Neural network based classifiers are still prone to manipulation through\nadversarial perturbations. State of the art attacks can overcome most of the\ndefense or detection mechanisms suggested so far, and adversaries have the\nupper hand in this arms race. Adversarial examples are designed to resemble the\nnormal input from which they were constructed, while triggering an incorrect\nclassification. This basic design goal leads to a characteristic spatial\nbehavior within the context of Activation Spaces, a term coined by the authors\nto refer to the hyperspaces formed by the activation values of the network's\nlayers. Within the output of the first layers of the network, an adversarial\nexample is likely to resemble normal instances of the source class, while in\nthe final layers such examples will diverge towards the adversary's target\nclass. The steps below enable us to leverage this inherent shift from one class\nto another in order to form a novel adversarial example detector. We construct\nEuclidian spaces out of the activation values of each of the deep neural\nnetwork layers. Then, we induce a set of k-nearest neighbor classifiers (k-NN),\none per activation space of each neural network layer, using the\nnon-adversarial examples. We leverage those classifiers to produce a sequence\nof class labels for each nonperturbed input sample and estimate the a priori\nprobability for a class label change between one activation space and another.\nDuring the detection phase we compute a sequence of classification labels for\neach input using the trained classifiers. We then estimate the likelihood of\nthose classification sequences and show that adversarial sequences are far less\nlikely than normal ones. We evaluated our detection method against the state of\nthe art C&W attack method, using two image classification datasets (MNIST,\nCIFAR-10) reaching an AUC 0f 0.95 for the CIFAR-10 dataset.\n