面向黑盒模型的隐私保护通用对抗防御
Privacy-preserving Universal Adversarial Defense for Black-box Models
AI总结：
针对黑盒模型缺乏通用防御且传统方法泄露隐私的问题，提出DUCD方法，通过查询蒸馏构建白盒替代模型，并结合随机平滑认证防御，实现通用鲁棒防御，性能优于现有黑盒防御且媲美白盒防御，同时增强隐私。
摘要：
深度神经网络（DNNs）越来越多地用于身份认证和自动驾驶等关键应用，在这些应用中，对对抗攻击的鲁棒性至关重要。对抗攻击可利用微小的扰动导致显著的预测错误，因此增强DNN的韧性十分必要。传统的防御方法通常依赖于对详细模型信息的访问，这引发了隐私担忧，因为模型所有者可能不愿共享此类数据。相比之下，现有的黑盒防御方法无法针对各种类型的对抗攻击提供通用防御。为解决这些挑战，我们提出了DUCD，一种无需访问目标模型参数或架构的通用黑盒防御方法。我们的方法通过用数据查询目标模型来对其进行蒸馏，创建一个白盒替代模型，同时保护数据隐私。我们进一步利用基于随机平滑和优化噪声选择的认证防御来增强该替代模型，从而能够对广泛的对抗攻击进行鲁棒防御。替代模型与目标模型的认证防御之间的比较评估证明了我们方法的有效性。在多个图像分类数据集上的实验表明，DUCD不仅优于现有的黑盒防御方法，而且达到了与白盒防御相当的准确率，同时增强了数据隐私并降低了成员推断攻击的成功率。
英文摘要：
Deep neural networks (DNNs) are increasingly used in critical applications such as identity authentication and autonomous driving, where robustness against adversarial attacks is crucial. These attacks can exploit minor perturbations to cause significant prediction errors, making it essential to enhance the resilience of DNNs. Traditional defense methods often rely on access to detailed model information, which raises privacy concerns, as model owners may be reluctant to share such data. In contrast, existing black-box defense methods fail to offer a universal defense against various types of adversarial attacks. To address these challenges, we introduce DUCD, a universal black-box defense method that does not require access to the target model's parameters or architecture. Our approach involves distilling the target model by querying it with data, creating a white-box surrogate while preserving data privacy. We further enhance this surrogate model using a certified defense based on randomized smoothing and optimized noise selection, enabling robust defense against a broad range of adversarial attacks. Comparative evaluations between the certified defenses of the surrogate and target models demonstrate the effectiveness of our approach. Experiments on multiple image classification datasets show that DUCD not only outperforms existing black-box defenses but also matches the accuracy of white-box defenses, all while enhancing data privacy and reducing the success rate of membership inference attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
