\)\\textnormal\{STAT\}\(X,Y;\\phi\)=\\mathcal\{T\}^\{\\rm A\}\(X,Y;\\ell,\\rho\)\)\. ∎

## Appendix EExperimental Details

### E\.1Aggregation Strategy

DUALZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\)can be extended to aggregate heterogeneous statistics because it operates on their joint correlation structure, without requiring the components to share the same U\-statistic form, scaling, or null distribution\. In contrast, MMDAggSchrab et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib45)\)relies on all components having identical U\-statistic structures and comparable bootstrap quantiles, making it unsuitable for mixing statistics with different functional forms or null behaviours\. MMDFuseBiggs et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib2)\)restricts aggregation by requiring all inputs to follow the same kernel\-based MMD formulation, so that its log\-sum\-exp fusion remains theoretically calibrated; as a result, it cannot accommodate statistics that differ in scale or structural definition\. By standardizing each statistic through its empirical covariance under the null and combining them via a correlation\-aware quadratic form, DUAL enables principled fusion of heterogeneous statistics that capture complementary aspects of distributional discrepancy\.

### E\.2Inference Time Complexity

For clarity, we first introduce the notations used in the time–complexity analysis\. Letnndenote the batch size of clean examples, i\.e\.,X=\{𝒙j\}j=1nX=\\\{\\bm\{x\}\_\{j\}\\\}\_\{j=1\}^\{n\}, and letmmdenote the batch size of test examples, i\.e\.,Y=\{𝒚j\}j=1mY=\\\{\\bm\{y\}\_\{j\}\\\}\_\{j=1\}^\{m\}\. We useKKto denote the number of random permutations used in PCD, andppto denote the dimension of the semantic feature\. We denote byCℓC\_\{\\ell\}andCρC\_\{\\rho\}the computational cost of evaluating the kernel functionsℓ\\ellandρ\\rhoonce, respectively, and byCfC\_\{f\}the cost of extracting semantic features from the target classifierff\. We denote byBBthe number of bootstrap resampling repeats used to estimate the correlationΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}, and byRRthe number of repeats used in the permutation test\.

Time Complexity of VD Estimator\.For the clean batchXX, evaluating the kernel over all diagonal and off\-diagonal pairs of semantic features requires𝒪​\(n2\)\\mathcal\{O\}\(n^\{2\}\)operations\. The test batchYYcontributes an additional𝒪​\(m2\)\\mathcal\{O\}\(m^\{2\}\)operations\. With a per\-evaluation cost ofCℓC\_\{\\ell\}, the total kernel computation cost is𝒪​\(\(n2\+m2\)​Cℓ\)\\mathcal\{O\}\(\(n^\{2\}\+m^\{2\}\)C\_\{\\ell\}\)\. Extracting semantic features from the classifierffadds𝒪​\(\(n\+m\)​Cf\)\\mathcal\{O\}\(\(n\+m\)C\_\{f\}\), which is typically negligible compared with the quadratic kernel terms\. Overall, the time complexity of VD is

𝒪​\(\(n2\+m2\)​Cℓ\+\(n\+m\)​Cf\)\.\\mathcal\{O\}\\big\(\(n^\{2\}\+m^\{2\}\)C\_\{\\ell\}\+\(n\+m\)C\_\{f\}\\big\)\.
Time Complexity of PCD Estimator\.For two batchesXXandYY, each withKKrandom perturbations per example, extracting semantic features through the classifierffrequires𝒪​\(\(n\+m\)​K​Cf\)\.\\mathcal\{O\}\(\(n\+m\)KC\_\{f\}\)\.Computing the covariance matrix for each example involvesKKouter\-product operations in app\-dimensional feature space, resulting in a total cost of𝒪​\(\(n\+m\)​K​p2\)\.\\mathcal\{O\}\(\(n\+m\)Kp^\{2\}\)\.After obtaining the covariance matrix for every example, the empirical PCD estimator in Eqn\. \([8](https://arxiv.org/html/2606.27832#S3.E8)\) requires evaluating the kernelρ\\rhoover all pairs of covariances within and across the two batches\. This involvesn​\(n−1\)n\(n\-1\),m​\(m−1\)m\(m\-1\), andn​mnmkernel computations, yielding a total complexity of𝒪​\(\(n\+m\)2​Cρ\)\.\\mathcal\{O\}\(\(n\+m\)^\{2\}C\_\{\\rho\}\)\.Overall, the time complexity of PCD is

𝒪​\(\(n\+m\)​\(K​Cf\+K​p2\)\+\(n\+m\)2​Cρ\)\.\\mathcal\{O\}\\big\(\(n\+m\)\(KC\_\{f\}\+Kp^\{2\}\)\+\(n\+m\)^\{2\}C\_\{\\rho\}\\big\)\.
Time Complexity of USAD Estimator\.For estimating the correlationΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}\(i\.e\., Eqn\. \([10](https://arxiv.org/html/2606.27832#S4.E10)\)\) fromBBbootstrap replicates incurs an offline cost of

𝒪​\(B​\(\(n2\+m2\)​Cℓ\+\(n\+m\)2​Cρ\+\(n\+m\)​\(K​Cf\+K​p2\)\)\),\\mathcal\{O\}\\left\(B\\left\(\(n^\{2\}\+m^\{2\}\)C\_\{\\ell\}\+\(n\+m\)^\{2\}C\_\{\\rho\}\+\(n\+m\)\(KC\_\{f\}\+Kp^\{2\}\)\\right\)\\right\)\\ ,which is dominated by computing VD and PCDBBtimes\. Notably, this is a one\-off preprocessing cost: onceΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}is estimated, it is fixed and reused in all subsequent permutation tests\.

Given the precomputedΣ^A\\widehat\{\\Sigma\}\_\{\\mathrm\{A\}\}, evaluating the aggregated test statistic requires computing VD and PCD only once for the test batchYY\. Therefore, the inference\-time complexity of USAD is

𝒪​\(\(n2\+m2\)​Cℓ\+\(n\+m\)2​Cρ\+\(n\+m\)​\(K​Cf\+K​p2\)\),\\mathcal\{O\}\\left\(\(n^\{2\}\+m^\{2\}\)C\_\{\\ell\}\+\(n\+m\)^\{2\}C\_\{\\rho\}\+\(n\+m\)\(KC\_\{f\}\+Kp^\{2\}\)\\right\),which corresponds exactly to the cost of evaluating VD and PCD on the observed data\.

Time Complexity of Permutation Test\.During the permutation test, the kernel inner products required by VD and PCD are already computed once when evaluating the statistics on the original batches\. For each permutation, we simply rearrange the precomputed kernel matrices according to the permuted indices, and then aggregate the corresponding entries to obtain the permuted VD and PCD values\. No kernel evaluations or covariance computations are repeated\. Since each permutation only involves indexing and summation over existing matrices, the per\-permutation cost is linear in the number of matrix entries\.

Therefore, forRRpermutations, the time complexity of the permutation test is𝒪​\(R​\(n2\+m2\)\)\\mathcal\{O\}\\bigl\(R\(n^\{2\}\+m^\{2\}\)\\bigr\)for VD,𝒪​\(R​\(n\+m\)2\)\\mathcal\{O\}\\bigl\(R\(n\+m\)^\{2\}\\bigr\)for PCD, and𝒪​\(R​\(n\+m\)2\)\\mathcal\{O\}\\bigl\(R\(n\+m\)^\{2\}\\bigr\)for USAD, which is dominated by the cost of repeatedly aggregating entries from the precomputed kernel and covariance matrices\.

In addition to the complexity analysis, we also report the actual elapsed time in[SectionF\.5](https://arxiv.org/html/2606.27832#A6.SS5)\.

Table 4:Test power of datasetCIFAR\-10under five different attacks with different perturbation budgetϵ\\epsilon\. The given adversarial examples all share the same number of examples\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions\. The target model is ResNet\-18 trained onCIFAR\-10dataset\.AttackMethodϵ\\epsilon12345678AASAMMD0\.160±\\pm0\.0120\.554±\\pm0\.0110\.871±\\pm0\.0050\.986±\\pm0\.0030\.998±\\pm0\.0010\.996±\\pm0\.0021\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)0\.222±\\pm0\.0160\.752±\\pm0\.0120\.997±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.261±\\pm0\.0101\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.298±\\pm0\.0161\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000BIMSAMMD0\.148±\\pm0\.0100\.250±\\pm0\.0130\.577±\\pm0\.0110\.792±\\pm0\.0110\.894±\\pm0\.0080\.926±\\pm0\.0080\.973±\\pm0\.0050\.980±\\pm0\.004PCD \(ours\)0\.125±\\pm0\.0080\.274±\\pm0\.0110\.523±\\pm0\.0190\.971±\\pm0\.0051\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.211±\\pm0\.0150\.984±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.219±\\pm0\.0100\.985±\\pm0\.0041\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000CWSAMMD0\.147±\\pm0\.0110\.139±\\pm0\.0060\.300±\\pm0\.0190\.478±\\pm0\.0130\.697±\\pm0\.0130\.849±\\pm0\.0110\.902±\\pm0\.0090\.948±\\pm0\.005PCD \(ours\)0\.234±\\pm0\.0120\.192±\\pm0\.0130\.862±\\pm0\.0111\.000±\\pm0\.0000\.994±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.507±\\pm0\.0100\.756±\\pm0\.0101\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.528±\\pm0\.0150\.850±\\pm0\.0101\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000FGSMSAMMD0\.190±\\pm0\.0120\.226±\\pm0\.0150\.408±\\pm0\.0190\.682±\\pm0\.0090\.899±\\pm0\.0120\.971±\\pm0\.0050\.997±\\pm0\.0021\.000±\\pm0\.000PCD \(ours\)0\.311±\\pm0\.0140\.303±\\pm0\.0090\.800±\\pm0\.0080\.950±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.794±\\pm0\.0160\.835±\\pm0\.0080\.851±\\pm0\.0110\.945±\\pm0\.0060\.992±\\pm0\.0040\.998±\\pm0\.0010\.999±\\pm0\.0011\.000±\\pm0\.000USAD \(ours\)0\.810±\\pm0\.0130\.842±\\pm0\.0110\.858±\\pm0\.0110\.987±\\pm0\.0021\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PGDSAMMD0\.192±\\pm0\.0120\.200±\\pm0\.0090\.381±\\pm0\.0110\.832±\\pm0\.0090\.829±\\pm0\.0060\.933±\\pm0\.0070\.971±\\pm0\.0060\.986±\\pm0\.003PCD \(ours\)0\.251±\\pm0\.0120\.257±\\pm0\.0150\.924±\\pm0\.0081\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.653±\\pm0\.0150\.687±\\pm0\.0181\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.663±\\pm0\.0140\.925±\\pm0\.0041\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000

### E\.3Implementation Details\.

Computational Resources\.We implement all methods using Python 3\.9\.18 with PyTorch 2\.7 and CUDA 12\.4 on two platforms\. One platform is an NVIDIA RTX 4090 GPU PC with PyTorch framework\. Another platform is a High\-performance Computer cluster with several NVIDIA A100 GPUs with Pytorch framework\. The memory of two platforms are both 64 GB\. The storage of disk of two platforms are both over 4 TB\. TheCIFAR\-10dataset andImageNet\-1Kdataset can be downloaded via torchvision or from their official websites\. Since our proposed methods do not require training, we directly utilize the full CIFAR\-10 test set \(10,000 images\) and the ImageNet\-1K validation set \(50,000 images\) for evaluation\. We employ pre\-trained ResNet\-18, WideResNet\-28, WideResNet\-70, ResNet\-50, and ViT\-B\-16 models with weights obtained from torchvision or downloaded checkpoints \(will be provided on our GitHub repository after reviewing period\) for feature extraction and classification\.

Experimental Setup for Datasets\.We employ two primary datasets:CIFAR\-10\(Krizhevsky et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib33)\)andImageNet\-1K\(Deng et al\.,[2009](https://arxiv.org/html/2606.27832#bib.bib12)\)\. For clean examples, we independently and randomly sample reference examples from each dataset\. For adversarial examples in CIFAR\-10, we apply each adversarial attack to the entire CIFAR\-10 test set \(10,000 images\) to generate 10,000 adversarial examples\. For ImageNet\-1K, followingGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\), we independently and randomly select 500 clean examples from the full ImageNet\-1K validation set \(50,000 images\), then apply each adversarial attack to these selected images to generate 500 adversarial examples\. For statistical power experiments, we independently and randomly select\|Y\|=50\|Y\|=50adversarial examples for testing \(except when explicitly varying the number of examples\)\. To assess type\-I error rates, we partition both the CIFAR\-10 test set and ImageNet\-1K validation set into two equal subsets\. We designate one subset as the reference set and the other as the input set, then independently and randomly select equal numbers of examples from both subsets to evaluate whether detection methods incorrectly classify clean examples as adversarial\.

Experimental Setup for Baselines\.For the single\-statistic SAD method SAMMD, we adopt all default experimental settings fromGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\. For the aggregated\-statistic two\-sample testing methods MMDAgg, MMD\-FUSE, and MMD\-DUAL, we follow the default experimental settings fromZhou et al\. \([2025](https://arxiv.org/html/2606.27832#bib.bib60)\), with one modification: we set the number of aggregations to 2 to ensure a fair comparison with our method\. While our method can be extended to kernel aggregation, such extensions are beyond the scope of this work on adversarial detection\.

Experimental Setup for Our Methods\.For PCD, we first apply principal component analysis \(PCA\) for dimensionality reduction, where the target dimension is automatically determined based on the original feature size\. We set the Gaussian perturbation mean to0and standard deviation to1/2551/255, with the number of perturbations fixed at200200across all experiments\. For both PCD and VD, we set the bandwidth parameters asbPCD=bVD=4​2b\_\{\\text\{PCD\}\}=b\_\{\\text\{VD\}\}=4\\sqrt\{2\}\. For USAD, we use bandwidthbUSAD=13​2b\_\{\\text\{USAD\}\}=13\\sqrt\{2\}\. In the permutation testing procedure, we set the significance level atα=0\.05\\alpha=0\.05and the number of permutations to100100\. All reported results are computed over1010independent experimental trials with different random seeds, where each trial conducts100100sampling iterations to estimate the mean test power\. Thus, every result is averaged over1,0001\{,\}000repetitions in total\.

Illustrations of Kernel Types\.For VD, we use the Gaussian kernel

ℓ​\(x,y\)=exp⁡\(−‖x−y‖2b2\),\\ell\(x,y\)=\\exp\\\!\\left\(\-\\frac\{\\\|x\-y\\\|^\{2\}\}\{b^\{2\}\}\\right\),where the bandwidthbbis selected using the median heuristicSchrab et al\. \([2022](https://arxiv.org/html/2606.27832#bib.bib44)\); Biggs et al\. \([2023](https://arxiv.org/html/2606.27832#bib.bib2)\)computed from the clean feature set\.

For PCD, we use the log\-RBF kernel applied to covariance matrices,

ρlog​\(Σx,Σy\)=exp⁡\(−‖log⁡Σx−log⁡Σy‖F2b2\),\\rho\_\{\\mathrm\{log\}\}\(\\Sigma\_\{x\},\\Sigma\_\{y\}\)=\\exp\\\!\\left\(\-\\frac\{\\\|\\log\\Sigma\_\{x\}\-\\log\\Sigma\_\{y\}\\\|\_\{F\}^\{2\}\}\{b^\{2\}\}\\right\),or the Gaussian kernel defined directly on covariance matrices,

ρgau​\(Σx,Σy\)=exp⁡\(−‖Σx−Σy‖F2b2\),\\rho\_\{\\mathrm\{gau\}\}\(\\Sigma\_\{x\},\\Sigma\_\{y\}\)=\\exp\\\!\\left\(\-\\frac\{\\\|\\Sigma\_\{x\}\-\\Sigma\_\{y\}\\\|\_\{F\}^\{2\}\}\{b^\{2\}\}\\right\),where the bandwidthbbis selected using the median heuristic computed from the clean feature set\.

Implementation Details of Adversarial Attacks \(Including Adaptive Attack\)\.In our experiments, we detect AEs that*successfully*fool the threat model, and all implementation details are designed around this principle\. Specifically, we use a diverse set of attack methods under bothℓ∞\\ell\_\{\\infty\}\-norm andℓ2\\ell\_\{2\}\-norm to comprehensively evaluate the detection ability of USAD, including*AutoAttack*\(AA\)Croce & Hein \([2020b](https://arxiv.org/html/2606.27832#bib.bib11)\),*basic iterative method*\(BIM\)Kurakin et al\. \([2017](https://arxiv.org/html/2606.27832#bib.bib34)\),*Carlini & Wagner*\(CW\) attackCarlini & Wagner \([2017b](https://arxiv.org/html/2606.27832#bib.bib6)\),*fast gradient sign method*\(FGSM\)Goodfellow et al\. \([2015](https://arxiv.org/html/2606.27832#bib.bib18)\)and*projected gradient descent*\(PGD\)Madry et al\. \([2018](https://arxiv.org/html/2606.27832#bib.bib38)\)\. Forℓ∞\\ell\_\{\\infty\}\-norm attacks, followingGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\), we set the maximum allowed perturbation budgetϵ\\epsilonto range from1/2551/255to8/2558/255\. Forℓ2\\ell\_\{2\}\-norm attacks, to ensure successful attacks against the threat model, we increaseϵ\\epsilonover a set of discrete values from48/25548/255to104/255104/255, with successive values differing by8/2558/255\(i\.e\.,48/25548/255,56/25556/255,64/25564/255,72/25572/255,80/25580/255,88/25588/255,96/25596/255and104/255104/255\)\. For bothℓ∞\\ell\_\{\\infty\}\-norm andℓ2\\ell\_\{2\}\-norm attacks, we set the step size to beϵ/5\\epsilon/5\. For all iterative attacks \(i\.e\., except for FGSM\), we set the iteration number to 5\.

Adaptive Attack\.To evaluate robustness under adaptive attacks, we follow the strategy ofGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\)and generate adversarial examples on CIFAR\-10 and ImageNet using a PGD\-based white\-box attack, where both the classifier and our detector are fully accessible to the attacker\. Given the trained classifierf:𝒳→𝒞f:\\mathcal\{X\}\\to\\mathcal\{C\}and a datasetD=\{\(𝒙i,ci\)\}i=1ND=\\\{\(\\bm\{x\}\_\{i\},c\_\{i\}\)\\\}\_\{i=1\}^\{N\}with𝒙i∈𝒳⊆ℝd\\bm\{x\}\_\{i\}\\in\\mathcal\{X\}\\subseteq\\mathbb\{R\}^\{d\}and ground\-truth labelci∈𝒞c\_\{i\}\\in\\mathcal\{C\}, the adaptive adversarial examplesD~=\{𝒙i\+𝜻i⋆\}i=1N\\tilde\{D\}=\\\{\\bm\{x\}\_\{i\}\+\\bm\{\\zeta\}\_\{i\}^\{\\star\}\\\}\_\{i=1\}^\{N\}are produced by solving

\{𝜻i⋆\}i=1N=arg​max\{𝜻i\}i=1N⁡\[∑i=1Nℒ​\(f​\(𝒙i\+𝜻i\),ci\)−STAT​\(D,\{𝒙i\+𝜻i\}i=1N;ϕ\)\],\\displaystyle\\\{\\bm\{\\zeta\}\_\{i\}^\{\\star\}\\\}\_\{i=1\}^\{N\}=\\operatorname\*\{arg\\,max\}\_\{\\\{\\bm\{\\zeta\}\_\{i\}\\\}\_\{i=1\}^\{N\}\}\\Bigg\[\\sum\_\{i=1\}^\{N\}\\mathcal\{L\}\\bigl\(f\(\\bm\{x\}\_\{i\}\+\\bm\{\\zeta\}\_\{i\}\),c\_\{i\}\\bigr\)\-\\mathrm\{STAT\}\\bigl\(D,\\\{\\bm\{x\}\_\{i\}\+\\bm\{\\zeta\}\_\{i\}\\\}\_\{i=1\}^\{N\};\\phi\\bigr\)\\Bigg\],s\.t\.‖𝜻i‖∞≤ϵ,∀i∈\[N\]\.\\displaystyle\\textnormal\{s\.t\.\}\\quad\\\|\\bm\{\\zeta\}\_\{i\}\\\|\_\{\\infty\}\\leq\\epsilon,\\quad\\forall i\\in\[N\]\.whereℒ\\mathcal\{L\}is the attack loss function \(e\.g\., cross\-entropy\), andSTAT​\(⋅\)\\mathrm\{STAT\}\(\\cdot\)denotes the detection statistic used by our method, which can be VD, PCD, or USAD with the corresponding kernel functionϕ\\phi\. The associated kernelsϕ∈\{ℓ,ρ,\{ℓ,ρ\}\}\\phi\\in\\\{\\ell,\\rho,\\\{\\ell,\\rho\\\}\\\}correspond respectively to VD, PCD, and USAD\.

Table 5:Test power of datasetImageNet\-1Kunder five different attacks with different perturbation budgetϵ\\epsilon\. The given adversarial examples all share the same number of examples\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions\. The target model is ResNet\-50 trained onImageNet\-1Kdataset\.AttackMethodϵ\\epsilon12345678AASAMMD0\.107±\\pm0\.0100\.310±\\pm0\.0170\.765±\\pm0\.0280\.953±\\pm0\.0070\.998±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)0\.569±\\pm0\.0100\.980±\\pm0\.0041\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.577±\\pm0\.0350\.984±\\pm0\.0051\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.748±\\pm0\.0190\.998±\\pm0\.0021\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000BIMSAMMD0\.102±\\pm0\.0120\.158±\\pm0\.0190\.305±\\pm0\.0280\.467±\\pm0\.0290\.674±\\pm0\.0250\.820±\\pm0\.0130\.887±\\pm0\.0160\.970±\\pm0\.005PCD \(ours\)0\.189±\\pm0\.0160\.505±\\pm0\.0140\.851±\\pm0\.0080\.953±\\pm0\.0060\.987±\\pm0\.0030\.984±\\pm0\.0030\.998±\\pm0\.0010\.993±\\pm0\.002VD \(ours\)0\.194±\\pm0\.0140\.467±\\pm0\.0400\.854±\\pm0\.0160\.940±\\pm0\.0110\.969±\\pm0\.0110\.986±\\pm0\.0050\.995±\\pm0\.0030\.999±\\pm0\.001USAD \(ours\)0\.196±\\pm0\.0100\.634±\\pm0\.0300\.961±\\pm0\.0080\.989±\\pm0\.0040\.998±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000CWSAMMD0\.055±\\pm0\.0070\.094±\\pm0\.0070\.262±\\pm0\.0180\.491±\\pm0\.0280\.586±\\pm0\.0250\.775±\\pm0\.0240\.825±\\pm0\.0150\.952±\\pm0\.011PCD \(ours\)0\.206±\\pm0\.0120\.822±\\pm0\.0090\.841±\\pm0\.0110\.989±\\pm0\.0030\.986±\\pm0\.0030\.988±\\pm0\.0030\.990±\\pm0\.0020\.980±\\pm0\.003VD \(ours\)0\.596±\\pm0\.0220\.972±\\pm0\.0071\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)0\.640±\\pm0\.0240\.980±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000FGSMSAMMD0\.051±\\pm0\.0120\.075±\\pm0\.0140\.187±\\pm0\.0250\.402±\\pm0\.0330\.727±\\pm0\.0250\.940±\\pm0\.0110\.997±\\pm0\.0021\.000±\\pm0\.000PCD \(ours\)0\.092±\\pm0\.0080\.210±\\pm0\.0110\.525±\\pm0\.0350\.931±\\pm0\.0110\.999±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.043±\\pm0\.0050\.127±\\pm0\.0120\.254±\\pm0\.0150\.516±\\pm0\.0210\.726±\\pm0\.0170\.924±\\pm0\.0110\.967±\\pm0\.0060\.997±\\pm0\.001USAD \(ours\)0\.135±\\pm0\.0140\.312±\\pm0\.0140\.620±\\pm0\.0250\.966±\\pm0\.0081\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PGDSAMMD0\.090±\\pm0\.0150\.169±\\pm0\.0120\.274±\\pm0\.0310\.450±\\pm0\.0270\.674±\\pm0\.0240\.875±\\pm0\.0100\.957±\\pm0\.0080\.975±\\pm0\.005PCD \(ours\)0\.152±\\pm0\.0100\.755±\\pm0\.0170\.826±\\pm0\.0170\.939±\\pm0\.0060\.986±\\pm0\.0020\.961±\\pm0\.0040\.992±\\pm0\.0030\.995±\\pm0\.002VD \(ours\)0\.074±\\pm0\.0120\.335±\\pm0\.0200\.799±\\pm0\.0130\.919±\\pm0\.0130\.972±\\pm0\.0070\.987±\\pm0\.0030\.997±\\pm0\.0011\.000±\\pm0\.000USAD \(ours\)0\.217±\\pm0\.0130\.813±\\pm0\.0160\.933±\\pm0\.0080\.994±\\pm0\.0031\.000±\\pm0\.0000\.999±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.000

Table 6:Test power of datasetImageNet\-1Kunder five different attacks with different perturbation budgetϵ\\epsilon\. The given adversarial examples all share the same number of examples\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions\. The target model is ViT\-B\-16 trained onImageNet\-1Kdataset\.AttackMethodϵ\\epsilon12345678AASAMMD0\.691±\\pm0\.0521\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000BIMSAMMD0\.758±\\pm0\.1100\.846±\\pm0\.0250\.973±\\pm0\.0121\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.593±\\pm0\.0301\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000CWSAMMD0\.472±\\pm0\.0660\.997±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.999±\\pm0\.0011\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000FGSMSAMMD0\.732±\\pm0\.0651\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.533±\\pm0\.0390\.765±\\pm0\.0400\.811±\\pm0\.0190\.766±\\pm0\.0260\.721±\\pm0\.0330\.655±\\pm0\.0370\.704±\\pm0\.0230\.643±\\pm0\.019USAD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PGDSAMMD0\.545±\\pm0\.0740\.606±\\pm0\.0390\.819±\\pm0\.0230\.949±\\pm0\.0140\.991±\\pm0\.0031\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000PCD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000VD \(ours\)0\.495±\\pm0\.0420\.988±\\pm0\.0041\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000USAD \(ours\)1\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.0001\.000±\\pm0\.000

Table 7:Test power of datasetCIFAR\-10under different attacks with perturbation budgetϵ=4/255\\epsilon=4/255across different target models WideResNet\-28 \(WRN28\) or WideResNet\-70 \(WRN70\), when the feature extractor are the same as target model\. Both of WRN28 and WRN70 are trained onCIFAR\-10dataset\. The given adversarial examples all share the same number of examples\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions\.Target ModelDetection MethodAABIMCWFGSMPGDWRN28SAMMD0\.748±\\pm0\.0290\.287±\\pm0\.0230\.356±\\pm0\.0130\.497±\\pm0\.0260\.367±\\pm0\.024\\cellcolororLPCD \(ours\)\\cellcolororL0\.997±\\pm0\.002\\cellcolororL0\.613±\\pm0\.016\\cellcolororL0\.910±\\pm0\.017\\cellcolororL0\.999±\\pm0\.001\\cellcolororL0\.937±\\pm0\.014\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±\\pm0\.000\\cellcolorgoL0\.737±\\pm0\.055\\cellcolorgoL0\.484±\\pm0\.105\\cellcolorgoL0\.999±\\pm0\.001\\cellcolorgoL0\.321±\\pm0\.094MMDAgg0\.992±\\pm0\.0020\.628±\\pm0\.0150\.610±\\pm0\.0100\.735±\\pm0\.0150\.682±\\pm0\.012MMD\-FUSE1\.000±\\pm0\.0000\.789±\\pm0\.0130\.742±\\pm0\.0130\.967±\\pm0\.0060\.748±\\pm0\.012MMD\-DUAL1\.000±\\pm0\.0000\.523±\\pm0\.0180\.938±\\pm0\.0070\.978±\\pm0\.0050\.882±\\pm0\.010\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±\\pm0\.000\\cellcolorgrL0\.860±\\pm0\.028\\cellcolorgrL0\.953±\\pm0\.011\\cellcolorgrL1\.000±\\pm0\.000\\cellcolorgrL0\.959±\\pm0\.005WRN70SAMMD0\.943±\\pm0\.0110\.416±\\pm0\.0120\.486±\\pm0\.0100\.500±\\pm0\.0110\.485±\\pm0\.020\\cellcolororLPCD \(ours\)\\cellcolororL1\.000±\\pm0\.000\\cellcolororL0\.773±\\pm0\.016\\cellcolororL0\.930±\\pm0\.006\\cellcolororL1\.000±\\pm0\.000\\cellcolororL0\.953±\\pm0\.007\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±\\pm0\.000\\cellcolorgoL0\.938±\\pm0\.010\\cellcolorgoL0\.983±\\pm0\.002\\cellcolorgoL0\.994±\\pm0\.002\\cellcolorgoL0\.844±\\pm0\.011MMDAgg0\.976±\\pm0\.0030\.577±\\pm0\.0100\.623±\\pm0\.0120\.686±\\pm0\.0100\.634±\\pm0\.012MMD\-FUSE1\.000±\\pm0\.0000\.700±\\pm0\.0190\.778±\\pm0\.0130\.915±\\pm0\.0110\.698±\\pm0\.014MMD\-DUAL1\.000±\\pm0\.0000\.749±\\pm0\.0160\.837±\\pm0\.0110\.857±\\pm0\.0090\.735±\\pm0\.016\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±\\pm0\.000\\cellcolorgrL0\.956±\\pm0\.006\\cellcolorgrL0\.992±\\pm0\.002\\cellcolorgrL1\.000±\\pm0\.000\\cellcolorgrL0\.982±\\pm0\.005

Table 8:Test power of datasetCIFAR\-10under different transfer attacks with perturbation budgetϵ=4/255\\epsilon=4/255across different target models, while the feature extractor ResNet\-18 keeps the same, which is trained onCIFAR\-10dataset\. The given adversarial examples all share the same number of examples\|Y\|=50\|Y\|=50\. The results are averaged over1,0001,000repetitions\.Target ModelDetection MethodAABIMCWFGSMPGDRes18SAMMD0\.995±0\.0020\.995\\pm 0\.0020\.689±0\.0170\.689\\pm 0\.0170\.434±0\.0120\.434\\pm 0\.0120\.610±0\.0110\.610\\pm 0\.0110\.562±0\.0190\.562\\pm 0\.019\\cellcolororLPCD \(ours\)\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL0\.975±0\.0030\.975\\pm 0\.003\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMDAgg1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.978±0\.0030\.978\\pm 0\.0030\.788±0\.0120\.788\\pm 0\.0120\.582±0\.0210\.582\\pm 0\.0210\.871±0\.0100\.871\\pm 0\.010MMD\-FUSE1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.894±0\.0110\.894\\pm 0\.0111\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMD\-DUAL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.952±0\.0050\.952\\pm 0\.0051\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}WRN28SAMMD0\.387±0\.0180\.387\\pm 0\.0180\.193±0\.0100\.193\\pm 0\.0100\.227±0\.0150\.227\\pm 0\.0150\.769±0\.0100\.769\\pm 0\.0100\.319±0\.0150\.319\\pm 0\.015\\cellcolororLPCD \(ours\)\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL0\.993±0\.0010\.993\\pm 0\.001\\cellcolorgoL0\.999±0\.0010\.999\\pm 0\.001\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMDAgg0\.459±0\.0220\.459\\pm 0\.0220\.245±0\.0110\.245\\pm 0\.0110\.295±0\.0170\.295\\pm 0\.0170\.812±0\.0200\.812\\pm 0\.0200\.522±0\.0140\.522\\pm 0\.014MMD\-FUSE0\.844±0\.0110\.844\\pm 0\.0110\.625±0\.0070\.625\\pm 0\.0070\.794±0\.0120\.794\\pm 0\.0120\.992±0\.0040\.992\\pm 0\.0040\.993±0\.0020\.993\\pm 0\.002MMD\-DUAL0\.937±0\.0060\.937\\pm 0\.0060\.764±0\.0070\.764\\pm 0\.0070\.900±0\.0090\.900\\pm 0\.0090\.998±0\.0020\.998\\pm 0\.0020\.998±0\.0020\.998\\pm 0\.002\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}WRN70SAMMD0\.398±0\.0090\.398\\pm 0\.0090\.207±0\.0150\.207\\pm 0\.0150\.227±0\.0100\.227\\pm 0\.0100\.792±0\.0150\.792\\pm 0\.0150\.199±0\.0130\.199\\pm 0\.013\\cellcolororLPCD \(ours\)\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL0\.999±0\.0010\.999\\pm 0\.001\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL0\.999±0\.0010\.999\\pm 0\.001MMDAgg0\.524±0\.0160\.524\\pm 0\.0160\.289±0\.0100\.289\\pm 0\.0100\.352±0\.0140\.352\\pm 0\.0140\.764±0\.0150\.764\\pm 0\.0150\.324±0\.0150\.324\\pm 0\.015MMD\-FUSE0\.970±0\.0040\.970\\pm 0\.0040\.810±0\.0110\.810\\pm 0\.0110\.847±0\.0080\.847\\pm 0\.0080\.982±0\.0050\.982\\pm 0\.0050\.795±0\.0140\.795\\pm 0\.014MMD\-DUAL0\.988±0\.0030\.988\\pm 0\.0030\.912±0\.0070\.912\\pm 0\.0070\.911±0\.0090\.911\\pm 0\.0090\.996±0\.0020\.996\\pm 0\.0020\.882±0\.0080\.882\\pm 0\.008\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}SWINSAMMD0\.365±0\.0150\.365\\pm 0\.0150\.306±0\.0170\.306\\pm 0\.0170\.279±0\.0160\.279\\pm 0\.0160\.600±0\.0150\.600\\pm 0\.0150\.403±0\.0150\.403\\pm 0\.015\\cellcolororLPCD \(ours\)\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolororL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoLVD \(ours\)\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgoL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}MMDAgg0\.630±0\.0100\.630\\pm 0\.0100\.535±0\.0210\.535\\pm 0\.0210\.515±0\.0070\.515\\pm 0\.0070\.730±0\.0150\.730\\pm 0\.0150\.420±0\.0100\.420\\pm 0\.010MMD\-FUSE0\.999±0\.0010\.999\\pm 0\.0010\.992±0\.0030\.992\\pm 0\.0030\.987±0\.0020\.987\\pm 0\.0021\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.894±0\.0100\.894\\pm 0\.010MMD\-DUAL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.995±0\.0020\.995\\pm 0\.0020\.994±0\.0030\.994\\pm 0\.0031\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}0\.946±0\.0070\.946\\pm 0\.007\\cellcolorgrLUSAD \(ours\)\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}\\cellcolorgrL1\.000±0\.000\\mathbf\{1\.000\\pm 0\.000\}

Table 9:Running Time \(seconds\) per test trial\. We record the total inference time for four methods across 100 trials, then we divide each total time by 100\. For PCD and USAD, it is also possible to pre\-compute the distance matrix between each covariance matrix generated by CEs offline, which can make the computation inference time at least twice faster than current implementation\.DatasetMMDAggMMD\-FUSEMMD\-DUALSAMMDPCDVDUSADCIFAR\-100\.0720\.0470\.0470\.0240\.1170\.0160\.132ImageNet\-1K0\.0510\.0440\.0370\.0970\.7590\.0150\.772

Table 10:Detection power againstℓ1\\ell\_\{1\}\-APGD \(varying normNN\) and Sparse\-PGD \(varying sparsitykk\) on CIFAR\-10\. All results are averaged over multiple trials and reported as mean±\\pmstandard deviation\. Type\-I error is controlled in all settings\.Methodℓ1\\ell\_\{1\}\-N10ℓ1\\ell\_\{1\}\-N20ℓ1\\ell\_\{1\}\-N30SPGD\-kk10SPGD\-kk20SPGD\-kk50SPGD\-kk100PCD0\.231±0\.0090\.231\\pm 0\.0090\.476±0\.0090\.476\\pm 0\.0090\.719±0\.0110\.719\\pm 0\.0110\.991±0\.0030\.991\\pm 0\.0031\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000VD0\.977±0\.0050\.977\\pm 0\.0051\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000USAD0\.981±0\.0040\.981\\pm 0\.0041\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.0001\.000±0\.0001\.000\\pm 0\.000

Table 11:Adversarial video detection on UCF101 against the sparse video attack ofWei et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib51)\)\. We evaluate on the first two classes \(alphabetical\), comparing 40\-frame clean and adversarial clips from the same class via a permutation test\. Type\-I error is controlled\.ClassTotalNNAvg\. DetectionType\-I ErrorApplyEyeMakeup\+Archery6581\.5%81\.5\\%0\.0%0\.0\\%

## Appendix FAdditional Experiments

This section complements the results reported in[Section6](https://arxiv.org/html/2606.27832#S6)with six additional groups of experiments\. In summary, we \(i\) evaluate the proposed detector underℓ2\\ell\_\{2\}norm attacks and compare it against baselines \([SectionF\.1](https://arxiv.org/html/2606.27832#A6.SS1)\); \(ii\) report detailed numerical results across perturbation budgets and additional architectures \([SectionF\.2](https://arxiv.org/html/2606.27832#A6.SS2)\); \(iii\) evaluate robustness to transfer attacks from surrogate target models \([SectionF\.3](https://arxiv.org/html/2606.27832#A6.SS3)\); and \(iv\) empirically verify Type\-I error control \([SectionF\.4](https://arxiv.org/html/2606.27832#A6.SS4)\); \(v\) measure inference\-time computational efficiency against competing detectors \(Section[F\.5](https://arxiv.org/html/2606.27832#A6.SS5)\); \(vi\) evaluate the proposed detector against sparseℓ0\\ell\_\{0\}\(Sparse\-PGD\) andℓ1\\ell\_\{1\}adversarial attacks \(Section[F\.6](https://arxiv.org/html/2606.27832#A6.SS6)\); and \(vii\) extend our evaluation to adversarial video detection on UCF101 \(Section[F\.7](https://arxiv.org/html/2606.27832#A6.SS7)\)\. Unless stated otherwise, we follow the hypothesis\-testing protocol with the main text: significance levelα=0\.05\\alpha=0\.05and adversarial batch size\|Y\|=50\|Y\|=50\.

### F\.1Detection underL2L\_\{2\}Norm Attacks

The main text \([Section6](https://arxiv.org/html/2606.27832#S6)\) primarily reports the detection performance onℓ∞\\ell\_\{\\infty\}\-bounded adversarial perturbations, following the previous studiesGao et al\. \([2021](https://arxiv.org/html/2606.27832#bib.bib17)\)\. To check that our detectors are not tied to this particular norm, we also evaluate our method underℓ2\\ell\_\{2\}\-bounded attacks\.

Figure[4](https://arxiv.org/html/2606.27832#S4.F4)reports test power for PCD, VD, and USAD, together with the SAMMD baseline, against AA, CW, FGSM, and PGD attacks targeting a ResNet\-18 trained on*CIFAR\-10*, constrained inℓ2\\ell\_\{2\}norm\. We fix the adversarial batch size to\|Y\|=50\|Y\|=50and vary the perturbation budgetϵ\\epsilon, averaging over1,0001\{,\}000repetitions\.

Across all four attacks, the uncertainty\-aware statistics maintain high detection power\. USAD and PCD achieve near\-perfect detection onceϵ≥64\\epsilon\\geq 64, while SAMMD remains noticeably weaker at the same budgets\. For AA and FGSM \(panels \(a\) and \(c\)\), USAD reaches test power essentially equal to one already aroundϵ≈48\\epsilon\\approx 48, substantially outperforming SAMMD at small perturbation levels\. For PGD \(panel \(d\)\), both USAD and VD exceed0\.950\.95test power atϵ≈64\\epsilon\\approx 64, whereas SAMMD requires considerably larger perturbations to approach this regime\. These results indicate that the statistics underlying USAD capture distributional shifts that manifest under bothℓ∞\\ell\_\{\\infty\}\- andℓ2\\ell\_\{2\}\-bounded attacks\.

### F\.2Detailed Numerical Results

Tables[4](https://arxiv.org/html/2606.27832#A5.T4)and[5](https://arxiv.org/html/2606.27832#A5.T5)present the detailed numerical results corresponding to Figure[3](https://arxiv.org/html/2606.27832#S4.F3)in the main paper, providing exact test power values with standard deviations for all evaluated methods across different perturbation budgetsϵ∈\{1,2,…,8\}\\epsilon\\in\\\{1,2,\\ldots,8\\\}\. Table[4](https://arxiv.org/html/2606.27832#A5.T4)corresponds to Figure[3](https://arxiv.org/html/2606.27832#S4.F3)\(a−d\)\(a\\\!\-\\\!d\)and reports the detection performance of our proposed methods \(PCD, VD, and USAD\) against the baseline SAMMD on adversarial examples generated against a ResNet\-18 model trained on theCIFAR\-10dataset\. Table[5](https://arxiv.org/html/2606.27832#A5.T5)corresponds to Figure[3](https://arxiv.org/html/2606.27832#S4.F3)\(e−h\)\(e\\\!\-\\\!h\)and presents results on adversarial examples generated against a ResNet\-50 model trained on theImageNet\-1Kdataset\. The superior performance of our methods is even more pronounced on this larger\-scale, more complex dataset\. While the main paper visualizes a subset of attacks for clarity—specifically AA, CW, FGSM, and PGD for CIFAR\-10 \(Figure[3](https://arxiv.org/html/2606.27832#S4.F3)a−da\\\!\-\\\!d\), and AA, BIM, CW, and PGD for ImageNet\-1K \(Figure[3](https://arxiv.org/html/2606.27832#S4.F3)e−he\\\!\-\\\!h\)—these tables include all five attacks \(AA, BIM, CW, FGSM, and PGD\) for comprehensive evaluation with exact values\. These results indicate that our methods maintain their superiority over the baseline, consistent with the observed trends across all other attacks and datasets\. The standard deviations \(computed over 1,000 repetitions with\|Y\|=50\|Y\|=50adversarial examples per trial\) are consistently small, particularly for larger perturbation budgets where test power approaches 1\.0, indicating the stability and reliability of our detection methods\. The boldface values in the tables highlight the best\-performing method\(s\) for each attack and perturbation budget, clearly demonstrating that our proposed methods achieve state\-of\-the\-art detection performance across the vast majority of experimental configurations\.

### F\.3Robustness to Transfer Attacks and Additional Architectures

We next investigate robustness to transfer attacks, where adversarial examples are generated on a surrogate target model but detected using features from a distinct threat classifier, e\.g\., the AEs are generated with respect to ViT\-B/16, while the threat model is a ResNet\-18\. This setting reflects a realistic threat model in which the defender is unaware of the attacker’s architecture\.

Transfer Attacks\.Table[8](https://arxiv.org/html/2606.27832#A5.T8)evaluates the detection performance under transfer attack scenarios, where adversarial examples are generated by attacking different target models \(ResNet\-18 \(Res18\), WideResNet\-28 \(WRN28\), WideResNet\-70 \(WRN\-70\), and Shifted window \(Swin\) Transformer\) but detected using features extracted from Res18\. This setting tests the transferability and generalizability of our detection methods across different model architectures, which is crucial for practical deployment where the exact attack generation process is unknown\. Our proposed methods demonstrate exceptional robustness to transfer attacks across all target models and attack types\. Notably, both PCD and USAD achieve perfect detection \(1\.000±0\.0001\.000\\pm 0\.000\) across all five attacks \(AA, BIM, CW, FGSM, PGD\) and all four target models \(Res18, WRN28, WRN70, Swin\), indicating near\-universal detection capability regardless of the architectural characteristics of the model used to generate adversarial examples\. VD similarly achieves perfect or near\-perfect detection in the vast majority of scenarios, with only minor degradation on CW attacks against WRN28 and WRN70 \(0\.999±0\.0010\.999\\pm 0\.001\) and BIM attacks against WRN28 \(0\.993±0\.0010\.993\\pm 0\.001\), which remains substantially superior to baseline methods\. In contrast, the baseline SAMMD exhibits significant vulnerability to transfer attacks, with detection rates often dropping below0\.40\.4\(AA on WRN28, WRN70 and SWIN\) when it performs0\.9950\.995on Res18 originally\. This performance gap suggests that single\-statistic method based on maximum mean discrepancy alone may be overly sensitive to the specific characteristics of the attack generation process and fail to capture the fundamental distributional shifts induced by adversarial perturbations across different model architectures\. The aggregated\-statistic baselines \(MMDAgg, MMD\-FUSE, MMD\-DUAL\) show improved robustness compared to SAMMD, which aligns with the theoretical motivation for aggregation—combining multiple test statistics can provide more comprehensive distributional characterization and reduce sensitivity to specific attack characteristics\. However, these methods still fall short of our proposed approaches\. For example, on WRN28, MMDAgg achieves only0\.4590\.459for AA attacks and0\.2450\.245for BIM attacks, while MMD\-FUSE and MMD\-DUAL perform better but still exhibit substantial degradation on certain attack\-model combinations \(e\.g\., MMD\-FUSE:0\.7940\.794for CW on WRN28, MMD\-DUAL:0\.7640\.764for BIM on WRN28\)\. Our USAD method, which also employs aggregation but with our novel permutation\-based and variational distance\-based test statistics, achieves perfect detection across all scenarios, demonstrating that the choice of base statistics is as critical as the aggregation strategy itself\.

Additional Architectures\.To demonstrate the broader applicability of our detection framework beyond ResNet architectures, we evaluate our methods on vision transformers and wide residual networks\. Table[6](https://arxiv.org/html/2606.27832#A5.T6)presents results on the ViT\-B\-16 model trained on ImageNet\-1K, where our methods achieve perfect or near\-perfect detection across all attacks and perturbation budgets\. Notably, all three of our proposed methods \(PCD, VD, USAD\) attain1\.000±0\.0001\.000\\pm 0\.000test power starting fromϵ=1\\epsilon=1for AA, BIM, CW, and PGD attacks, while SAMMD exhibits substantially lower detection rates at small perturbation budgets \(e\.g\., 0\.691 for AA atϵ=1\\epsilon=1, 0\.758 for BIM atϵ=1\\epsilon=1\)\. The only exception is VD on FGSM attacks, where detection rates remain moderate across differentϵ\\epsilonvalues, suggesting potential architectural\-specific sensitivities of certain base statistics to particular attack types on transformer models\. Table[7](https://arxiv.org/html/2606.27832#A5.T7)further validates our framework on WRN28 and WRN70 architectures trained on CIFAR\-10, where adversarial examples are generated by attacking the same model used for feature extraction\. Our methods maintain strong performance with USAD achieving detection rates exceeding 0\.860 across all attacks on both architectures, while SAMMD struggles with rates often below 0\.500\. Interestingly, the performance patterns differ across architectures: VD achieves perfect detection on WRN28 for AA attacks but exhibits more variable performance on other attacks, whereas on WRN70, both PCD and VD achieve perfect detection for AA while showing complementary strengths on other attacks\. This architectural diversity in the results underscores the importance of aggregation in USAD, which consistently delivers robust detection by combining multiple complementary statistics that capture different aspects of adversarial perturbations across varied model architectures, from convolutional networks to transformers\.

### F\.4Type\-I Error Control Check

Controlling type\-I error \(false alarm rate\) is crucial for practical deployment\. Figure[5](https://arxiv.org/html/2606.27832#S6.F5)shows that all SAD and MMD testing methods maintain Type\-I error rates close to the theoretical significance level ofα=0\.05\\alpha=0\.05across different number of examples in the test set\. Our methods \(PCD, VD, and USAD\) also exhibit stable type\-I error rates, confirming the significance of all the statistical adversarial detection methods\.

### F\.5Computational Efficiency\.

Table[9](https://arxiv.org/html/2606.27832#A5.T9)reports the inference time per test trial averaged over 100 runs, with all experiments conducted using reference example size\|X\|\|X\|equal to input example size\|Y\|=50\|Y\|=50on the platform we mentioned in[E\.3](https://arxiv.org/html/2606.27832#A5.SS3)\. Our VD method demonstrates superior computational efficiency across both datasets, achieving0\.016​s0\.016\\text\{s\}on CIFAR\-10 and0\.015​s0\.015\\text\{s\}on ImageNet\-1K—representing 33% and 85% speedups over the baseline SAMMD, respectively\. Notably, VD’s inference time remains nearly constant across datasets, indicating excellent scalability to higher\-dimensional data\. While SAMMD shows moderate computational cost on CIFAR\-10\(0\.024​s\)\(0\.024\\text\{s\}\), it increases substantially to0\.097​s0\.097\\text\{s\}on ImageNet\-1K, suggesting quadratic or higher complexity with respect to feature dimensionality\. In contrast, PCD and USAD exhibit significantly longer inference times \(0\.1170\.117s and0\.1320\.132s on CIFAR\-10;0\.7590\.759s and0\.7720\.772s on ImageNet\-1K\), due to their reliance on computationally intensive distance matrix operations or optimization procedures\. The minimal overhead of VD, combined with its strong detection performance, makes it particularly attractive for real\-time or large\-scale deployment scenarios where computational budget is constrained\.

### F\.6ℓ0\\ell\_\{0\}\(Sparse\-PGD\) andℓ1\\ell\_\{1\}Attacks\.

While the main paper focuses on denseℓ∞\\ell\_\{\\infty\}andℓ2\\ell\_\{2\}adversarial perturbations, sparse attacks induce qualitatively different geometric distortions and thus warrant separate empirical verification\. To assess the robustness of our detection framework against this regime, we additionally evaluate againstℓ0\\ell\_\{0\}\-bounded perturbations generated by Sparse\-PGD \(SPGD\)\(Zhong & Liu,[2025](https://arxiv.org/html/2606.27832#bib.bib58)\)andℓ1\\ell\_\{1\}\-bounded perturbations generated byℓ1\\ell\_\{1\}\-APGD\. For SPGD, we vary the sparsity budgetk∈\{10,20,50,100\}k\\in\\\{10,20,50,100\\\}\(i\.e\., the number of perturbed pixels\), and forℓ1\\ell\_\{1\}\-APGD we sweep the perturbation normN∈\{10,20,30\}N\\in\\\{10,20,30\\\}\. All experiments follow the same evaluation protocol as the main paper and are verified to maintain a valid type\-I error control\.

Table[10](https://arxiv.org/html/2606.27832#A5.T10)reports the detection power of PCD, VD, and USAD across these settings\. Our methods, particularly VD and USAD, remain highly effective against sparse adversarial perturbations: both attain detection power of1\.0001\.000across nearly all configurations, with only marginal degradation under the most restrictiveℓ1\\ell\_\{1\}budget \(ℓ1\\ell\_\{1\}\-N10\)\. PCD shows a sharper sensitivity to the perturbation budget underℓ1\\ell\_\{1\}attacks, but recovers to near\-perfect detection as the budget grows\. These results confirm that the proposed framework generalizes beyond denseℓ∞\\ell\_\{\\infty\}/ℓ2\\ell\_\{2\}threat models and is robust to the geometrically distinct distortions induced by sparse adversarial attacks\.

### F\.7Extension to Adversarial Video Detection on UCF101\.

We also include a preliminary study that explores whether our sample\-wise distributional detection framework can be applied beyond static images\. Video data provides a natural setting for such an extension, since a short clip contains multiple temporally related frames that can be treated as a sample set\. However, we emphasize that our current method does not explicitly model temporal correlations across frames\. Therefore, this experiment should be viewed as a proof\-of\-concept rather than a dedicated adversarial video detection method\. Specifically, adversarial video attacks often introduce perturbations across multiple frames, which may induce a distributional discrepancy between clean and adversarial frame sets\. This makes video detection a potentially interesting future direction for multi\-sample detectors such as ours, although fully exploiting temporal structure would require additional modeling beyond the present framework\.

Setup\.We attack 65 sample videos drawn from the first two classes in alphabetical order \(ApplyEyeMakeupandArchery\) of the UCF101 action recognition benchmark, using the sparse video attack proposed byWei et al\. \([2019](https://arxiv.org/html/2606.27832#bib.bib51)\)\. For each successfully attacked video, we extract a 40\-frame clip from both its clean and adversarial versions, and treat the frames within each clip as a sample set\. Detection is performed by running a permutation test between the clean and adversarial frame sets drawn from the same class, yielding a binary detection decision per video\. The reported detection rate \(test power\) is averaged over all successfully attacked videos, and type\-I error is computed under the null using clean\-vs\-clean clip pairs\.

Results\.Table[11](https://arxiv.org/html/2606.27832#A5.T11)reports the result of this preliminary evaluation\. Our method achieves a detection rate of81\.5%81\.5\\%while maintaining0\.0%0\.0\\%type\-I error in this small\-scale setting\. These results suggest that sample\-wise distributional testing may transfer to video\-domain adversarial detection when frame\-level perturbations accumulate into a detectable distributional shift\. At the same time, this experiment does not establish a complete adversarial video detection framework, as it does not compare against specialized video detection baselines or explicitly account for temporal dependencies\. Developing detectors that combine distributional testing with temporal modeling is an interesting direction for future work\.