{"id":"https://openalex.org/W3183075005","doi":"https://doi.org/10.48550/arxiv.2107.03806","title":"Output Randomization: A Novel Defense for both White-box and Black-box Adversarial Models","display_name":"Output Randomization: A Novel Defense for both White-box and Black-box Adversarial Models","publication_year":2021,"publication_date":"2021-07-08","ids":{"openalex":"https://openalex.org/W3183075005","doi":"https://doi.org/10.48550/arxiv.2107.03806","mag":"3183075005"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2107.03806","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2107.03806","pdf_url":"https://arxiv.org/pdf/2107.03806","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2107.03806","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100613715","display_name":"Daniel Park","orcid":"https://orcid.org/0000-0002-1919-0460","observed_orcids":["https://orcid.org/0000-0002-1919-0460"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Park, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083382561","display_name":"Haidar Khan","orcid":"https://orcid.org/0000-0003-1617-3208","observed_orcids":["https://orcid.org/0000-0003-1617-3208"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khan, Haidar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038560946","display_name":"Azer Khan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khan, Azer","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038646656","display_name":"Alex Gittens","orcid":"https://orcid.org/0000-0003-3482-0157","observed_orcids":["https://orcid.org/0000-0003-3482-0157"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gittens, Alex","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5073676361","display_name":"B\u00fclent Yener","orcid":"https://orcid.org/0000-0003-3989-6097","observed_orcids":["https://orcid.org/0000-0003-3989-6097"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yener, B\u00fclent","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-defense","display_name":"adversarial defense","score":0.828000009059906},{"id":"https://openalex.org/keywords/adversarial-examples","display_name":"adversarial examples","score":0.9599999785423279},{"id":"https://openalex.org/keywords/white-box-attacks","display_name":"white-box attacks","score":0.8209999799728394},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":1.0},{"id":"https://openalex.org/keywords/derivative-free-optimization","display_name":"derivative-free optimization","score":0.6620000004768372},{"id":"https://openalex.org/keywords/projected-gradient-descent","display_name":"projected gradient descent","score":0.9340000152587891},{"id":"https://openalex.org/keywords/deep-neural-network","display_name":"deep neural network","score":0.7009999752044678}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7394681572914124},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.6948416233062744},{"id":"https://openalex.org/C204243189","wikidata":"https://www.wikidata.org/wiki/Q1363085","display_name":"Randomization","level":3,"score":0.6893431544303894},{"id":"https://openalex.org/C180932941","wikidata":"https://www.wikidata.org/wiki/Q997233","display_name":"White box","level":2,"score":0.6462934017181396},{"id":"https://openalex.org/C56273599","wikidata":"https://www.wikidata.org/wiki/Q3122841","display_name":"White (mutation)","level":3,"score":0.5964427590370178},{"id":"https://openalex.org/C170295934","wikidata":"https://www.wikidata.org/wiki/Q4952019","display_name":"Box\u2013Behnken design","level":3,"score":0.5486271977424622},{"id":"https://openalex.org/C2992995325","wikidata":"https://www.wikidata.org/wiki/Q4951592","display_name":"Box model","level":2,"score":0.4660557210445404},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4233437180519104},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2568715214729309},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.15972748398780823},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.11730951070785522},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.09359946846961975},{"id":"https://openalex.org/C168563851","wikidata":"https://www.wikidata.org/wiki/Q1436668","display_name":"Randomized controlled trial","level":2,"score":0.08944132924079895},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C141071460","wikidata":"https://www.wikidata.org/wiki/Q40821","display_name":"Surgery","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C153294291","wikidata":"https://www.wikidata.org/wiki/Q25261","display_name":"Meteorology","level":1,"score":0.0},{"id":"https://openalex.org/C150077022","wikidata":"https://www.wikidata.org/wiki/Q3136137","display_name":"Response surface methodology","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2107.03806","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2107.03806","pdf_url":"https://arxiv.org/pdf/2107.03806","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2107.03806","doi":"https://doi.org/10.48550/arxiv.2107.03806","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2107.03806","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2107.03806","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2107.03806","pdf_url":"https://arxiv.org/pdf/2107.03806","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2108598243","https://openalex.org/W2174868984","https://openalex.org/W2432142698","https://openalex.org/W2460937040","https://openalex.org/W2543927648","https://openalex.org/W2561498661","https://openalex.org/W2767962654","https://openalex.org/W2783113218","https://openalex.org/W2788684909","https://openalex.org/W2795725650","https://openalex.org/W2883285025","https://openalex.org/W2913848079","https://openalex.org/W2963207607","https://openalex.org/W2964153729","https://openalex.org/W2964253222"],"related_works":["https://openalex.org/W2945893265","https://openalex.org/W4387323670","https://openalex.org/W3012438436","https://openalex.org/W4297672470","https://openalex.org/W2767962654","https://openalex.org/W3018322762","https://openalex.org/W3210286538","https://openalex.org/W2921173985","https://openalex.org/W4387587264","https://openalex.org/W2972523835"],"abstract_inverted_index":{"Adversarial":[0],"examples":[1],"pose":[2],"a":[3,11,27,36,51,130,149],"threat":[4],"to":[5,32,79,97,100,109,140,181,200,235],"deep":[6],"neural":[7],"network":[8],"models":[9,63],"in":[10,26,35,55,84],"variety":[12],"of":[13,23,47,91,107,129],"scenarios,":[14],"from":[15,113],"settings":[16],"where":[17],"the":[18,24,33,45,57,69,98,105,126,135,172,217,225,229],"adversary":[19,133],"has":[20,191],"complete":[21],"knowledge":[22],"model":[25,99,209],"\"white":[28],"box\"":[29,38],"setting":[30],"and":[31,60,64,194,222],"opposite":[34],"\"black":[37],"setting.":[39],"In":[40,68],"this":[41,89,122,189],"paper,":[42],"we":[43,72,103,143],"explore":[44],"use":[46,106,159,167],"output":[48,74,145,213],"randomization":[49,75,108,146,186,214],"as":[50,148],"defense":[52,123,150,162,190,226],"against":[53,151,184,216],"attacks":[54,83],"both":[56],"black":[58,85,131],"box":[59,62,86,132,153],"white":[61,152],"propose":[65,73,144],"two":[66],"defenses.":[67,187],"first":[70],"defense,":[71],"at":[76,168],"test":[77,169],"time":[78],"thwart":[80,110],"finite":[81],"difference":[82],"settings.":[87],"Since":[88],"type":[90],"attack":[92,139],"relies":[93],"on":[94],"repeated":[95],"queries":[96],"estimate":[101],"gradients,":[102],"investigate":[104],"such":[111],"adversaries":[112],"successfully":[114],"creating":[115],"adversarial":[116],"examples.":[117],"We":[118,211],"empirically":[119],"show":[120,223],"that":[121,158,224],"can":[124,227],"limit":[125],"success":[127,232],"rate":[128,233],"using":[134,238],"Zeroth":[136],"Order":[137],"Optimization":[138],"0%.":[141],"Secondly,":[142],"training":[147,215],"adversaries.":[154],"Unlike":[155],"prior":[156],"approaches":[157],"randomization,":[160],"our":[161],"does":[163],"not":[164],"require":[165],"its":[166],"time,":[170],"eliminating":[171],"Backward":[173],"Pass":[174],"Differentiable":[175],"Approximation":[176],"attack,":[177],"which":[178],"was":[179],"shown":[180],"be":[182,201],"effective":[183],"other":[185,205],"Additionally,":[188],"low":[192],"overhead":[193],"is":[195],"easily":[196],"implemented,":[197],"allowing":[198],"it":[199],"used":[202],"together":[203],"with":[204],"defenses":[206],"across":[207],"various":[208],"architectures.":[210],"evaluate":[212],"Projected":[218],"Gradient":[219],"Descent":[220],"attacker":[221],"reduce":[228],"PGD":[230],"attack's":[231],"down":[234],"12%":[236],"when":[237],"cross-entropy":[239],"loss.":[240]},"counts_by_year":[{"year":2023,"cited_by_count":1}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2021-07-19T00:00:00"}