用CLIP检测对抗攻击，无需了解模型或攻击方式
A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP
- 基于CLIP的提示相似度，不依赖具体模型或攻击类型
- 在多个数据集和攻击下达到当前最好检测效果
- 适合保护黑盒模型安全，无需训练或样本
对抗攻击威胁深度学习模型的可靠性，现有方法常依赖特定攻击假设、对抗样本或对分类器的白盒信息。本文提出 $A^4D$：一种完全黑盒、零样本的对抗攻击检测框架，利用来自 CLIP 的提示式相似度得分。据我们所知，这是首次将 CLIP 应用于该任务。方法基于两个关键观察：(i) CLIP 对微小且不可察觉的非语义扰动敏感；(ii) CLIP 嵌入空间中的偏移并非随机，可作为鲁棒的攻击指示器。在多种攻击、数据集和分类器上的实验表明，$A^4D$ 在攻击无关与分类器无关设置下达到最先进性能。
原文摘要 · Abstract (English)
Adversarial attacks pose a challenge to the reliability of deep learning models, motivating effective detection methods. Existing techniques often rely on attack-specific assumptions, access to adversarial samples, or knowledge of the underlying classifier (white-box). We propose $A^4D$ Attack- and Architecture-Agnostic Adversarial Detector, a completely black-box, zero-shot adversarial attack detection framework that utilizes prompt-based similarity scores derived from CLIP. To the best of our knowledge this is the first attempt to utilize CLIP for such a task. The method is based on two key observations: (i) CLIP is sensitive even to small imperceptible non-semantic perturbations; (ii) The shift in CLIP embedding space is not arbitrary and can be used as a robust attack indicator. Experiments across multiple attacks, datasets and classifiers validate that $A^4D$ achieves SOTA detection results in the attack-agnostic and classifier-agnostic setting.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。