RobustQuote: Using Reference Images for Adversarial Robustness
Source abstract
Abstract
We propose RobustQuote, a novel defense framework designed to enhance the adversarial robustness of vision transformers. The core idea is to leverage trusted reference images drawn from a dynamically changing pool unknown to the attacker as contextual anchors to detect and correct adversarial perturbations in input images. By quoting semantic features from uncorrupted references, RobustQuote mitigates the propagation of corrupted features through the model and uses these references to compute the rectification term. RobustQuote consists of two key modules: a quotation mechanism that propagates the global semantic tokens (i.e., the [cls] tokens) from reference images, and a rectification mechanism that adjusts the image tokens of the adversarial input using contextual signals from those references. During training, the model is explicitly guided to detect and rectify adversarial inputs more aggressively than clean ones. This approach is modular and plug-and-play, making it compatible with a wide range of vision transformer architectures, such as DeiT. Experiments show that RobustQuote achieves adversarial robustness on par with TRADES-trained DeiT under strong threat models, even when the attacker is aware of the reference set. In a more realistic setting where the attacker lacks access to the references, RobustQuote outperforms the second-best defense by +12.2% adversarial accuracy against the C&W attack. Our findings highlight the underexplored potential of incorporating external, attacker-unknown context as a robust defense strategy. RobustQuote offers a promising direction for addressing evolving adversarial threats in modern vision models, directly aligning with the critical challenges in adversarial machine learning and cybersecurity.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Image Processing Techniques and Applications · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Graduate School of Information Science and Technology, University of Osaka, Suita 565-0871, Japan
D3 Center, University of Osaka, Suita 565-0871, Japan
Funding
JST CREST
References (40)
Show source-provided references
1. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. (2018, January 18–23). Robust physical-world attacks on deep learning visual classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.10.1109/CVPR.2018.00175 ↗
2. Komkov, S., and Petiushko, A. (2021, January 16–18). Advhat: Real-world adversarial attack on arcface face id system. Proceedings of the IEEE International Conference of Pattern Recognition Systems, Chengdu, China.10.1109/ICPR48806.2021.9412236 ↗
3. Shin, T., Razeghi, Y., Logan IV, R.L., Wallace, E., and Singh, S. (2020, January 16–20). AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Online.10.18653/v1/2020.emnlp-main.346 ↗
4. Qin, Y., Carlini, N., Cottrell, G., Goodfellow, I., and Raffel, C. (2019, January 9–15). Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. Proceedings of the International Conference Learning Representations, PMLR, Long Beach, CA, USA.
5. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (May, January 30). Towards Deep Learning Models Resistant to Adversarial Attacks. Proceedings of the International Conference Learning Representations, Vancouver, BC, Canada.
6. Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., and Zhu, J. (2018, January 18–23). Defense against adversarial attacks using high-level representation guided denoiser. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.10.1109/CVPR.2018.00191 ↗
7. Lemarchant, H., Li, L., Qian, Y., Nakashima, Y., and Nagahara, H. (2023). Inference Time Evidences of Adversarial Attacks for Forensic on Transformers. arXiv.
8. Xu, Y., Sun, Y., Goldblum, M., Goldstein, T., and Huang, F. (2023, January 1–5). Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness. Proceedings of the International Conference Learning Representations, Kigali, Rwanda.
9. Mitigating robust overfitting via self-residual-calibration regularization10.1016/j.artint.2023.103877 ↗
10. Athalye, A., Carlini, N., and Wagner, D. (May, January 30). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. Proceedings of the International Conference Learning Representations, PMLR, Vancouver, BC, Canada.
11. Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., and Swami, A. (2017, January 2–6). Practical black-box attacks against machine learning. Proceedings of the ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.10.1145/3052973.3053009 ↗
12. Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., and Gelly, S. (2020, January 30). An Image is Worth 16 × 16 Words: Transformers for Image Recognition at Scale. Proceedings of the International Conference Learning Representations, Addis Ababa, Ethiopia.
13. Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., and Clark, J. (2021, January 18–24). Learning transferable visual models from natural language supervision. Proceedings of the International Conference Learning Representations, PMLR, Virtual.
14. Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. (2022, January 18–24). High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.10.1109/CVPR52688.2022.01042 ↗
15. Li, P., Gu, J., Kuen, J., Morariu, V.I., Zhao, H., Jain, R., Manjunatha, V., and Liu, H. (2021, January 20–25). Selfdoc: Self-supervised document representation learning. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Nashville, TN, USA.10.1109/CVPR46437.2021.00560 ↗
16. Retrieval-augmented generation for knowledge-intensive nlp tasks
17. Kim, W.J., Cho, Y., Jung, J., and Yoon, S.E. (2023, January 17–24). Feature Separation and Recalibration for Adversarial Robustness. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.10.1109/CVPR52729.2023.00791 ↗
18. Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jégou, H. (2021, January 18–24). Training data-efficient image transformers & distillation through attention. Proceedings of the International Conference Learning Representations, PMLR, Virtual.
19. Krizhevsky, A., and Hinton, G. (2009). Learning Multiple Layers of Features from Tiny Images. [Master’s Thesis, Department of Computer Science, University of Toronto].
20. Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., and Fei-Fei, L. (2009, January 20–25). Imagenet: A large-scale hierarchical image database. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Miami, FL, USA.10.1109/CVPR.2009.5206848 ↗
21. Croce, F., and Hein, M. (2020, January 13–18). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. Proceedings of the the 37th International Conference on Machine Learning, Online.
22. Adversarial Attacks and Defenses in Machine Learning-Empowered Communication Systems and Networks: A Contemporary Survey10.1109/COMST.2023.3319492 ↗
23. Kannan, H., Kurakin, A., and Goodfellow, I. (2018). Adversarial logit pairing. arXiv.
24. Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. (2019, January 9–15). Theoretically principled trade-off between robustness and accuracy. Proceedings of the International Conference Learning Representations, PMLR, Long Beach, CA, USA.
25. Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. (2019). Adversarial examples are not bugs, they are features. Adv. Neural Inform. Process. Syst., 32.
26. Ross, A., and Doshi-Velez, F. (2018, January 2–7). Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. Proceedings of the AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.10.1609/aaai.v32i1.11504 ↗
27. Benz, P., Zhang, C., and Kweon, I.S. (2021, January 4). Batch normalization increases adversarial vulnerability and decreases adversarial transferability: A non-robust feature perspective. Proceedings of the International Conference Learning Representations, Vienna, Austria.10.1109/ICCV48922.2021.00772 ↗
28. Huang, S., Lu, Z., Deb, K., and Boddeti, V.N. (2023, January 17). Revisiting Residual Networks for Adversarial Robustness. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.10.1109/CVPR52729.2023.00793 ↗
29. Dhillon, G.S., Azizzadenesheli, K., Bernstein, J.D., Kossaifi, J., Khanna, A., Lipton, Z.C., and Anandkumar, A. (May, January 30). Stochastic activation pruning for robust adversarial defense. Proceedings of the International Conference Learning Representations, Vancouver, BC, Canada.
30. Bai, Y., Zeng, Y., Jiang, Y., Xia, S.T., Ma, X., and Wang, Y. (2021, January 4). Improving Adversarial Robustness via Channel-wise Activation Suppressing. Proceedings of the International Conference Learning Representations, Vienna, Austria.
31. Hung-Quang, N., Lao, Y., Pham, T., Wong, K.S., and Doan, K.D. (2024, January 7–11). Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks. Proceedings of the International Conference Learning Representations, Vienna, Austria.
32. Yoon, J., Kim, K., and Jang, J. (2019, January 27–28). Propagated perturbation of adversarial attack for well-known CNNs: Empirical study and its explanation. Proceedings of the ICCV Workshop, Seoul, Republic of Korea.10.1109/ICCVW.2019.00520 ↗
33. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017). Attention is all you need. Adv. Neural Inform. Process. Syst., 30.
34. When adversarial training meets vision transformers: Recipes from training to architecture
35. Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification10.1109/TIP.2021.3118977 ↗
36. Jiang, Y., Ma, X., Erfani, S.M., and Bailey, J. (2021, January 18–22). Dual head adversarial training. Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN), Shenzhen, China.10.1109/IJCNN52387.2021.9533363 ↗
37. Carlini, N., and Wagner, D. (2017, January 22–24). Towards evaluating the robustness of neural networks. Proceedings of the Symposium on Security and Privacy (sp), San Jose, CA, USA.10.1109/SP.2017.49 ↗
38. Touvron, H., Cord, M., and Jégou, H. (2022, January 23–27). Deit iii: Revenge of the vit. Proceedings of the European Conference on Computer Vision, Tel Aviv, Israel.10.1007/978-3-031-20053-3_30 ↗
39. Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. (2020, January 23–28). Square attack: A query-efficient black-box adversarial attack via random search. Proceedings of the European Conference on Computer Vision, Glasgow, UK.10.1007/978-3-030-58592-1_29 ↗
40. Do vision transformers see like convolutional neural networks?