Random transformations to improve mitigation of query-based black-box attacks
Year: 2024
Type: article
Abstract: Random noise defense (RND), which adds gaussian noise to input data during inference time, has been claimed to effectively defend image classification models against the best query-based black-box attacks. In fact, the RND method is currently arguably the best defense against black-box attacks. Even so, there is a need to improve upon RND, as it has only achieved limited robustness of 53.5% and 18.1% with a ResNet-50 model on CIFAR-10 and ImageNet datasets respectively, against the so-called square attack – the state-of-the-art black-box attack. Therefore, in this work, we propose two alternatives to gaussian noise addition at inference time, namely, random crop-resize and random rotation of the input images. Typically these transformations are used for data augmentation while training to improve model invariance and generalisation. For the first time, we show that for such well-trained models either of the two transformations can also blunt powerful query-based black-box attacks when used at inference time on three popular datasets.The results show that the proposed randomised transformations outperform previously proposed defenses in terms of robust accuracy against a strong adversary that uses a high budget of 100,000 queries based on expectation over transformation (EOT) of 10, Crucially, against high-confidence adversarial examples, these transformations are even more effective as the margin of improvement over the benchmarks increases further.
Source: Expert Systems with Applications
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Estimated APC paid: $3,320
OpenAlex ID: W4404645870