A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP¶

Conference: ECCV 2026
arXiv: 2606.30342
Code: None
Area: AI Security / Adversarial Attack Detection
Keywords: Adversarial Attack Detection, CLIP, Zero-Shot Detection, Classifier-Agnostic, Prompt-Based Detection

TL;DR¶

Proposes A4D, a completely black-box, zero-shot adversarial attack detection framework. By exploiting the sensitivity of CLIP to micro-perturbations, the framework compares the cosine similarity of image embeddings with a set of carefully crafted text prompts, and then aggregates them into a single detection score via PCA. This detects adversarial examples without needing to know the attack type or classifier architecture, achieving SOTA performance across multiple attacks, datasets, and classifiers.

Background & Motivation¶

Background: Existing adversarial attack detection methods can be roughly divided into three categories: attack-specific detection (learning thresholds or training classifiers to distinguish clean from adversarial examples, requiring assumptions about the attack type), classifier-representation-based (utilizing hidden layer activations or architectural characteristics, heavily coupled with the classifier), and training-based (requiring both clean and adversarial examples to train a detector). These three classes of methods all rely on prior information—either knowing the attack type, accessing the classifier architecture, or having training data—which is often unavailable in real-world scenarios.

Key Challenge: An ideal detector should operate under completely black-box conditions: without knowing the attack type, without accessing the classifier architecture, and without utilizing adversarial examples for training. Meanwhile, as new classifiers and novel attacks continuously emerge, the detection method must possess the generalization ability to cope with unseen attacks and future classifiers. How can we extract signals that distinguish clean from adversarial examples under such highly constrained conditions?

Core Idea: The key insight of this work is that the embedding space of CLIP is not only adept at semantic alignment but also exceptionally sensitive to non-semantic, micro-perturbations. Even imperceptible adversarial perturbations produce measurable, biased shifts in the CLIP embedding space. More importantly, these shifts are not random: attacked samples tend to cluster in specific regions of the embedding space. Thus, text prompts can be used to encode the abstract concept of being "attacked", and whether an image is attacked can be determined by calculating the similarity between the image and the prompts. Based on this, A4D (Attack- and Architecture-Agnostic Adversarial Detector) is proposed.

Method¶

Overall Architecture¶

The core idea of A4D is to transform adversarial detection into a zero-shot classification problem based on the CLIP semantic space. The overall workflow is as follows: the input image is processed by the CLIP image encoder to obtain an embedding vector; simultaneously, a set of text prompts describing noise/anomaly characteristics is passed through the CLIP text encoder to obtain the corresponding embeddings; the cosine similarity between the image embedding and each prompt embedding is calculated, yielding an \(N\)-dimensional similarity vector (here \(N=10\)); a small set of clean images is used as a representative set to estimate the first principal component direction \(v_1\) of the similarity matrix; the similarity vector of the test image is normalized in the same manner and projected onto \(v_1\) to obtain a one-dimensional detection score \(s'\); a higher score indicates a higher probability of being an adversarial example.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Image X'"] --> B["CLIP<br/>Image Encoder"]
    B --> C["Image Embedding z'I"]
    C --> D["Calculate Cosine Similarity<br/>with 10 Text Prompts"]
    D --> E["10D Similarity Vector u'<br/>Normalization → u~'"]
    E --> F["Project onto PC1 direction<br/>s' = u~'^T · v1"]
    F --> G{"s' > Threshold?"}
    G -->|Yes| H["Determined as Adversarial"]
    G -->|No| I["Determined as Clean"]

Key Designs¶

1. Text Prompt Dictionary Construction: Encoding the Concept of "Being Attacked" with Natural Language

To leverage the CLIP semantic space for characterizing adversarial perturbations, this work manually constructs a dictionary containing 10 prompts. These prompts describe signs of noise or artifacts from different aspects, such as "An image with noise", "An image with unnatural texture", "An image with adversarial perturbations", "An image with high-frequency noise", etc. The reason for choosing multiple prompts instead of a single prompt is twofold: (1) different attacks induce different shift patterns in the embedding space (as shown in Figure 4), and multiple prompts can cover more attack types; (2) the ensemble of multiple prompts reduces the variance of the detection signals. The cross-correlation heatmap in Figure 5 shows low correlation among these prompts, indicating they indeed provide diversified detection signals. It is worth noting that not all semantically related noise prompts are effective—for instance, the intuitive prompt "A noisy image" is not discriminative across all attacks (third subfigure of Figure 4), highlighting that prompt selection significantly impacts performance.

2. PCA-Based Similarity Vector Aggregation: Extracting the Most Robust Detection Factor from High-Dimensional Signals

After obtaining the 10-dimensional similarity vector, it needs to be aggregated into a scalar detection score. This work compares four aggregation strategies: maximum percentile, minimum percentile, mean percentile, and PCA projection. The core steps of the PCA method are: selecting \(M=200\) clean images from the target dataset to form a representative set, and computing their similarity matrix \(P \in \mathbb{R}^{M \times N}\); after standardizing \(P\) column-wise, PCA is performed to find the first principal component direction \(v_1 \in \mathbb{R}^N\) (i.e., the direction that explains the maximum variance); during testing, the standardized similarity vector \(\tilde{u}'\) of a new image is projected onto \(v_1\) to obtain the score \(s' = \tilde{u}'^{\top} v_1\). PCA outperforms simple statistics because the PC1 direction automatically learns the weights of different prompts in distinguishing clean from adversarial examples, exploiting the covariance structure among prompts to find the optimal projection direction instead of assigning equal weights to all prompts.

3. Zero-Shot Detection Protocol: Inference Workflow without Adversarial Examples and Classifier Information

The entire detection process does not require any adversarial examples for training. The validation set only requires 200 clean images, and these images are purely used to estimate the PCA direction—no model fine-tuning or parameter updates are involved. During inference, processing a single image only requires one forward pass of CLIP (0.0091 seconds/image), and subsequent operations are just the normalization and projection of low-dimensional similarity vectors. This means A4D can be plugged-and-played onto any classifier: regardless of the classifier architecture (Transformer / CNN / MLP) or the adversarial attack type (white-box/black-box, \(\ell_\infty\)/\(\ell_2\) bounded), the framework itself requires no adjustments.

A Complete Example: FGSM Detection on DeiT-Small¶

Suppose the DeiT-Small classifier is used to process the Tiny-ImageNet dataset, and the attacker generates adversarial examples using FGSM (\(\epsilon = 8/255\)). The detection process is as follows: (1) First, randomly select 200 clean images from the training set, extract their embeddings using CLIP (e.g., ViT-B/32), and simultaneously extract embeddings of the 10 text prompts; (2) compute the \(200 \times 10\) similarity matrix \(P\), and perform PCA after standardization to obtain \(v_1\); (3) during testing, extract the embedding of the input image, calculate its similarity with the 10 prompts, and take the inner product of the standardized vector with \(v_1\) to obtain the detection score \(s'\). Under FGSM attack, the \(s'\) of adversarial examples is significantly higher than that of clean samples (as their "noisy" characteristics are captured by multiple prompts), achieving an AU-ROC of 99.24 for FGSM in Table 3.

Key Experimental Results¶

Main Results¶

The following results are measured on the Tiny-ImageNet dataset with the DeiT-Small classifier. The baselines include noise-statistics-based methods MAD and Wavelet. The metric is AU-ROC (%).

Attack Method	A4D (Ours)	MAD	Wavelet
FGSM	99.24	73.46	95.99
PGD	98.16	71.07	95.05
AutoAttack	98.39	85.95	93.69
BIM	97.76	83.46	90.36
CW	77.31	50.68	50.92
DeepFool	78.62	50.46	50.62
Square	97.84	63.52	56.88
Average	92.47	68.37	76.22

Similar conclusions are drawn on three other classifiers (Wide-ResNet average 92.53, ResNet34 average 93.32, ConvNeXt-Tiny average 84.97): A4D's average AU-ROC on all classifiers overwhelmingly outperforms MAD and Wavelet baselines, securing optimal or sub-optimal results for the vast majority of attacks. Compared with the Mahalanobis method which requires internal classifier information (its attack-agnostic variant achieves only 54.96 on DeiT-Small), A4D achieves a substantial lead under the completely black-box setting.

Ablation Study¶

Influence of different aggregation strategies on detection performance (Tiny-ImageNet, DeiT-Small, AU-ROC %).

Aggregation Method	FGSM	PGD	AutoAttack	BIM	CW	DeepFool	Square	Average
Max Percentile	99.25	98.54	98.63	97.99	74.70	76.22	95.35	91.53
Min Percentile	93.07	89.84	89.73	85.66	69.01	69.75	88.05	83.58
Mean Percentile	98.63	97.44	97.61	96.81	75.19	76.86	94.77	91.04
PCA (Ours)	99.24	98.16	98.39	97.76	77.31	78.62	97.84	92.47

PCA consistently outperforms or matches other aggregation strategies across all attacks, achieving the best in 5 out of 7 attacks and the second-best in 2. Notably, on CW and DeepFool, their two most difficult attacks, the advantage of PCA is most pronounced (outperforming Mean Percentile by 2.1 and 1.8 percentage points, respectively).

Key Findings¶

Performance discrepancy between noise-like attacks vs. structured attacks: The method is highly effective at detecting attacks that generate noise-like perturbations, such as FGSM, PGD, AutoAttack, BIM, and Square (AU-ROC > 95%), but its performance decreases significantly to around 77-78% on CW and DeepFool. The reason is that CW and DeepFool perturbations are highly correlated with image edges (quantitatively verified in Figure 7), and their structured patterns deviate from the semantics of "noise-related" prompts, leading to weaker similarity signals.
Stability advantage of PCA aggregation: Compared with simple Max/Min/Mean aggregation, PCA is more stable across multiple attack types as it captures the covariance structure between prompts. Specifically, the Min Percentile strategy performs the worst (average 83.58), indicating that a single least similar prompt is insufficient to reliably distinguish clean from adversarial examples.
Cross-classifier generalization: A4D is consistently effective across 4 structurally distinctive classifiers (ViT-like DeiT-Small, CNN-like Wide-ResNet/ResNet34, and lightweight ConvNeXt-Tiny), with average AU-ROC ranging from 84.97% to 93.32%, validating its classifier-agnostic nature.

Highlights & Insights¶

Encoding adversarial perturbations with text prompts: Transforming the binary classification of "whether an image is attacked" into "the semantic distance between the image and a set of noise/anomaly description texts" is an elegant reformulating of the problem. This leverages the joint embedding space of CLIP, which can understand both "natural texture" and abstract concepts like "digital distortion".
True zero-shot with zero training overhead: A4D does not require any adversarial examples for training or validation, nor does it require fine-tuning CLIP. The only statistical calculation needed (PCA of 200 clean images) has a negligible time cost, achieving an inference speed of 0.0091 seconds/image (including all prompt computations), demonstrating real-time processing capability.
New perspective on non-semantic properties of CLIP: While CLIP is usually viewed as a semantic alignment model, this work explores its sensitivity to non-semantic, low-level visual features, which is validated as the key to detecting adversarial attacks. This finding itself has transfer value: other tasks requiring low-level feature discrimination (such as image forgery detection and JPEG artifact detection) could also benefit.
Simple and interpretable detection signal: The weights of each component of the PCA projection direction \(v_1\) can be interpreted as the contribution of each prompt to the detection, which is more interpretable than end-to-end black-box detectors.

Limitations & Future Work¶

Prompt selection relies on manual curation: The current 10 prompts are manually selected by the authors based on validation performance, and the detection capabilities of different prompts vary vastly (e.g., "A noisy image" completely fails across all attacks). A more systematic automatic prompt selection/learning strategy is a natural direction for future work, though care must be taken to prevent the learning process from collapsing into overfitting on specific attacks.
Limited detection effectiveness on CW and DeepFool: For attacks generating structured perturbations (correlated with image edges), the AU-ROC is only about 77-78%. Improving the detection of such attacks may require adding prompts that describe structured features, such as "edge perturbation" or "texture variation".
Assumption of distribution drift: The method assumes that a set of clean images from the target dataset can be obtained to estimate the PCA direction. When there is a drift between the test distribution and the validation set, detection performance might degrade. How to detect under absolutely zero exposure to target data (true zero-shot) remains an open challenge.
Quality bottleneck of CLIP itself: The performance of the method is constrained by the quality of CLIP features. Future and stronger vision-language models (e.g., SigLIP, EVA-CLIP) could directly boost detection performance.

vs. Mahalanobis Detection (Lee et al., 2018): The Mahalanobis method calculates Mahalanobis distance based on hidden layer features of the classifier to detect adversarial examples, which requires access to the classifier's internal representations and is inherently classifier-dependent. A4D is completely black-box and does not rely on any internal classifier information. Experiments show that under the attack-agnostic setting, Mahalanobis only achieves 54.96 (on average for DeiT-Small), whereas A4D's 92.47 represents an overwhelming superiority.
vs. AnomalyCLIP (Zhou et al., 2023): AnomalyCLIP leverages text prompts from CLIP for zero-shot anomaly detection, focusing on semantic "anomalies" (unseen object classes or defect patterns compared to the training set). A4D focuses on non-semantic adversarial perturbations—where the primary content of the image remains unchanged, and only pixel-level modifications are made. While they share a similar technical framework (CLIP + prompts), their detection objectives are fundamentally different.
vs. Traditional Attack-Specific Detection (Metzen et al., 2017): Traditional methods require assuming the attack type (such as FGSM or PGD) to train exclusive detectors. A4D does not require such assumptions, enabling it to detect unseen attack types during training and possessing stronger generalization.

Rating¶

Novelty: ⭐⭐⭐⭐ The first work to leverage CLIP for zero-shot adversarial attack detection; the problem formulation transition (adversarial perturbation \(\rightarrow\) semantic similarity) is ingenious.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ Covers 7 attacks (white-box + black-box), 4 classifiers with structurally diverse architectures, and 2 datasets, with complete ablation (comparison of aggregation strategies, analysis of perturbation structure in Fig 7); highly comprehensive and robust.
Writing Quality: ⭐⭐⭐⭐ Clear motivation, self-consistent methodology, although the prompt selection process could have been described more transparently.
Value: ⭐⭐⭐⭐ Completely black-box + zero training overhead + real-time inference, highly suitable for real-world deployment; opens up new possibilities for applying vision-language models to non-semantic tasks.