Mitigating Black-Box Adversarial Attacks via Output Noise Perturbation
Not on the map. Why?
Abstract (arXiv)
In black-box adversarial attacks, adversaries query the deep neural network (DNN), use the output to reconstruct gradients, and then optimize the adversarial inputs iteratively. In this paper, we study the method of adding white noise to the DNN output to mitigate such attacks, with a unique focus on the trade-off analysis of noise level and query cost. The attacker's query count (QC) is derived mathematically as a function of noise standard deviation. With this result, the defender can conveniently find the noise level needed to mitigate attacks for the desired security level specified by QC and limited DNN performance loss. Our analysis shows that the added noise is drastically magnified by the small variation of DNN outputs, which makes the reconstructed gradient have an extremely low signal-to-noise ratio (SNR). Adding slight white noise with a standard deviation less than 0.01 is enough to increase QC by many orders of magnitude without introducing any noticeable classification accuracy reduction. Our experiments demonstrate that this method can effectively mitigate both soft-label and hard-label black-box attacks under realistic QC constraints. We also show that this method outperforms many other defense methods and is robust to the attacker's countermeasures.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 33 of its 40 references that are in the map. First posted on arXiv 30 Sep 2021.
Builds on
33 of 40 references.
References · 33
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
21 more
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2019Simple Black-box Adversarial Attackscited by 249
- 2018Certified Adversarial Robustness with Additive Noisecited by 178
- 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
- 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
- 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
- 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
- 2017SafetyNet: Detecting and Rejecting Adversarial Examples Robustlycited by 76
- 2016Simple Black-Box Adversarial Perturbations for Deep Networkscited by 42
- 2018On the Robustness of the CVPR 2018 White-Box Adversarial Example Defensescited by 40
- 2018Defending Against Machine Learning Model Stealing Attacks Using Deceptive Perturbationscited by 11
- 2019Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defensescited by 8
- 2017Learning Universal Adversarial Perturbations with Generative Modelscited by 4
Built on by
Citing papers per year: 2022: 2; 2023: 0; 2024: 1.
3 papers.