Research map / Adversarial robustness and security / Attacks on text and graphs
DataFreeShield: Defending Adversarial Attacks without Training Data
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DataFreeShield, which makes a non-robust pretrained classifier adversarially robust using only synthetic data generated from the pretrained model (diversified sample synthesis, a soft-label KL training loss, and gradient refinement).
Problem
Adversarial robustness for a pretrained model when the original training data is private and unavailable, so only the weights can be used (data-free adversarial robustness).
Approach
Generate a diverse surrogate dataset from the pretrained teacher by optimizing noise with randomly sampled loss coefficients per batch (DSS), then adversarially train the student with a teacher-soft-label KL objective plus a smoothness term and a sign-agreement gradient refinement (GradRefine) that yields flatter loss surfaces.
Key results
- On CIFAR-10 with WRN-28-10 under l_inf 4/255, DataFreeShield reaches 43.73% AutoAttack accuracy versus 10.67% for the best baseline (AIT on ResNet-20 scale comparisons aside, baselines are far lower).
- On SVHN with WRN-28-10 (l_inf 4/255), it reaches 62.66% AutoAttack accuracy versus 33.06% for AIT.
- On medical datasets with ResNet-18, it outperforms DAD, DiffPure and TTE on AutoAttack for most datasets (e.g., OrganC 42.56% vs 18.63% best other with ResNet-50 TTE on ResNet-50 excluded).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DataFreeShield instead of the strongest reported baseline | ResNet-18 medical-image classifiers · Tissue, Blood, Path, and OrganC; l∞ ε=8/255 | AutoAttack accuracy | Helped |
| Use DataFreeShield instead of the strongest reported baseline | WRN-28-10 · SVHN, CIFAR-10, and CIFAR-100; l∞ ε=4/255 | AutoAttack accuracy | Helped |
| Add DFShield training loss instead of TRADES to the synthesis baseline (ablation) | DataFreeShield training · CIFAR-10, WRN-28-10 | AutoAttack accuracy: 37.96 -> 36.34 (-1.62) | Mixed |
| Add DFShield training loss instead of TRADES to the synthesis baseline (ablation) | DataFreeShield training · CIFAR-10, ResNet-20 | AutoAttack accuracy: 2.03 -> 14.61 (+12.58) | Helped |
| Add DSS to DFShield training (ablation) | DataFreeShield · CIFAR-10, ResNet-20 | AutoAttack accuracy: 14.61 -> 19.09 (+17.06) | Helped |
| Add DSS to DFShield training (ablation) | DataFreeShield · CIFAR-10, WRN-28-10 | AutoAttack accuracy: 36.34 -> 41.40 (+3.44) | Helped |
| Add GradRefine to DFShield training with DSS (ablation) | DataFreeShield · CIFAR-10, ResNet-20 | AutoAttack accuracy: 22.65 (+20.62) | Helped |
| Add GradRefine to DFShield training with DSS (ablation) | DataFreeShield · CIFAR-10, ResNet-56 | AutoAttack accuracy: 30.51 (+6.17) | Helped |
| Add GradRefine to DFShield training with DSS (ablation) | DataFreeShield · CIFAR-10, WRN-28-10 | AutoAttack accuracy: 43.73 (+5.77) | Helped |
| Use DSS instead of fixed-coefficient synthesis (ablation) | Synthetic-data diversification for adversarial training · CIFAR-10 | AutoAttack accuracy: 36.34 -> 41.40 | Helped |
| Add Mixup to direct sample optimization (ablation) | Synthetic-data diversification · CIFAR-10 | AutoAttack accuracy: 36.34 -> 36.43 | No clear effect |
| Add Cutout to direct sample optimization (ablation) | Synthetic-data diversification · CIFAR-10 | AutoAttack accuracy: 36.34 -> 34.39 | Hurt |
Surprising findings
- Using a similar-domain or public dataset for additional adversarial training yields poor robustness compared with the original data, motivating the data-free setting.
- MART provides almost no robustness in the data-free setting, likely due to overfitting to synthetic misclassified samples.
Limitations
- Synthetic data quality is bounded by the pretrained teacher, making small models harder to train with synthetic data (ResNet-20 needs more samples).
- Clean accuracy trades off somewhat against robustness in some settings, and gains from DSS are inconsistent for WRN-28-10 without GradRefine.
- Evaluated only on image classification with small-resolution datasets and fixed PGD/AutoAttack budgets.
Experimental setup
Datasets: MedMNIST-v2 (Tissue, Blood, Path, OrganC) SVHN CIFAR-10 CIFAR-100
Benchmarks: MedMNIST-v2 medical datasets SVHN CIFAR-10 CIFAR-100
Metrics: AutoAttack accuracy PGD-10 accuracy clean accuracy coverage recall NDB JSD
Baselines: DaST DFME AIT DFARD DAD DiffPure TTE Qimera IntraQ RDSKD
Builds on: TRADES PGD adversarial training DeepInversion-style synthesis AutoAttack DFARD
Closest papers by meaning
- Out of Thin Air: Exploring Data-Free Adversarial Robustness Distillation (AAAI 2024 · similarity 0.89)
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.88)
- Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning (ICLR 2022 · similarity 0.88)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.87)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.86)
- Adversarial Purification with the Manifold Hypothesis (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.