Post-train Black-box Defense via Bayesian Boundary Correction
Not on the map. Why?
Abstract (arXiv)
Classifiers based on deep neural networks are susceptible to adversarial attack, where the widely existing vulnerability has invoked the research in defending them from potential threats. Given a vulnerable classifier, existing defense methods are mostly white-box and often require re-training the victim under modified loss functions/training regimes. While the model/data/training specifics of the victim are usually unavailable to the user, re-training is unappealing, if not impossible for reasons such as limited computational resources. To this end, we propose a new post-train black-box defense framework. It can turn any pre-trained classifier into a resilient one with little knowledge of the model specifics. This is achieved by new joint Bayesian treatments on the clean data, the adversarial examples and the classifier, for maximizing their joint probability. It is further equipped with a new post-train strategy which keeps the victim intact, avoiding re-training. We name our framework Bayesian Boundary Correction (BBC). BBC is a general and flexible framework that can easily adapt to different data types. We instantiate BBC for image classification and skeleton-based human activity recognition, for both static and dynamic data. Exhaustive evaluation shows that BBC has superior robustness and can enhance robustness without severely hurting the clean accuracy, compared with existing defense methods.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 48 of its 65 references that are in the map. First posted on arXiv 29 Jun 2023.
Builds on
48 of 65 references.
References · 48
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2016Wide Residual Networkscited by 3,057
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2018Spatial Temporal Graph Convolutional Networks for Skeleton-Based Action Recognitioncited by 1,199
- 2016NTU RGB+D: A Large Scale Dataset for 3D Human Activity Analysiscited by 683
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
36 more
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2019NTU RGB+D 120: A Large-Scale Benchmark for 3D Human Activity Understandingcited by 530
- 2016Stein Variational Gradient Descent: A General Purpose Bayesian Inference Algorithmcited by 498
- 2022Diffusion Models for Adversarial Purificationcited by 469
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
- 2014Stochastic Gradient Hamiltonian Monte Carlocited by 341
- 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
- 2021Channel-wise Topology Refinement Graph Convolution for Skeleton-Based Action Recognitioncited by 317
- 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
- 2018Disentangling Adversarial Robustness and Generalizationcited by 171
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
- 2019Semantics-Guided Neural Networks for Efficient Skeleton-Based Human Action Recognitioncited by 135
- 2019On the Anatomy of MCMC-Based Maximum Likelihood Learning of Energy-Based Modelscited by 105
- 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
- 2020Learnable Boundary Guided Adversarial Trainingcited by 93
- 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 68
- 2020Robustness of Bayesian Neural Networks to Gradient-Based Attackscited by 48
- 2019Adversarial Attacks on Time Seriescited by 40
- 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
- 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 35
- 2019Adversarial Attack on Skeleton-based Human Action Recognitioncited by 32
- 2022LOT: Layer-wise Orthogonal Training on Improving ℓ2 Certified Robustnesscited by 32
- 2017Bayesian GANcited by 31
- 2023Randomized Adversarial Training via Taylor Expansioncited by 28
- 2021BASAR:Black-box Attack on Skeletal Action Recognitioncited by 25
- 2021Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attackcited by 23
- 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
- 2020Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognitioncited by 12
- 2022On the Robustness of Bayesian Neural Networks to Adversarial Attackscited by 12
- 2021Adversarial Bone Length Attack on Action Recognitioncited by 10
- 2022Defending Black-box Skeleton-based Human Activity Classifierscited by 8
- 2022Understanding the Vulnerability of Skeleton-based Human Activity Recognition via Black-box Attackcited by 7
- 2022Bayesian Learning with Information Gain Provably Bounds Risk for a Robust Adversarial Defensecited by 4
Built on by
Citing papers per year: 2024: 1.
1 paper.