Deep Neural Networks can be easily fooled by small and imperceptible perturbations. The query-based black-box attack (QBBA) is able to create the perturbations using model output probabilities of image queries requiring no access to the underlying models. QBBA poses realistic threats to real-world applications. Recently, various types of robustness have been explored to defend against QBBA. In this work, we first taxonomize the stochastic defense strategies against QBBA. Following our taxonomy, we propose to explore non-additive randomness in models to defend against QBBA. Specifically, we focus on underexplored Vision Transformers based on their flexible architectures. Extensive experiments show that the proposed defense approach achieves effective defense, without much sacrifice in performance.

翻译：深度神经网络易被微小且难以察觉的扰动所欺骗。查询型黑盒攻击（QBBA）能够利用图像查询的模型输出概率生成扰动，且无需访问底层模型。此类攻击对实际应用构成了真实威胁。近年来，研究者探索了多种鲁棒性机制以抵御QBBA。本文首先对针对QBBA的随机防御策略进行分类。基于所提出的分类体系，我们提出探索模型中的非加性随机性来防御QBBA。具体而言，我们聚焦于尚未充分研究的Vision Transformer，利用其灵活架构展开研究。大量实验表明，所提出的防御方法在有效抵御攻击的同时，无需大幅牺牲模型性能。