Difference between Forward and Backward Information can Defend Score-Based Query Attack
 

Abstract: The score-based query attacks (SQAs) pose practical threats to real-world deep neural networks by crafting adversarial perturbations within dozens of queries, only using the model’s output scores. To deal with SQAs, we are facing two seemingly contradictive targets: changing the output for defending attackers and keeping the output for serving users. We find the difference between forward and backward information is the key point we can make use of. Following this idea, we propose novel defenses to confound SQAs towards incorrect attack directions, by imposing Adversarial Attack on Attackers (AAA), or to hide the correct attack directions, by Unifying Gradients (UniG) of a batch. Numerical experiments support our effectiveness on defending SQAs for several CIFAR-10/ImageNet models, compared to the SOTA defenses. Besides, we will also introduce some results from robust learning for classical kernel methods, which differs from adversarial robustness for deep learning but may have inspiration for both sides.