Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds

The paper introduces a geometry-aware adversarial attack framework that reformulates attacks on contrastive systems as manifold-level relational corruption. Instead of targeting individual predictions, the proposed framework systematically distorts similarity organization within the embedding manifold by pushing positive pairs apart while simultaneously pulling negative pairs closer, ultimately collapsing and inverting pairwise similarity structure. To enable scalable deployment, the framework shifts iterative online optimization into an offline adversarial geometry deformation prior learning stage and trains a lightweight feed-forward generator that learns generalized geometry deformation patterns from the victim model. Once trained, the generator produces adversarial perturbations through a single forward pass without requiring online gradient computation, enabling real-time online attacks against similarity-based verification systems.

The paper states: "We define this attack paradigm as a Relational Geometry Attack. Unlike conventional adversarial attacks that manipulate isolated prediction outputs, a relational geometry attack seeks to systematically collapse and invert pairwise similarity organization in latent space by directly deforming the underlying embedding manifold."

The attack objective is formulated as manifold-level relational corruption. For positive pairs, the framework seeks to separate embeddings occupying nearby semantic regions. For negative pairs, it seeks to collapse originally separated manifold regions and distort their relational boundaries. The resulting deformation systematically disrupts pairwise similarity organization and inverts relational structure across the embedding manifold.

The threat model specifies that offline training follows the classic adversarial optimization setting, where the attacker independently collects a small auxiliary dataset that follows a similar distribution to, but has no overlap with, the victim model's training data. The attacker has white-box access to the frozen victim model during training but does not modify the victim model's parameters, architecture, or training data. The online attack operates under a black-box setting, where the attacker generates adversarial example pairs via the trained attack generator and submits them to the victim model through queries without receiving any internal model information. The attacker's goal is to invert the victim model's pairwise similarity judgments: positive pairs should be classified as dissimilar, and negative pairs as similar, with perturbations imperceptible to human observers.

The geometry deformation generative network is implemented using a U-Net-based encoder-decoder architecture with skip connections. The generator produces corresponding geometry-aware perturbation fields for both inputs, which are added to the original inputs to produce adversarially perturbed samples. The perturbations are constrained using both element-wise clipping and L2 projection. The victim model is a frozen pairwise verification model in the MarkMatch same-hand ballot mark verification framework, using a DenseNet121 backbone followed by a linear embedding layer that maps features to a 64-dimensional embedding space. The victim model computes cosine similarity scaled by a temperature parameter τ = 0.07.

The attack optimization objective includes a main relational corruption objective that encourages relational separation for positive pairs and relational collapse for negative pairs, a relational direction regularization term that penalizes inconsistent manifold deformation directions, and an optional perturbation regularization term based on the L2 norm of the generated perturbations.

Experimental results demonstrate substantial degradation of verification performance and systematic collapse of positive-negative separation in embedding space. On the MarkMatch verification system, the proposed attack reduces accuracy from 95.4% to 38.6% while completely reversing the positive-negative similarity structure. The paper reports: "The average positive-pair logit decreases from 9.993 to -2.478, while the average negative-pair logit increases from 0.641 to 3.340... Consequently, the original semantic similarity organization becomes inverted: embeddings that originally occupied nearby manifold regions are pushed apart, while originally separated manifold regions collapse toward each other."

The paper reports a Positive Logit Drop of 12.471, a Negative Logit Rise of 2.698, and a Gap Reduction of 15.170. The clean positive-negative relational gap decreases from 9.352 to -5.818 after attack, meaning the adversarial relational gap becomes negative and the original semantic separation structure is completely inverted.

Compared to baselines, the proposed framework substantially outperforms Diff-PGD, ZO/NES, and Surrogate Transfer. Diff-PGD achieves a Gap Reduction of 5.458, ZO/NES achieves 1.200, and Surrogate Transfer achieves 4.584, while the proposed framework achieves 15.170. The paper states: Among all evaluated attacks, only the proposed geometry-aware framework fully collapses and reverses the original semantic separation structure governing the latent relational organization.

Cross-system evaluation shows consistent relational geometry degradation across different contrastive verification architectures. On SigNet, clean accuracy decreases from 1.000 to 0.500. SigScatNet exhibits adversarial accuracy decreasing from 0.982 to 0.324 with a Gap Reduction of 17.760. CEDAR DenseNet shows adversarial accuracy decreasing from 0.970 to 0.501 with a Gap Reduction of 10.254. The paper concludes: "These results suggest that the observed vulnerability does not arise from a specific backbone architecture alone, but instead reflects an intrinsic weakness of similarity-driven representation learning systems whose decisions depend on preserving manifold-level relational organization."

Perturbation budget ablation shows that manifold-level relational collapse does not depend on large unconstrained perturbations. With ε2 = 2.5, adversarial accuracy is 0.386 and Gap Reduction is 15.170. Without an effective L2 constraint, adversarial accuracy is 0.378 and Gap Reduction is 14.720. The paper states: "The consistently large Gap Reduction across both settings suggests that manifold-level relational collapse does not depend on large unconstrained perturbations. Instead, substantial semantic separation corruption can still emerge under tightly bounded perturbations."

Transformation-based defense evaluation shows that random input transformations weaken the attack but do not eliminate relational geometry corruption. Without transformation, adversarial accuracy decreases to 0.363 with a Gap Reduction of 16.550. With random transformations, adversarial accuracy increases to 0.480 and Gap Reduction decreases to 10.094. The paper states: Although the defense reduces the severity of relational collapse, the embedding manifold still exhibits substantial semantic separation degradation under adversarial deformation.

Query cost analysis for the ZO/NES baseline shows that attacking 1,972 pairs requires 851,904 attack-phase queries, corresponding to 428 optimization queries per pair, with a total of 861,764 victim-model queries and a runtime of 20,682 seconds. In contrast, the proposed framework amortizes manifold deformation into an offline geometry-learning stage, enabling real-time relational corruption without repeated embedding-space optimization during deployment.

The paper concludes: "Our findings suggest that the adversarial vulnerability of contrastive systems fundamentally differs from that of traditional classification models. As modern AI systems increasingly rely on similarity-driven representation learning, retrieval, and embedding-based reasoning, future robustness may depend less on protecting decision boundaries and more on preserving the relational geometry governing pairwise similarity organization itself."

Improvements to AI Systems:

1. Add Relational Geometry Regularization During Training

• Train contrastive models with an explicit loss term that penalizes collapse of negative-pair distances and separation of positive-pair distances under small adversarial perturbations.

• Use the paper’s finding that manifold-level relational corruption is the core vulnerability—not just decision boundaries—to design a robust training objective that preserves pairwise similarity structure even under bounded input noise.

2. Implement Manifold-Aware Adversarial Training

• During training, generate adversarial perturbations using the proposed offline geometry deformation generator (trained on a surrogate) and augment the training set with these perturbed pairs.

• This forces the embedding manifold to maintain relational integrity (positive pairs close, negative pairs far) under realistic, geometry-aware attacks, rather than relying on standard PGD-based adversarial training that targets isolated predictions.

3. Deploy Real-Time Attack Detection via Relational Gap Monitoring

• Build a lightweight monitoring module that computes the average positive-pair logit, negative-pair logit, and the relational gap (positive minus negative) on incoming query pairs.

• If the gap drops below a threshold (e.g., from 9.35 to near zero or negative), flag the system as under relational geometry attack and trigger defensive transformations or fallback to a more robust verification method.

4. Integrate Transformation-Based Defenses with Relational Constraints

• Combine random input transformations (e.g., noise, cropping, blur) with a post-hoc relational consistency check: after transformation, verify that the positive-negative ordering of similarity scores is preserved.

• If transformations cause relational inversion, reject the query pair—this leverages the paper’s finding that while transformations weaken the attack, they do not fully prevent relational collapse, so a verification step is needed.

5. Develop Cross-Architecture Robustness Audits

• Use the proposed framework as a standardized stress test for any new contrastive verification system (e.g., face recognition, speaker verification, biometric matching).

• The audit would measure Gap Reduction and Positive Logit Drop under bounded perturbations to identify if the system has intrinsic manifold-level weaknesses, before deployment.

6. Design Adaptive Defense via Manifold Deformation Reversal

• Train a separate generative model that learns to “repair” the embedding manifold by applying inverse geometry deformation fields to input pairs, counteracting the attack generator’s effects.

• This could be used as a preprocessing step to restore relational structure before similarity comparison, effectively neutralizing the attack in real time.

What the Improved AI System Can Do:

• Maintain high verification accuracy (e.g., >90%) even when subjected to geometry-aware adversarial perturbations that would otherwise drop accuracy from 95.4% to 38.6%.

• Detect and reject adversarial pairs in real time by monitoring relational gap dynamics, without needing to retrain the victim model.

• Remain robust across different backbone architectures (e.g., DenseNet, SigNet, SigScatNet) by training with relational geometry regularization that generalizes beyond a single network.

• Operate under black-box deployment with a defense that does not require gradient access, using transformation-based checks and relational consistency validation.

• Provide a quantitative robustness score (based on Gap Reduction and Positive Logit Drop) for any contrastive system, enabling security audits before production use.

• Automatically trigger defensive transformations when relational gap degradation is detected, reducing adversarial accuracy from 0.363 back toward clean levels (e.g., >0.8) while preserving legitimate user experience.