Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds

Modern verification systems, such as biometric or signature authentication, often rely on contrastive learning rather than discrete classification boundaries. These systems operate by projecting inputs into an embedding space where decisions are based on the relational geometry—how similar or dissimilar two items are. The authors investigate whether these systems are vulnerable to adversarial attacks that target this relational structure rather than traditional classification boundaries.

The researchers propose a 'Relational Geometry Attack' framework. Unlike traditional attacks that use iterative, sample-specific gradient optimization (like PGD) to flip a single label, this method uses a lightweight, U-Net-based generator. This generator is trained offline to learn generalized deformation patterns that can be applied to any input pair. Once trained, the generator produces adversarial perturbations in a single forward pass, allowing for real-time, low-latency attacks. The objective is to systematically 'push' positive pairs apart and 'pull' negative pairs together, effectively inverting the similarity logic of the embedding manifold.

The proposed attack framework successfully degrades verification performance across multiple architectures. For example, in the Markmatch ballot verification system, the attack reduced accuracy from 95.4% to 38.6%. Crucially, the authors demonstrate that the attack does not just cause isolated errors; it fundamentally collapses and inverts the positive-negative similarity structure of the entire embedding space. This confirms that contrastive systems have a unique vulnerability profile compared to traditional classification models, where the security of the system is tied to the integrity of the manifold's geometry.

As contrastive learning becomes the standard for verification and retrieval, this study highlights that protecting decision boundaries is insufficient. Future security efforts must focus on the robustness of the underlying relational geometry. The ability to perform these attacks in real-time using a pre-trained generator poses a significant threat to high-throughput verification environments.