mlsanityData to 7 Oct 2026

Random Noise Defense Against Query-Based Black-Box Attacks

arXiv 2104.11470 ↗First posted 23 Apr 2021cs.LG cs.CRcited by 46

Not on the map. Why?

Abstract (arXiv)

The query-based black-box attacks have raised serious threats to machine learning models in many real applications. In this work, we study a lightweight defense method, dubbed Random Noise Defense (RND), which adds proper Gaussian noise to each query. We conduct the theoretical analysis about the effectiveness of RND against query-based black-box attacks and the corresponding adaptive attacks. Our theoretical results reveal that the defense performance of RND is determined by the magnitude ratio between the noise induced by RND and the noise added by the attackers for gradient estimation or local search. The large magnitude ratio leads to the stronger defense performance of RND, and it's also critical for mitigating adaptive attacks. Based on our analysis, we further propose to combine RND with a plausible Gaussian augmentation Fine-tuning (RND-GF). It enables RND to add larger noise to each query while maintaining the clean accuracy to obtain a better trade-off between clean accuracy and defense performance. Additionally, RND can be flexibly combined with the existing defense methods to further boost the adversarial robustness, such as adversarial training (AT). Extensive experiments on CIFAR-10 and ImageNet verify our theoretical findings and the effectiveness of RND and RND-GF.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). Builds on 36 of its 53 references that are in the map. First posted on arXiv 23 Apr 2021.

Builds on

36 of 53 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
24 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  2. 2015Cyclical Learning Rates for Training Neural Networkscited by 627
  3. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  4. 2020Overfitting in adversarially robust deep learningcited by 504
  5. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  6. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  7. 2019On Evaluating Adversarial Robustnesscited by 442
  8. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  9. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  10. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  11. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  12. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  13. 2019Simple Black-box Adversarial Attackscited by 249
  14. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  15. 2013Optimal rates for zero-order convex optimization: the power of two function evaluationscited by 190
  16. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
  17. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  18. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
  19. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
  20. 2020DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensemblescited by 73
  21. 2019Stateful Detection of Black-Box Adversarial Attackscited by 55
  22. 2019Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimizationcited by 49
  23. 2016Generalization Error of Invariant Classifierscited by 42
  24. 2020AdvMind: Inferring Adversary Intent of Black-Box Attackscited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 13; 2023: 15; 2024: 8; 2025: 4; 2026: 5.

46 papers.

Sort:

By area:

  1. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  2. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  3. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
  4. 2022Stability Analysis and Generalization Bounds of Adversarial Trainingcited by 30
  5. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  6. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  7. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  8. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  9. 2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
  10. 2022D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensemblescited by 11
  11. 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attentioncited by 10
  12. 2023PubDef: Defending Against Transfer Attacks From Public Modelscited by 7
34 more
  1. 2024GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative modelcited by 7
  2. 2024BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attackcited by 7
  3. 2025Improving LLM Unlearning Robustness via Random Perturbationscited by 6
  4. 2022Robust Prototypical Few-Shot Organ Segmentation with Regularized Neural-ODEscited by 5
  5. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
  6. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  7. 2024PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attackscited by 5
  8. 2022Audit and Improve Robustness of Private Neural Networks on Encrypted Datacited by 4
  9. 2023The Adaptive Arms Race: Redefining Robustness in AI Securitycited by 4
  10. 2021Query Attack by Multi-Identity Surrogatescited by 3
  11. 2023Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networkscited by 3
  12. 2023Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attackscited by 3
  13. 2023Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learningcited by 2
  14. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
  15. 2022Unifying Gradients to Improve Real-world Robustness for Deep Networkscited by 1
  16. 2022A Theoretical Study of The Effects of Adversarial Attacks on Sparse Regressioncited by 1
  17. 2022Guidance Through Surrogate: Towards a Generic Diagnostic Attackcited by 1
  18. 2023Rapid Plug-in Defenderscited by 1
  19. 2023Exploring Non-additive Randomness on ViT against Query-Based Black-Box Attackscited by 1
  20. 2024Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attackscited by 1
  21. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  22. 2022A Novel Plug-and-Play Approach for Adversarially Robust Generalizationcited by 0
  23. 2023Phase-shifted Adversarial Trainingcited by 0
  24. 2023SEA: Shareable and Explainable Attribution for Query-based Black-box Attackscited by 0
  25. 2024A Curious Case of Remarkable Resilience to Gradient Attacks via Fully Convolutional and Differentiable Front End with a Skip Connectioncited by 0
  26. 2024Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attackscited by 0
  27. 2024PEAS: A Strategy for Crafting Transferable Adversarial Examplescited by 0
  28. 2025Quantitative Analysis of Deeply Quantized Tiny Neural Networks Robust to Adversarial Attackscited by 0
  29. 2025A Perplexity and Menger Curvature-Based Approach for Similarity Evaluation of Large Language Modelscited by 0
  30. 2026Low-Cost Hard-Label Adversarial Attack with Theoretical Foundationscited by 0
  31. 2026LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Modelscited by 0
  32. 2026Dashed Line Defense: Plug-And-Play Defense Against Adaptive Score-Based Query Attackscited by 0
  33. 2026RobPI: Robust Private Inference against Malicious Clientcited by 0
  34. 2026Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attackscited by 0