Jun 2026· arXiv.org· Vol abs/2606.30342· 0 citations· 46 references
Computer Science
TL;DR
This work proposes $A^4D$ Attack- and Architecture-Agnostic Adversarial Detector, a completely black-box, zero-shot adversarial attack detection framework that utilizes prompt-based similarity scores derived from CLIP, the first attempt to utilize CLIP for such a task.
Abstract
Adversarial attacks pose a challenge to the reliability of deep learning models, motivating effective detection methods. Existing techniques often rely on attack-specific assumptions, access to adversarial samples, or knowledge of the underlying classifier (white-box). We propose $A^4D$ Attack- and Architecture-Agnostic Adversarial Detector, a completely black-box, zero-shot adversarial attack detection framework that utilizes prompt-based similarity scores derived from CLIP. To the best of our knowledge this is the first attempt to utilize CLIP for such a task. The method is based on two key observations: (i) CLIP is sensitive even to small imperceptible non-semantic perturbations; (ii) The shift in CLIP embedding space is not arbitrary and can be used as a robust attack indicator. Experiments across multiple attacks, datasets and classifiers validate that $A^4D$ achieves SOTA detection results in the attack-agnostic and classifier-agnostic setting.
This work introduces Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors and suggests that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.
Vincent L'eb'e, Y. Prudent, Corentin Friedrich et al.· 0 citations
This paper introduces DefendMal, a novel framework that synergistically combines Denoise Autoencoder with Sequence Squeezing, a Context-aware Adversarial Generator (CAG-AdvGAN), Projected Gradient Descent (PGD) adversarial training, and a Positive–Negative Detector with Variational Autoencoder (PNDetector-VAE) to enhance robustness against evolving adversarial threats.
Dennis Benedict Crasta, Vikash Kumar· Journal of Computer Virology...· 0 citations
Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the'piecewise linearity'of deep learning based models. Since adversarial attacks and adversarial robustness are mathematically defined problems that can be optimised directly with end-to-end differentiable search, adversarial robustness is more widely applicable than other robustness metrics such as corruption and perturbation robustness, and new kinds of adversarial attacks are beneficial for robustness testing. Attacks are targeted or non-targeted depending on whether the image is modified to misclassify to a particular class or to any incorrect class; we focus on the non-targeted setting. Finding the optimal input data points and hyper-parameters for generating non-targeted adversarial attacks remains a challenge for current methods like the Fast Gradient Method, Basic Iterative Method and Virtual Adversarial Method. We propose a new method, the"Binary Iterative Method"(BinIM), which uses a divide-and-conquer paradigm to optimise parameters and hyper-parameters for the generation of non-targeted attacks. We compare our method to other gradient-based adversarial attacks evaluated over pre-trained networks (InceptionV3, InceptionV2, ResNet V2 152) on classification tasks. On 1000 randomly-sampled images from the standard ImageNet dataset, the Binary Iterative Method outperforms all other gradient-based methods, qualitatively making the classifier misclassify with confidence up to 0.995 while reducing the probability of the true label to 2.21e-09 (approximately 0).
: Non-maximum suppression (NMS) is commonly used to filter redundant detection results in object detection models. Several white-box adversarial attacks to induce false positives by circumventing the NMS and increasing the number of false bounding boxes have been studied. However, since white-box attacks require internal parameters of the target model, actual viable environments are limited. This paper aims at an adversarial attack in a more feasible black-box environment threat model without internal parameters of the target model. Specifically, we propose a zero-query attack that exploits transferability such that we generate a universal adversarial perturbation (UAP) by the ensemble of multiple surrogate models that are white-box accessible and use the UAP to attack the target model in the black-box environment. We show that by increasing the number of surrogate models, we can achieve the false positive rate of the target model up to 84.4% in COCO2017 dataset and 82.9% in BDD100K dataset for targeting YOLOv8, and 87.2% in COCO2017 and 79.7% in BDD100K for targeting YOLOv9.
Kohei Kawasumi, Kazuki Yoneyama· Proceedings of the 23rd Inte...· 0 citations
The research methodology involved a systematic literature review using the Scopus database, adhering to Preferred Reporting Items for Systematic Reviews and Meta-Analyses guidelines, and focusing on recent advancements in attack and defence techniques.
This work proposes an efficient and effective adversarial attack detection scheme leveraging the multi-task perception within a complex vision system, and develops a consistency score metric to measure the inconsistency between vision tasks.
Cong Chen, J. Monteuuis, Jonathan Petit· 0 citations