缩小差距：在针对基于查询的攻击时实现更好的准确率-鲁棒性权衡
Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
AI总结：
本文提出仅在低置信度输入上激活随机噪声和随机图像变换等防御，以在测试阶段无训练地实现针对基于查询攻击的更好准确率-鲁棒性权衡。
摘要：
尽管现有针对基于查询的攻击的防御方法前景可观，但它们存在一个共同局限：以在干净样本上显著下降的准确率为代价来换取对攻击的更强鲁棒性。本文展示了在测试阶段缓解基于查询的攻击时，如何高效地在鲁棒性与准确率之间建立稳固的权衡。鉴于此类攻击必然探索低置信度区域，我们的核心见解是：仅对低置信度输入激活专用防御（如随机噪声防御和随机图像变换）就足以阻止这些攻击。我们的方法独立于训练过程，并有理论支撑。我们通过在CIFAR-10、CIFAR-100和ImageNet上进行大量实验，验证了该方法对多种现有防御的有效性。结果表明，与最先进的方法相比，我们的方案确实能够增强这些防御，在完全无需训练的情况下提供更好的准确率-鲁棒性权衡。
英文摘要：
Although promising, existing defenses against query-based attacks share a common limitation: they offer increased robustness against attacks at the price of a considerable accuracy drop on clean samples. In this work, we show how to efficiently establish, at test-time, a solid tradeoff between robustness and accuracy when mitigating query-based attacks. Given that these attacks necessarily explore low-confidence regions, our insight is that activating dedicated defenses, such as random noise defense and random image transformations, only for low-confidence inputs is sufficient to prevent them. Our approach is independent of training and supported by theory. We verify the effectiveness of our approach for various existing defenses by conducting extensive experiments on CIFAR-10, CIFAR-100, and ImageNet. Our results confirm that our proposal can indeed enhance these defenses by providing better tradeoffs between robustness and accuracy when compared to state-of-the-art approaches while being completely training-free.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
