PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attacks
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866912450786361344 |
|---|---|
| author | Guo, Ping Li, Xiang Yang, Zhiyuan Lin, Xi Zhao, Qingchuan Zhang, Qingfu |
| author_facet | Guo, Ping Li, Xiang Yang, Zhiyuan Lin, Xi Zhao, Qingchuan Zhang, Qingfu |
| contents | Black-box query-based attacks constitute significant threats to Machine Learning as a Service (MLaaS) systems since they can generate adversarial examples without accessing the target model's architecture and parameters. Traditional defense mechanisms, such as adversarial training, gradient masking, and input transformations, either impose substantial computational costs or compromise the test accuracy of non-adversarial inputs. To address these challenges, we propose an efficient defense mechanism, PuriDefense, that employs random patch-wise purifications with an ensemble of lightweight purification models at a low level of inference cost. These models leverage the local implicit function and rebuild the natural image manifold. Our theoretical analysis suggests that this approach slows down the convergence of query-based attacks by incorporating randomness into purifications. Extensive experiments on CIFAR-10 and ImageNet validate the effectiveness of our proposed purifier-based defense mechanism, demonstrating significant improvements in robustness against query-based attacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2401_10586 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attacks Guo, Ping Li, Xiang Yang, Zhiyuan Lin, Xi Zhao, Qingchuan Zhang, Qingfu Cryptography and Security Artificial Intelligence Computer Vision and Pattern Recognition Machine Learning Black-box query-based attacks constitute significant threats to Machine Learning as a Service (MLaaS) systems since they can generate adversarial examples without accessing the target model's architecture and parameters. Traditional defense mechanisms, such as adversarial training, gradient masking, and input transformations, either impose substantial computational costs or compromise the test accuracy of non-adversarial inputs. To address these challenges, we propose an efficient defense mechanism, PuriDefense, that employs random patch-wise purifications with an ensemble of lightweight purification models at a low level of inference cost. These models leverage the local implicit function and rebuild the natural image manifold. Our theoretical analysis suggests that this approach slows down the convergence of query-based attacks by incorporating randomness into purifications. Extensive experiments on CIFAR-10 and ImageNet validate the effectiveness of our proposed purifier-based defense mechanism, demonstrating significant improvements in robustness against query-based attacks. |
| title | PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attacks |
| topic | Cryptography and Security Artificial Intelligence Computer Vision and Pattern Recognition Machine Learning |
| url | https://arxiv.org/abs/2401.10586 |