Detecting Unseen Adversarial Image Manipulations Using Lightweight Statistical and Frequency Features

Adversarial perturbations can change a vision model's decision while remaining visually subtle, creating an integrity risk for AI-enabled imaging systems. This study asks whether a compact detector trained on one attack can identify a different, unseen attack without requiring the original clean image. A multilayer perceptron was trained on the 1,797-image scikit-learn Digits dataset using five stratified 70/15/15 train-validation-test splits. Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) perturbations used an L-infinity budget of 0.15. Twelve image-domain descriptors captured pixel statistics, local gradients, total variation, Laplacian response, entropy, and FFT/DCT energy. A class-weighted histogram gradient-boosting detector was trained only on clean and FGSM images. Its threshold was selected on validation data and transferred unchanged to the unseen PGD test. Clean classification accuracy was 96.74% ± 0.80%. FGSM and PGD succeeded against 78.23% ± 3.49% and 87.03% ± 4.25% of initially correct test images, respectively. On known FGSM examples, the detector achieved 99.85% ± 0.08% ROC AUC and 98.00% ± 0.50% recall. On unseen PGD examples, ROC AUC remained 99.85% ± 0.04%, recall reached 98.67% ± 0.56%, and balanced accuracy was 98.15% ± 0.54%, with a 2.37% ± 1.50% clean-image false-positive rate. Pixel standard deviation, mean intensity, and maximum local gradient were the dominant permutation-importance features. Lightweight image statistics transferred effectively from a single-step to an unseen iterative attack in this controlled benchmark. The result supports inexpensive pre-screening for image-integrity threats, but the small grayscale dataset and nonadaptive attacks preclude deployment claims. Validation on contemporary, higher-resolution and medical images is required.