A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP
It addresses the need for a universal, practical adversarial detection method that works in a completely black-box setting, eliminating reliance on attack-specific knowledge or white-box access.
The paper proposes A4D, a black-box, zero-shot adversarial attack detection method using CLIP, achieving SOTA detection across multiple attacks, datasets, and classifiers without needing attack-specific assumptions or classifier access.
Adversarial attacks pose a challenge to the reliability of deep learning models, motivating effective detection methods. Existing techniques often rely on attack-specific assumptions, access to adversarial samples, or knowledge of the underlying classifier (white-box). We propose \textit{$A^4D$ (\textbf{A}ttack- and \textbf{A}rchitecture-\textbf{A}gnostic \textbf{A}dversarial \textbf{D}etector)}, a completely black-box, zero-shot adversarial attack detection framework that utilizes prompt-based similarity scores derived from CLIP. To the best of our knowledge this is the first attempt to utilize CLIP for such a task. The method is based on two key observations: (i) CLIP is sensitive even to small imperceptible non-semantic perturbations; (ii) The shift in CLIP embedding space is not arbitrary and can be used as a robust attack indicator. Experiments across multiple attacks, datasets and classifiers validate that $A^4D$ achieves SOTA detection results in the attack-agnostic and classifier-agnostic setting.