mlsanityData to 14 Oct 2026

PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attacks

arXiv 2401.10586 ↗First posted 19 Jan 2024cs.CR cs.AI cs.CVcited by 6

Not on the map. Why?

Abstract (arXiv)

Black-box query-based attacks constitute significant threats to Machine Learning as a Service (MLaaS) systems since they can generate adversarial examples without accessing the target model's architecture and parameters. Traditional defense mechanisms, such as adversarial training, gradient masking, and input transformations, either impose substantial computational costs or compromise the test accuracy of non-adversarial inputs. To address these challenges, we propose an efficient defense mechanism, PuriDefense, that employs random patch-wise purifications with an ensemble of lightweight purification models at a low level of inference cost. These models leverage the local implicit function and rebuild the natural image manifold. Our theoretical analysis suggests that this approach slows down the convergence of query-based attacks by incorporating randomness into purifications. Extensive experiments on CIFAR-10 and ImageNet validate the effectiveness of our proposed purifier-based defense mechanism, demonstrating significant improvements in robustness against query-based attacks.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Builds on 39 of its 53 references that are in the map. First posted on arXiv 19 Jan 2024.

Builds on

39 of 53 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Wide Residual Networkscited by 3,070
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  7. 2016Adversarial examples in the physical worldcited by 1,769
  8. 2017Enhanced Deep Residual Networks for Single Image Super-Resolutioncited by 1,552
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  10. 2018Image Super-Resolution Using Very Deep Residual Channel Attention Networkscited by 1,264
  11. 2016Adversarial Machine Learning at Scalecited by 936
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
27 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  2. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  3. 2020Learning Continuous Image Representation with Local Implicit Image Functioncited by 552
  4. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  5. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  6. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  7. 2022Diffusion Models for Adversarial Purificationcited by 476
  8. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  9. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  10. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
  11. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
  12. 2019Simple Black-box Adversarial Attackscited by 251
  13. 2018Adversarial Robustness Toolbox v1.0.0cited by 215
  14. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  15. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 159
  16. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 152
  17. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  18. 2021Adversarial purification with Score-based generative modelscited by 134
  19. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  20. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 120
  21. 2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
  22. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 47
  23. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  24. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 19
  25. 2022Demystifying the Adversarial Robustness of Random Transformation Defensescited by 14
  26. 2016On the Effectiveness of Defensive Distillationcited by 6
  27. 2022Boundary Defense Against Black-box Adversarial Attackscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 4; 2025: 1; 2026: 1.

6 papers.

  1. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 125
  2. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 68
  3. 2024L-AutoDA: Leveraging Large Language Models for Automated Decision-based Adversarial Attackscited by 8
  4. 2024Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolumecited by 3
  5. 2025PRISM: Robust VLM Alignment with Principled Reasoning for Integrated Safety in Multimodalitycited by 2
  6. 2026Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detectioncited by 0