On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detection (2023)

Abstract: Detecting adversarial samples that are carefully crafted to fool the model is a critical step to socially-secure applications. However, existing adversarial detection methods require access to sufficient training data, which brings noteworthy concerns regarding privacy leakage and generalizability. In this work, we validate that the adversarial sample generated by attack algorithms is strongly related to a specific vector in the high-dimensional inputs. Such vectors, namely UAPs (Universal Adversarial Perturbations), can be calculated without original training data. Based on this discovery, we propose a data-agnostic adversarial detection framework, which induces different responses between normal and adversarial samples to UAPs. Experimental results show that our method achieves competitive detection performance on various text classification tasks, and maintains an equivalent time consumption to normal inference.

## introduction despite remarkable performance on various nlp tasks, pre-trained language models (prlms), like bert @xcite , are highly vulnerable to adversarial samples @xcite . through intentionally designed perturbations, attackers can modify the model predictions to a specified output while maintaining syntactic and grammatical consistency @xcite . such sensitivity and vulnerability induce persistent concerns about the security of nlp systems @xcite . compared to deploying robust new models, it would be more applicable to production scenarios by distinguishing adversarial examples from normal inputs and discarding them before the inference phase @xcite . such detection-discard strategy helps to reduce the effectiveness of adversarial samples and can be combined with existing defence methods @xcite . however, existing adversarial detection methods depend heavily on the statistical characteristics of the training data manifolds, such as density estimation @xcite and local intrinsic dimensionality @xcite . some other researches focus on identifying high-frequency words in the training data and replacing or masking them in the prediction phase to observe the change in logits score @xcite . we propose a summary of existing works in in this work, we propose uapad, a novel framework to detect adversarial samples without exposure to training data and maintain a time consumption consistent with normal inference. we visualize our detection framework in figure 1 . universal adversarial perturbations (uaps) is an intriguing method summary require clean data require adv. data require extra model mle @xcite gaussian discriminant analysis ✔ ✔ disp @xcite token-level detection model ✔ ✔ ✔ fgws @xcite frequency-based word substitution ✔ ✔ adfar @xcite sentence-level detection model ✔ ✔ ✔ rde @xcite feature-based density estimation ✔ uapad (ours) experimental results demonstrate that our training-data-agnostic method achieves promising detection accuracy with bert on multiple adversarial detection tasks without using training or adversarial data, consuming additional inference time, or conducting overly extensive searches for hyperparameters. our main contributions are as follows: ## method this section shows how to calculate the uaps for a specific text model without obtaining training data. and subsequently, how to detect adversarial data by pre-trained uaps. data-free uaps we compute uaps for a finetuned model by perturbing the substitute inputs, based on the fact that uaps are generalized properties for a given model. we start with a parameterfrozen target network f and a random perturbation δ. the optimal situation is we can obtain some data that are involved in the training procedure. however, there are situations that we cannot access to training samples or it is unclear whether the accessible data is within the training set. to demonstrate the effectiveness of uapad under the data-agnostic scenario. we initialize the input embedding by randomly selecting data from an unrelated substitute dataset (e.g., the mnli dataset in our experiments). it is a reasonable assumption that a defender can access a moderate amount of substitute data. these embeddings are subsequently updated to ensure the model's confidence score is above the threshold on them. in our framework, we only retain samples with model confidence above 85% to calculate uaps. we then optimize the perturbation δ by gradient-ascending the overall loss when added to all the inputs and project it to a normalized sphere of fixed radius to constrain its norm. we obtain a reasonable uap when most predictions are induced to a fixed result under perturbation. ## experimental setup we experimentally validate our method on three well-accepted benchmarks: sst-2 @xcite , imdb @xcite , and agnews @xcite . the statistics of involved benchmark datasets are summarised in appendix a. we use the bert-base @xcite as the target model and pre-generate adversarial samples for the detection task with three attack methods: textfooler @xcite , pwws @xcite , and bertattack @xcite . ## experiment results and discussions in this section, we show the experimental performance of our proposed method under the two scenarios in section 4.1, and investigate different defence methods on the inference time consumption. ## conclusion in this paper, we propose that adversarial samples and clean samples exhibit different resistance to uaps, a model-related vector that can be calculated without accessing any training data. based on this discovery, we propose uapad as an efficient and application-friendly algorithm to overcome the drawbacks of previous adversarial detection methods in terms of slow inference and the requirement of training samples. uapad acts by observing the feedback of inputs when perturbed by pre-computed uaps. our approach achieves impressive detection performance against different textual adversarial attacks in various nlp tasks. we call for further exploration of the connection between adversarial samples and uaps. this section discusses the potential limitations of our work. this paper's analysis of model effects mainly focuses on common benchmarks for adversarial detection, which may introduce confounding factors that affect the stability of our framework. our model's performance on more tasks and more attack algorithms is worth further exploring. our detection framework exploits the special properties exhibited by the adversarial sample under universal perturbation. we expect a more profound exploration of improving the connection between uaps and adversarial samples. in figure 2 , we note that a small number (about 3%) of clean and adversarial samples do not suffer from uap interference. it is worth conducting an analysis of them to further explore the robustness properties of the language models. we leave these problems to further work.