mlsanityData to 14 Oct 2026

Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks

arXiv 2205.12134 ↗First posted 24 May 2022cs.LG cs.CRcited by 19

Not on the map. Why?

Abstract (arXiv)

The score-based query attacks (SQAs) pose practical threats to deep neural networks by crafting adversarial perturbations within dozens of queries, only using the model's output scores. Nonetheless, we note that if the loss trend of the outputs is slightly perturbed, SQAs could be easily misled and thereby become much less effective. Following this idea, we propose a novel defense, namely Adversarial Attack on Attackers (AAA), to confound SQAs towards incorrect attack directions by slightly modifying the output logits. In this way, (1) SQAs are prevented regardless of the model's worst-case robustness; (2) the original model predictions are hardly changed, i.e., no degradation on clean accuracy; (3) the calibration of confidence scores can be improved simultaneously. Extensive experiments are provided to verify the above advantages. For example, by setting ℓ_∞=8/255 on CIFAR-10, our proposed AAA helps WideResNet-28 secure 80.59% accuracy under Square attack (2500 queries), while the best prior defense (i.e., adversarial training) only attains 67.44%. Since AAA attacks SQA's general greedy strategy, such advantages of AAA over 8 defenses can be consistently observed on 8 CIFAR-10/ImageNet models under 6 SQAs, using different attack targets, bounds, norms, losses, and strategies. Moreover, AAA calibrates better without hurting the accuracy. Our code is available at https://github.com/Sizhe-Chen/AAA.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Builds on 55 of its 83 references that are in the map. First posted on arXiv 24 May 2022.

Builds on

55 of 83 references.

References · 55

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  7. 2013Intriguing properties of neural networkscited by 5,155
  8. 2017On Calibration of Modern Neural Networkscited by 4,960
  9. 2016Wide Residual Networkscited by 3,070
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  11. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,546
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  4. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  5. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  9. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  10. 2017Countering Adversarial Images using Input Transformationscited by 520
  11. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  12. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  13. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  14. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  15. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  16. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  17. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
  18. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  19. 2019On Mixup Training: Improved Calibration and Predictive Uncertainty for Deep Neural Networkscited by 305
  20. 2019Simple Black-box Adversarial Attackscited by 251
  21. 2021Improving Robustness using Generated Datacited by 234
  22. 2021Data Augmentation Can Improve Robustnesscited by 194
  23. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 159
  24. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  25. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  26. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 125
  27. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  28. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  29. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  30. 2018Deflecting Adversarial Attacks with Pixel Deflectioncited by 71
  31. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  32. 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
  33. 2021Subspace Adversarial Trainingcited by 41
  34. 2021TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothnesscited by 38
  35. 2019Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attackscited by 35
  36. 2021Drawing Robust Scratch Tickets: Subnetworks with Inborn Robustness Are Found within Randomly Initialized Networkscited by 29
  37. 2020Improving Calibration through the Relationship with Adversarial Robustnesscited by 26
  38. 2021Automated Discovery of Adaptive Attacks on Adversarial Defensescited by 22

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 10; 2024: 5; 2025: 1; 2026: 3.

19 papers.

Sort:

  1. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  2. 2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
  3. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  4. 2023Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attackscited by 11
  5. 2024Calibration Attacks: A Comprehensive Study of Adversarial Attacks on Model Confidencecited by 7
  6. 2024PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attackscited by 6
  7. 2023Investigating Catastrophic Overfitting in Fast Adversarial Training: A Self-fitting Perspectivecited by 5
  8. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  9. 2023Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attackscited by 4
  10. 2024Natural Language Induced Adversarial Imagescited by 4
  11. 2023Towards Deep Learning Models Resistant to Transfer-based Adversarial Attacks via Data-centric Robust Learningcited by 2
  12. 2024RobustBlack: Challenging Black-Box Adversarial Attacks on State-of-the-Art Defensescited by 2
7 more
  1. 2023Post-train Black-box Defense via Bayesian Boundary Correctioncited by 1
  2. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  3. 2026Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attackscited by 1
  4. 2023Adaptive Attractors: A Defense Strategy against ML Adversarial Collusion Attackscited by 0
  5. 2023SEA: Shareable and Explainable Attribution for Query-based Black-box Attackscited by 0
  6. 2026Dashed Line Defense: Plug-And-Play Defense Against Adaptive Score-Based Query Attackscited by 0
  7. 2026Mitigating Black-Box Score-Based Query Attacks via Gradient Confusioncited by 0