DataFreeShield: Defending Adversarial Attacks without Training Data
This addresses a critical privacy and security issue in real-world scenarios where only pretrained models are available, offering a novel approach to data-free adversarial robustness.
The paper tackles the problem of achieving adversarial robustness without access to the original training data, which is often kept private, and proposes DataFreeShield, a method that generates surrogate datasets and uses them for adversarial training, outperforming baselines as the first entirely data-free solution.
Recent advances in adversarial robustness rely on an abundant set of training data, where using external or additional datasets has become a common setting. However, in real life, the training data is often kept private for security and privacy issues, while only the pretrained weight is available to the public. In such scenarios, existing methods that assume accessibility to the original data become inapplicable. Thus we investigate the pivotal problem of data-free adversarial robustness, where we try to achieve adversarial robustness without accessing any real data. Through a preliminary study, we highlight the severity of the problem by showing that robustness without the original dataset is difficult to achieve, even with similar domain datasets. To address this issue, we propose DataFreeShield, which tackles the problem from two perspectives: surrogate dataset generation and adversarial training using the generated data. Through extensive validation, we show that DataFreeShield outperforms baselines, demonstrating that the proposed method sets the first entirely data-free solution for the adversarial robustness problem.