The wide application of deep neural networks (DNNs) demands an increasing amount of attention to their real-world robustness, i.e., whether a DNN resists black-box adversarial attacks, among which score-based query attacks (SQAs) are most threatening since they can effectively hurt a victim network with the only access to model outputs. Defending against SQAs requires a slight but artful variation of outputs due to the service purpose for users, who share the same output information with SQAs. In this paper, we propose a real-world defense by Unifying Gradients (UniG) of different data so that SQAs could only probe a much weaker attack direction that is similar for different samples. Since such universal attack perturbations have been validated as less aggressive than the input-specific perturbations, UniG protects real-world DNNs by indicating attackers a twisted and less informative attack direction. We implement UniG efficiently by a Hadamard product module which is plug-and-play. According to extensive experiments on 5 SQAs, 2 adaptive attacks and 7 defense baselines, UniG significantly improves real-world robustness without hurting clean accuracy on CIFAR10 and ImageNet. For instance, UniG maintains a model of 77.80% accuracy under 2500-query Square attack while the state-of-the-art adversarially-trained model only has 67.34% on CIFAR10. Simultaneously, UniG outperforms all compared baselines in terms of clean accuracy and achieves the smallest modification of the model output. The code is released at https://github.com/snowien/UniG-pytorch.

翻译：深度神经网络的广泛应用要求对其实际鲁棒性给予越来越多的关注，即深度神经网络是否能抵抗黑盒对抗攻击，其中基于分数的查询攻击（SQAs）最具威胁性，因为它们仅通过访问模型输出就能有效攻击受害者网络。防御SQAs需要在不影响用户服务的前提下对输出进行巧妙但细微的调整，因为用户与SQAs共享相同的输出信息。本文提出一种通过统一梯度（UniG）实现实际防御的方法，使SQAs只能探测到不同样本间相似的、更弱的攻击方向。由于此类通用攻击扰动已被验证比基于特定输入的扰动更不具攻击性，UniG通过向攻击者指示扭曲且信息量较少的攻击方向来保护实际深度神经网络。我们通过可即插即用的Hadamard积模块高效实现UniG。在5种SQA、2种自适应攻击和7种防御基线上进行的广泛实验表明，UniG在不影响CIFAR10和ImageNet上干净准确率的前提下显著提升了实际鲁棒性。例如，在CIFAR10上，UniG在2500次查询Square攻击下保持77.80%的模型准确率，而最先进的对抗训练模型仅为67.34%。同时，UniG在干净准确率上优于所有对比基线，并实现了对模型输出最小的修改。代码已发布于https://github.com/snowien/UniG-pytorch。