{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/2408-01978","title":"AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning","arxiv_id":"2408.01978","date":"2024-08-04","proceeding":null,"authors":["Xin Wang","Kai Chen","Xingjun Ma","Zhineng Chen","Jingjing Chen","Yu-Gang Jiang"],"abstract":"Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks even under a black-box setting where the adversary can only query the model. Particularly, query-based black-box adversarial attacks estimate adversarial gradients based on the returned probability vectors of the target model for a sequence of queries. During this process, the queries made to the target model are intermediate adversarial examples crafted at the previous attack step, which share high similarities in the pixel space. Motivated by this observation, stateful detection methods have been proposed to detect and reject query-based attacks. While demonstrating promising results, these methods either have been evaded by more advanced attacks or suffer from low efficiency in terms of the number of shots (queries) required to detect different attacks. Arguably, the key challenge here is to assign high similarity scores for any two intermediate adversarial examples perturbed from the same clean image. To address this challenge, we propose a novel Adversarial Contrastive Prompt Tuning (ACPT) method to robustly fine-tune the CLIP image encoder to extract similar embeddings for any two intermediate adversarial queries. With ACPT, we further introduce a detection framework AdvQDet that can detect 7 state-of-the-art query-based attacks with $>99\\%$ detection rate within 5 shots. We also show that ACPT is robust to 3 types of adaptive attacks. Code is available at https://github.com/xinwong/AdvQDet.","url_abs":"https://arxiv.org/abs/2408.01978v1","url_pdf":"https://arxiv.org/pdf/2408.01978v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"2408-01978","repo_url":"https://github.com/xinwong/advqdet","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[{"method_slug":"clip","method_name":"CLIP"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2408.01978","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2408.01978"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xinwong/advqdet","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":2,"ran":3,"ran_violates":1,"unverified":1},"by_repo_kind":{"official":{"samples":7,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"d9def42110729a85","entry":"conv1x1","repo":"xinwong/advqdet","repo_kind":"official","path":"acpt/resnet.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/acpt/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d9def42110729a85"}},{"code_sha256_prefix":"160bb14bd76201b4","entry":"conv3x3","repo":"xinwong/advqdet","repo_kind":"official","path":"acpt/resnet.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/acpt/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"160bb14bd76201b4"}},{"code_sha256_prefix":"9e1ec9f6aaa45867","entry":"get_correctly_classified_images","repo":"xinwong/advqdet","repo_kind":"official","path":"select_img.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/select_img.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9e1ec9f6aaa45867"}},{"code_sha256_prefix":"2cb0c21874580d92","entry":"lambda_hack","repo":"xinwong/advqdet","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2cb0c21874580d92"}},{"code_sha256_prefix":"8bc8b691d2e94f84","entry":"normalize_fn","repo":"xinwong/advqdet","repo_kind":"official","path":"acpt/utils.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/acpt/utils.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8bc8b691d2e94f84"}},{"code_sha256_prefix":"8cdd577ff58690f6","entry":"resnet20","repo":"xinwong/advqdet","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8cdd577ff58690f6"}},{"code_sha256_prefix":"135e998f8e8e4e89","entry":"get_10_correctly_classified_images","repo":"xinwong/advqdet","repo_kind":"official","path":"select_img.py","file_url":"https://github.com/xinwong/advqdet/blob/HEAD/select_img.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"135e998f8e8e4e89"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}