Search papers, labs, and topics across Lattice.
This paper introduces $A^4D$, a novel black-box framework for zero-shot adversarial attack detection that leverages prompt-based similarity scores from CLIP. By capitalizing on CLIP's sensitivity to subtle perturbations and the structured nature of its embedding space, the authors demonstrate that their approach can effectively identify adversarial attacks without relying on specific attack types or classifier knowledge. Experimental results show that $A^4D$ achieves state-of-the-art performance across various attack methods, datasets, and classifiers, highlighting its robustness and versatility.
CLIP can be harnessed to detect adversarial attacks without any prior knowledge of the attack type or underlying model, achieving state-of-the-art results in a black-box setting.
Adversarial attacks pose a challenge to the reliability of deep learning models, motivating effective detection methods. Existing techniques often rely on attack-specific assumptions, access to adversarial samples, or knowledge of the underlying classifier (white-box). We propose \textit{$A^4D$ (\textbf{A}ttack- and \textbf{A}rchitecture-\textbf{A}gnostic \textbf{A}dversarial \textbf{D}etector)}, a completely black-box, zero-shot adversarial attack detection framework that utilizes prompt-based similarity scores derived from CLIP. To the best of our knowledge this is the first attempt to utilize CLIP for such a task. The method is based on two key observations: (i) CLIP is sensitive even to small imperceptible non-semantic perturbations; (ii) The shift in CLIP embedding space is not arbitrary and can be used as a robust attack indicator. Experiments across multiple attacks, datasets and classifiers validate that $A^4D$ achieves SOTA detection results in the attack-agnostic and classifier-agnostic setting.
