Mitigating Black-Box Adversarial Attacks via Output Noise Perturbation

TL;DR

This paper proposes adding carefully calibrated white noise to DNN outputs to significantly increase the query cost for black-box adversarial attacks, effectively reducing attack success while maintaining model accuracy.

Contribution

The study introduces a novel noise-based defense mechanism that quantifies the trade-off between noise level and query cost, outperforming existing defenses against black-box attacks.

Findings

Adding noise with std less than 0.01 greatly increases query cost

The method effectively mitigates soft-label and hard-label attacks

It outperforms other defense strategies and resists countermeasures

Abstract

In black-box adversarial attacks, adversaries query the deep neural network (DNN), use the output to reconstruct gradients, and then optimize the adversarial inputs iteratively. In this paper, we study the method of adding white noise to the DNN output to mitigate such attacks, with a unique focus on the trade-off analysis of noise level and query cost. The attacker's query count (QC) is derived mathematically as a function of noise standard deviation. With this result, the defender can conveniently find the noise level needed to mitigate attacks for the desired security level specified by QC and limited DNN performance loss. Our analysis shows that the added noise is drastically magnified by the small variation of DNN outputs, which makes the reconstructed gradient have an extremely low signal-to-noise ratio (SNR). Adding slight white noise with a standard deviation less than 0.01 is enough to increase QC by many orders of magnitude without introducing any noticeable classification accuracy reduction. Our experiments demonstrate that this method can effectively mitigate both soft-label and hard-label black-box attacks under realistic QC constraints. We also show that this method outperforms many other defense methods and is robust to the attacker's countermeasures.