Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attacks

Deep neural networks are vulnerable to black-box adversarial attacks, where attackers generate malicious inputs by querying the model and observing its output scores. While existing defenses like adversarial training or ensemble methods improve robustness, they often suffer from high computational costs or significant drops in model accuracy. This paper investigates whether a lightweight, post-processing method can effectively defend against these attacks without sacrificing performance.

The authors propose Random Logit Scaling (RLS), a defense mechanism that modifies the model's output logits by applying a random scaling factor. By scaling the logits, the model produces falsified confidence scores that mislead the attacker's optimization process—which relies on these scores to estimate gradients or search for adversarial perturbations—without altering the final predicted class label. The authors also introduce the Pendulum attack, an adaptive strategy designed to bypass existing non-randomized defenses like AAA (Adversarial Attack on Attackers) by iteratively switching search directions to escape local minima.

RLS significantly reduces the success rate of state-of-the-art black-box score-based attacks, such as the Square attack, by up to 80% on datasets like CIFAR-10 and ImageNet. Unlike other randomization-based defenses, RLS maintains high model accuracy and minimizes distortion to confidence scores. Furthermore, the authors demonstrate that the non-randomized AAA defense is vulnerable to their newly proposed Pendulum attack, highlighting the superior resilience of randomization-based strategies like RLS against adaptive adversaries.