Boundary Defense Against Black-box Adversarial Attacks

TL;DR

This paper introduces Boundary Defense, a method that detects boundary samples with low confidence and adds noise to logits, effectively defending neural networks against black-box adversarial attacks with minimal accuracy loss.

Contribution

The paper proposes a novel Boundary Defense approach that exploits the need for boundary samples in black-box attacks and demonstrates its effectiveness through extensive experiments.

Findings

Reduces attack success rate to nearly 0 on IMAGENET models

Maintains classification accuracy degradation around 1%

Outperforms existing defense methods

Abstract

Black-box adversarial attacks generate adversarial samples via iterative optimizations using repeated queries. Defending deep neural networks against such attacks has been challenging. In this paper, we propose an efficient Boundary Defense (BD) method which mitigates black-box attacks by exploiting the fact that the adversarial optimizations often need samples on the classification boundary. Our method detects the boundary samples as those with low classification confidence and adds white Gaussian noise to their logits. The method's impact on the deep network's classification accuracy is analyzed theoretically. Extensive experiments are conducted and the results show that the BD method can reliably defend against both soft and hard label black-box attacks. It outperforms a list of existing defense methods. For IMAGENET models, by adding zero-mean white Gaussian noise with standard deviation 0.1 to logits when the classification confidence is less than 0.3, the defense reduces the attack success rate to almost 0 while limiting the classification accuracy degradation to around 1 percent.