Random Noise Defense Against Query-Based Black-Box Attacks

Abstract

The query-based black-box attacks have raised serious threats to machine learning models in many real applications. In this work, we study a lightweight defense method, dubbed Random Noise Defense (RND), which adds proper Gaussian noise to each query. We conduct the theoretical analysis about the effectiveness of RND against query-based black-box attacks and the corresponding adaptive attacks. Our theoretical results reveal that the defense performance of RND is determined by the magnitude ratio between the noise induced by RND and the noise added by the attackers for gradient estimation or local search. The large magnitude ratio leads to the stronger defense performance of RND, and it's also critical for mitigating adaptive attacks. Based on our analysis, we further propose to combine RND with a plausible Gaussian augmentation Fine-tuning (RND-GF). It enables RND to add larger noise to each query while maintaining the clean accuracy to obtain a better trade-off between clean accuracy and defense performance. Additionally, RND can be flexibly combined with the existing defense methods to further boost the adversarial robustness, such as adversarial training (AT). Extensive experiments on CIFAR-10 and ImageNet verify our theoretical findings and the effectiveness of RND and RND-GF.

arXiv commentNeurIPS 2021 poster paper

References in corpus (14)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Wide Residual Networks
• ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Simple Black-box Adversarial Attacks
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization
• Generalization Error of Invariant Classifiers
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution

Cited by in corpus (2)

• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks