# RobustQuote: Using Reference Images for Adversarial Robustness
## 1 Introduction  
Recent studies have observed that deep models are sensitive to adversarial examples, which have been shown to be threatening in various domains, such as computer vision [1, 2], natural language processing [3], and speech recognition [4]. Research efforts aim to mitigate the impact of adversarial examples, such as adversarial training [5], input denoising [6], and attack detection [7]. Adversarial training is one of the most effective defense mechanisms, which generates adversarial examples and incorporates them into the training set [5]. This strengthens the decision boundaries [8] of the model subjected to such training. These new boundaries are harder to breach because they usually do not overfit the training distribution too closely. However, these boundaries can still be overcome with a larger perturbation or a new attack algorithm [9]. In brief, a model trained with these techniques will keepthe reinforced weights and be static. A consequence of this is that an attacker finding a successful perturbation will be able to use it and replay it to consistently fool the model. We qualify defense strategies that exhibit this pattern as static. Another way to defend against it would be to completely prevent the generation of attacks by stopping the correct flow of the gradient, for instance. This kind of defense, called gradient obfuscation [10], is often criticized and overlooked because of its intrinsic tendency to hide potential new vulnerabilities introduced in the defense method itself. For this reason, it is not desirable to prevent the generation of the attack according to the definition of gradient obfuscation [11], but rather to rely on a dynamic aspect that introduces discrepancies between the generation of the attack and the inference stages. We propose making the adversarial perturbation less relevant to the final inference task by leveraging the generalization capabilities of the model to find citations and self-corrections from reference images. Following Figure 1, we compare the classification task to the process of testing a student's knowledge. The input image is the question, the internal features are the student's thinking process, and the predicted result is the student's answer. So, adversarial examples can be considered as a deformed representation of the question, affecting the student's thinking process, and in turn the answer. The attacker, or the evil examiner, may design a question that seems ambiguous, and even confuse the model/student in a given context, but can hardly generalize to all possible contexts. But how can a context interact with the input image? We follow our inspiration from the student's test and argue that the quotation relies on generalized features that can be compared with a context, in a trackable way, but also in a way that varies with a different context. Specifically, we can request the student to retrieve information from reference documents to answer the question and to substantiate their reasoning using the same documents. This information retrieval and valorization, performed at inference time and generalizable on an arbitrary set of references, is the core of this work, putting the attacker in an asymmetric situation between attack generation and inference time. To this end, our novel defense mechanism, called RobustQuote, is a newly designed network block that can be plugged into most **vision** transformer (**ViT**) [12] architectures. This block aims to use the classification token of reference images to create a new classification token free of perturbations from the input image. We achieve this by replacing the classification token of the query image with a mixture of equivalent tokens from reliable and unattacked references. We propose to rely on the generalization of class embedding to create a dynamic defense method. In practice, this means utilizing a new set of references during each inference, thereby breaking the attacker's guarantee that the perturbation computed for a given batch of references will transfer to another batch.