On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detection

TL;DR

This paper introduces a data-free, universal adversarial perturbation-based detection method that effectively identifies adversarial samples in text classification without requiring training data, ensuring privacy and broad applicability.

Contribution

The work presents a novel data-agnostic framework leveraging UAPs for adversarial detection, eliminating the need for original training data and maintaining efficiency.

Findings

Achieves competitive detection accuracy across multiple text tasks.

Operates with similar speed to standard inference methods.

Does not require access to original training data.

Abstract

Detecting adversarial samples that are carefully crafted to fool the model is a critical step to socially-secure applications. However, existing adversarial detection methods require access to sufficient training data, which brings noteworthy concerns regarding privacy leakage and generalizability. In this work, we validate that the adversarial sample generated by attack algorithms is strongly related to a specific vector in the high-dimensional inputs. Such vectors, namely UAPs (Universal Adversarial Perturbations), can be calculated without original training data. Based on this discovery, we propose a data-agnostic adversarial detection framework, which induces different responses between normal and adversarial samples to UAPs. Experimental results show that our method achieves competitive detection performance on various text classification tasks, and maintains an equivalent time consumption to normal inference.