Privacy-preserving Universal Adversarial Defense for Black-box Models

TL;DR

This paper presents DUCD, a universal black-box defense for deep neural networks that enhances robustness against adversarial attacks without requiring access to model details, while also preserving data privacy.

Contribution

Introduces DUCD, a novel black-box defense method that distills models and applies certified defenses, improving robustness and privacy in adversarial settings.

Findings

Outperforms existing black-box defenses in robustness.

Matches white-box defense accuracy on multiple datasets.

Reduces success rate of membership inference attacks.

Abstract

Deep neural networks (DNNs) are increasingly used in critical applications such as identity authentication and autonomous driving, where robustness against adversarial attacks is crucial. These attacks can exploit minor perturbations to cause significant prediction errors, making it essential to enhance the resilience of DNNs. Traditional defense methods often rely on access to detailed model information, which raises privacy concerns, as model owners may be reluctant to share such data. In contrast, existing black-box defense methods fail to offer a universal defense against various types of adversarial attacks. To address these challenges, we introduce DUCD, a universal black-box defense method that does not require access to the target model's parameters or architecture. Our approach involves distilling the target model by querying it with data, creating a white-box surrogate while preserving data privacy. We further enhance this surrogate model using a certified defense based on randomized smoothing and optimized noise selection, enabling robust defense against a broad range of adversarial attacks. Comparative evaluations between the certified defenses of the surrogate and target models demonstrate the effectiveness of our approach. Experiments on multiple image classification datasets show that DUCD not only outperforms existing black-box defenses but also matches the accuracy of white-box defenses, all while enhancing data privacy and reducing the success rate of membership inference attacks.