[论文解读] Small Input Noise is Enough to Defend Against Query-based Black-box Attacks

Junyoung Byun, Hyojun Go+1 more|arXiv (Cornell University)|May 4, 2021

Adversarial Robustness in Machine Learning参考文献 21被引用 7

一句话总结

该论文提出了一种名为小噪声防御（Small Noise Defense, SND）的简单而有效的防御方法，通过在推理阶段添加极小的输入噪声来干扰基于查询的黑盒攻击。通过打破模型输出与查询输入完全匹配的假设，SND严重阻碍了攻击中的梯度估计和局部搜索，从而在CIFAR-10和ImageNet上实现了强大的鲁棒性，同时保持了接近零的准确率下降和极低的计算开销。

ABSTRACT

While deep neural networks show unprecedented performance in various tasks, the vulnerability to adversarial examples hinders their deployment in safety-critical systems. Many studies have shown that attacks are also possible even in a black-box setting where an adversary cannot access the target model's internal information. Most black-box attacks are based on queries, each of which obtains the target model's output for an input, and many recent studies focus on reducing the number of required queries. In this paper, we pay attention to an implicit assumption of these attacks that the target model's output exactly corresponds to the query input. If some randomness is introduced into the model to break this assumption, query-based attacks may have tremendous difficulty in both gradient estimation and local search, which are the core of their attack process. From this motivation, we observe even a small additive input noise can neutralize most query-based attacks and name this simple yet effective approach Small Noise Defense (SND). We analyze how SND can defend against query-based black-box attacks and demonstrate its effectiveness against eight different state-of-the-art attacks with CIFAR-10 and ImageNet datasets. Even with strong defense ability, SND almost maintains the original clean accuracy and computational speed. SND is readily applicable to pre-trained models by adding only one line of code at the inference stage, so we hope that it will be used as a baseline of defense against query-based black-box attacks in the future.

研究动机与目标

• 解决深度神经网络在安全关键应用中对基于查询的黑盒对抗攻击的脆弱性问题。
• 挑战基于查询攻击中隐含的假设，即模型输出精确反映输入查询。
• 开发一种轻量级、实用的防御方法，以保持高原始准确率和高效的推理速度。
• 在标准基准上展示该防御对多种最先进的基于查询攻击的鲁棒性。

提出的方法

• 提出小噪声防御（SND），在推理过程中向输入添加小幅度的随机加性噪声。
• 利用模型响应中的固有随机性，打破输入查询与输出之间的确定性对应关系。
• 通过使相似输入下的模型输出变得不可预测，从而干扰攻击中的梯度估计。
• 通过引入噪声来模糊对抗样本周围的真实损失曲面，从而干扰攻击中的局部搜索。
• 仅在推理阶段应用噪声，仅需一行代码即可集成到预训练模型中。
• 通过使用极小的噪声量，避免改变模型的主要行为，从而保持高原始准确率和计算速度。

实验结果

研究问题

• RQ1 少量输入噪声是否能有效干扰基于查询的黑盒攻击的核心机制？
• RQ2 在模型响应中引入随机性如何影响黑盒攻击中梯度估计和局部搜索的可行性？
• RQ3 SND在防御多种基于查询的攻击时，能在多大程度上保持原始准确率和推理速度？
• RQ4 SND能否作为预训练模型的实用、开箱即用的防御基线？

主要发现

• SND在CIFAR-10和ImageNet数据集上均有效中和了八种最先进的基于查询的黑盒攻击。
• 该防御方法保持了与原始模型几乎完全相同的原始准确率，性能下降可忽略不计。
• SND未引入显著的计算开销，完全保持了原始的推理速度。
• 该防御通过破坏大多数基于查询攻击所依赖的确定性输入-输出映射假设而起效。
• SND极具实用性，仅需一行代码即可部署到任何预训练模型上。
• 该防御对多种攻击策略均表现出强鲁棒性，包括依赖梯度估计和局部搜索的攻击。