English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Adversarial examples pose a threat to deep neural network models in a varietyof scenarios, from settings where the adversary has complete knowledge of themodel and to the opposite "black box" setting. Black box attacks areparticularly threatening as the adversary only needs access to the input andoutput of the model. Defending against black box adversarial example generationattacks is paramount as currently proposed defenses are not effective. Sincethese types of attacks rely on repeated queries to the model to estimategradients over input dimensions, we investigate the use of randomization tothwart such adversaries from successfully creating adversarial examples.Randomization applied to the output of the deep neural network model has thepotential to confuse potential attackers, however this introduces a tradeoffbetween accuracy and robustness. We show that for certain types ofrandomization, we can bound the probability of introducing errors by carefullysetting distributional parameters. For the particular case of finite differenceblack box attacks, we quantify the error introduced by the defense in thefinite difference estimate of the gradient. Lastly, we show empirically thatthe defense can thwart two adaptive black box adversarial attack algorithms.

Thwarting finite difference adversarial attacks with output randomization