Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attacks
This addresses the security challenge of adversarial attacks for machine learning models, offering a generic defence against multiple attack types, though it appears incremental as it builds on existing optimization techniques.
The paper tackles the problem of defending against black box adversarial attacks by introducing a stateless strategy that counters each attacker query with a targeted white box optimization, effectively misleading the search for adversarial examples while preserving model accuracy on legitimate inputs. The approach outperforms existing defences on CIFAR-10 and ImageNet datasets.
Our paper presents a novel defence against black box attacks, where attackers use the victim model as an oracle to craft their adversarial examples. Unlike traditional preprocessing defences that rely on sanitizing input samples, our stateless strategy counters the attack process itself. For every query we evaluate a counter-sample instead, where the counter-sample is the original sample optimized against the attacker's objective. By countering every black box query with a targeted white box optimization, our strategy effectively introduces an asymmetry to the game to the defender's advantage. This defence not only effectively misleads the attacker's search for an adversarial example, it also preserves the model's accuracy on legitimate inputs and is generic to multiple types of attacks. We demonstrate that our approach is remarkably effective against state-of-the-art black box attacks and outperforms existing defences for both the CIFAR-10 and ImageNet datasets. Additionally, we also show that the proposed defence is robust against strong adversaries as well.