Post-train Black-box Defense via Bayesian Boundary Correction

TL;DR

This paper introduces Bayesian Boundary Correction (BBC), a post-train black-box defense method that enhances the robustness of pre-trained classifiers against adversarial attacks without re-training.

Contribution

The paper presents a novel Bayesian framework for black-box adversarial defense that does not require re-training or model specifics, applicable to various data types.

Findings

BBC improves robustness against adversarial attacks.

BBC maintains high accuracy on clean data.

The framework is adaptable to different data modalities.

Abstract

Classifiers based on deep neural networks are susceptible to adversarial attack, where the widely existing vulnerability has invoked the research in defending them from potential threats. Given a vulnerable classifier, existing defense methods are mostly white-box and often require re-training the victim under modified loss functions/training regimes. While the model/data/training specifics of the victim are usually unavailable to the user, re-training is unappealing, if not impossible for reasons such as limited computational resources. To this end, we propose a new post-train black-box defense framework. It can turn any pre-trained classifier into a resilient one with little knowledge of the model specifics. This is achieved by new joint Bayesian treatments on the clean data, the adversarial examples and the classifier, for maximizing their joint probability. It is further equipped with a new post-train strategy which keeps the victim intact, avoiding re-training. We name our framework Bayesian Boundary Correction (BBC). BBC is a general and flexible framework that can easily adapt to different data types. We instantiate BBC for image classification and skeleton-based human activity recognition, for both static and dynamic data. Exhaustive evaluation shows that BBC has superior robustness and can enhance robustness without severely hurting the clean accuracy, compared with existing defense methods.