Privacy-preserving Universal Adversarial Defense for Black-box Models

TL;DR

This paper tackles robust defense for black-box models under adversarial perturbations by introducing DUCD, a distillation-based universal defense that builds a white-box surrogate through query access and applies an optimized randomized smoothing scheme to achieve norm-universal certified robustness. It combines a surrogate-training objective that matches the target's logits with a two-stage radius optimization and a tunable noise PDF, yielding larger certified radii across $\ell_1$, $\ell_2$, and $\ell_{\infty}$ norms while preserving data privacy. Empirical results across MNIST, SVHN, CIFAR-10 and distribution-shift variants show DUCD often surpasses existing black-box defenses in certified accuracy and robustness scores and remains competitive with white-box defenses, albeit with remaining challenges for $\ell_{\infty}$ attacks. The work demonstrates practical privacy benefits by reducing membership inference risk and indicates a viable path toward universal, privacy-preserving defenses in black-box settings with broad applicability.

Abstract

Deep neural networks (DNNs) are increasingly used in critical applications such as identity authentication and autonomous driving, where robustness against adversarial attacks is crucial. These attacks can exploit minor perturbations to cause significant prediction errors, making it essential to enhance the resilience of DNNs. Traditional defense methods often rely on access to detailed model information, which raises privacy concerns, as model owners may be reluctant to share such data. In contrast, existing black-box defense methods fail to offer a universal defense against various types of adversarial attacks. To address these challenges, we introduce DUCD, a universal black-box defense method that does not require access to the target model's parameters or architecture. Our approach involves distilling the target model by querying it with data, creating a white-box surrogate while preserving data privacy. We further enhance this surrogate model using a certified defense based on randomized smoothing and optimized noise selection, enabling robust defense against a broad range of adversarial attacks. Comparative evaluations between the certified defenses of the surrogate and target models demonstrate the effectiveness of our approach. Experiments on multiple image classification datasets show that DUCD not only outperforms existing black-box defenses but also matches the accuracy of white-box defenses, all while enhancing data privacy and reducing the success rate of membership inference attacks.

Figures (9)

• Figure 1: Illustration of knowledge distillation in DUCD.
• Figure 2: Robust radius derivation.
• Figure 3: Accuracies of surrogate models under different query budgets.
• Figure 4: $p_A$-$R$ curves for different noise distributions.
• Figure 5: $p_A$-$R$ curve comparisons between DUCD and RS cohen2019certified.