针对对比学习的几何结构攻击,让相似样本变远、不同样本变近。
Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds

- 通过扭曲嵌入流形中的相似性关系实施攻击
- 在Markmatch系统上使准确率从95.4%降至38.6%
- 可离线训练生成器,实现无梯度实时攻击
对比学习和孪生嵌入模型已成为现代验证系统的基础,决策依据并非离散分类边界,而是嵌入空间中的相对几何关系。然而现有对抗攻击仍以分类为中心,忽视了几何结构的脆弱性。本文提出一种面向几何的对抗攻击框架,将对比系统攻击重构为流形级别的关系破坏。该框架不针对单个预测,而是系统性地扭曲嵌入流形内的相似性组织:同时推远正样本对、拉近负样本对,最终导致成对相似性结构坍缩与反转。为实现可扩展部署,将迭代在线优化转为离线对抗几何变形先验学习阶段,并训练一个轻量级前馈生成器,从目标模型中学习通用的几何变形模式。训练完成后,生成器仅需一次前向传播即可生成对抗扰动,无需在线梯度计算,支持对基于相似性的验证系统进行实时攻击。多类验证架构实验表明,验证性能显著下降且出现严重的流形级关系破坏。在Markmatch系统上,准确率由95.4%降至38.6%,正负样本相似性结构被完全反转。
原文摘要 · Abstract (English)
Contrastive learning and Siamese embedding models have become the foundation of modern verification systems, where decisions are governed not by discrete classification boundaries, but by relational geometry in embedding space. However, existing adversarial attacks remain fundamentally classification-centric, overlooking the vulnerability of relational geometry. In this paper, we introduce a geometry-aware adversarial attack framework that reformulates attacks on contrastive systems as manifold-level relational corruption. Instead of targeting individual predictions, the proposed framework systematically distorts similarity organization within the embedding manifold by pushing positive pairs apart while simultaneously pulling negative pairs closer, ultimately collapsing and inverting pairwise similarity structure. To enable scalable deployment, we shift iterative online optimization into an offline adversarial geometry deformation prior learning stage and train a lightweight feed-forward generator that learns generalized geometry deformation patterns from the victim model. Once trained, the generator produces adversarial perturbations through a single forward pass without requiring online gradient computation, enabling real-time online attacks against similarity-based verification systems. Experimental results across multiple verification architectures demonstrate substantial degradation of verification performance together with severe manifold-level relational corruption. On the Markmatch verification system, the proposed attack reduces accuracy from 95.4% to 38.6% while completely reversing the positive-negative similarity structure.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。