Boundary Defense Against Black-box Adversarial Attacks
This addresses a critical security issue for machine learning systems vulnerable to adversarial attacks, offering an efficient defense with minimal performance loss.
The paper tackles the problem of defending deep neural networks against black-box adversarial attacks by proposing a Boundary Defense method that adds noise to low-confidence boundary samples, reducing attack success rates to nearly 0% while limiting accuracy degradation to about 1% on IMAGENET models.
Black-box adversarial attacks generate adversarial samples via iterative optimizations using repeated queries. Defending deep neural networks against such attacks has been challenging. In this paper, we propose an efficient Boundary Defense (BD) method which mitigates black-box attacks by exploiting the fact that the adversarial optimizations often need samples on the classification boundary. Our method detects the boundary samples as those with low classification confidence and adds white Gaussian noise to their logits. The method's impact on the deep network's classification accuracy is analyzed theoretically. Extensive experiments are conducted and the results show that the BD method can reliably defend against both soft and hard label black-box attacks. It outperforms a list of existing defense methods. For IMAGENET models, by adding zero-mean white Gaussian noise with standard deviation 0.1 to logits when the classification confidence is less than 0.3, the defense reduces the attack success rate to almost 0 while limiting the classification accuracy degradation to around 1 percent.