Beyond Decision Boundaries: Relational Geometry Attacks on Contrastive Embedding Manifolds

2026-08-10

AI Summary

This work addresses a critical limitation in existing adversarial attacks, which predominantly target classification boundaries while overlooking the geometric fragility of relational structures within embedding manifolds in contrastive learning. To bridge this gap, the authors propose a geometry-aware adversarial attack framework that shifts the objective from perturbing individual predictions to disrupting manifold-level relational geometry. By leveraging offline-learned priors of geometric deformations in the embedding space, the method trains a lightweight feedforward generator capable of producing effective perturbations in a single forward pass—eliminating the need for online gradient computation. Evaluated on the Markmatch system, the attack reduces verification accuracy from 95.4% to 38.6% and fundamentally inverts the similarity structure among samples, thereby severely degrading multi-class verification performance.

Abstract

Contrastive learning and Siamese embedding models have become the foundation of modern verification systems, where decisions are governed not by discrete classification boundaries, but by relational geometry in embedding space. However, existing adversarial attacks remain fundamentally classification-centric, overlooking the vulnerability of relational geometry. In this paper, we introduce a geometry-aware adversarial attack framework that reformulates attacks on contrastive systems as manifold-level relational corruption. Instead of targeting individual predictions, the proposed framework systematically distorts similarity organization within the embedding manifold by pushing positive pairs apart while simultaneously pulling negative pairs closer, ultimately collapsing and inverting pairwise similarity structure. To enable scalable deployment, we shift iterative online optimization into an offline adversarial geometry deformation prior learning stage and train a lightweight feed-forward generator that learns generalized geometry deformation patterns from the victim model. Once trained, the generator produces adversarial perturbations through a single forward pass without requiring online gradient computation, enabling real-time online attacks against similarity-based verification systems. Experimental results across multiple verification architectures demonstrate substantial degradation of verification performance together with severe manifold-level relational corruption. On the Markmatch verification system, the proposed attack reduces accuracy from 95.4% to 38.6% while completely reversing the positive-negative similarity structure.

Problem

• contrastive learning
• relational geometry
• adversarial attacks
• embedding manifold
• similarity-based verification

Innovation

• relational geometry attack
• contrastive embedding manifold
• adversarial geometry deformation
• feed-forward perturbation generator
• similarity structure inversion