Privacy Preserving Defense For Black Box Classifiers Against On-Line Adversarial Attacks

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep learning models are susceptible to adversarial attacks, where subtle image alterations cause misclassification.
• Current defense methods rely on classification accuracy, which is insufficient for validating adversarial-free images, especially in online applications without ground truth.

Purpose of the Study:

• To propose a novel privacy-preserving framework to defend black-box classifiers against adversarial attacks.
• To introduce an iterative defense mechanism using an ensemble of image purifiers validated by Bayesian uncertainties.
• To develop privacy-preserving Knowledge Distillation (KD) approaches for mimicking black-box classifier performance.

Main Methods:

• An ensemble of iterative adversarial image purifiers is employed.
• Bayesian uncertainties are used for continuous performance validation in a closed loop.
• Three novel privacy-preserving Knowledge Distillation (KD) methods leverage prior meta-information.

Main Results:

• The proposed framework effectively converts single-step defenses into iterative ones.
• Experimental results on six benchmark datasets demonstrate consistent detection and purification/rejection of adversarial examples.
• The existence of an optimal distribution for purified images, reaching a theoretical purification lower bound, is proven.

Conclusions:

• The developed framework offers a robust defense against adversarial attacks for black-box classifiers.
• The approach provides a reliable method for validating and purifying images in real-world applications.
• The study advances the field of adversarial robustness in deep learning with privacy-preserving techniques.