随机对数缩放：防御深度神经网络对抗基于黑盒分数的对抗样本攻击
Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attacks
浏览论文内容
中文总结 AI 辅助
研究针对基于黑盒分数的对抗样本攻击的防御与攻击方法，提出随机对数缩放（RLS）防御可降低攻击成功率，还引入新型自适应攻击，证明一种非随机化黑盒防御易受攻击。
中文摘要 AI 辅助
机器学习模型在各领域应用日益广泛，对抗样本对其可靠部署构成重大威胁。近年来出现了强大的对抗样本攻击方法。本文有两项贡献：一是提出随机对数缩放（RLS），这是一种针对基于黑盒分数的对抗样本攻击的基于随机化的防御方法，是即插即用的后处理防御，能在不影响模型准确性的同时混淆攻击者，显著降低攻击成功率；二是引入针对一种非随机化黑盒防御的新型自适应攻击，证明其易受自适应攻击。
英文摘要
Machine learning models are increasingly adapted in various domains. However, adversarial examples pose a significant threat to the reliable deployment of these models. In recent years, some powerful adversarial example attacks have been proposed for the fast and query-efficient generation of adversarial examples, even in black-box scenarios, highlighting the need for scalable, low-cost, and powerful defenses. In this work, we present two contributions to the domain of black-box adversarial example attacks and defenses. First, we propose Random Logit Scaling (RLS), a randomization-based defense against black-box score-based adversarial example attacks. RLS is a plug-and-play, post-processing defense that can be implemented on top of any existing ML model with minimal effort. The idea behind RLS is to confuse an attacker by outputting falsified scores resulting from randomly scaled logits while maintaining the model accuracy. We show that RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving the accuracy and minimizing confidence score distortion compared to state-of-the-art randomization-based defenses. Second, we introduce a novel adaptive attack against AAA, a SOTA non-randomized black-box defense against black-box score-based attacks that also modifies output logits to confuse attackers, demonstrating its vulnerability against adaptive attacks.
发表机构
- Sharif University of Technology（伊朗谢里夫理工大学）
机构由 AI 辅助整理，请以论文原文为准。
