Counter-Samples: A Stateless Strategy to Neutralize Black Box Adversarial Attacks

TL;DR

A novel defense mechanism against black-box attacks, where attackers exploit the victim model as an oracle to craft adversarial examples, which proves to be highly effective against state-of-the-art black-box attacks, outperforming existing defenses on both CIFAR-10 and ImageNet datasets.

Abstract

Our paper presents a novel defence against black box attacks, where attackers use the victim model as an oracle to craft their adversarial examples. Unlike traditional preprocessing defences that rely on sanitizing input samples, our stateless strategy counters the attack process itself. For every query we evaluate a counter-sample instead, where the counter-sample is the original sample optimized against the attacker's objective. By countering every black box query with a targeted white box optimization, our strategy effectively introduces an asymmetry to the game to the defender's advantage. This defence not only effectively misleads the attacker's search for an adversarial example, it also preserves the model's accuracy on legitimate inputs and is generic to multiple types of attacks. We demonstrate that our approach is remarkably effective against state-of-the-art black box attacks and outperforms existing defences for both the CIFAR-10 and ImageNet datasets. Additionally, we also show that the proposed defence is robust against strong adversaries as well.

Figures (2)

• Figure 1: An illustration of how the counter-sample defence works. For each attack iteration, (1) the adversary sends one sample $x_t$ to estimate the gradient or direction that will maximizes the loss, (2) the defender applies the preprocessor $T(x_t)=x_{t}^{*}$ which uses gradient descent to distance $x_t$ away from the attacker's objective and (3) the attacker receives response $f(x_{t}^{*})$ and estimates the wrong direction for $x_{t+1}$ as a result.
• Figure 2: The affect of our defence's hyperparameter step-size ($\alpha$) on both clean data and adversarial examples.