English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Several companies often safeguard their trained deep models (i.e., details ofarchitecture, learnt weights, training details etc.) from third-party users byexposing them only as black boxes through APIs. Moreover, they may not evenprovide access to the training data due to proprietary reasons or sensitivityconcerns. In this work, we propose a novel defense mechanism for black boxmodels against adversarial attacks in a data-free set up. We constructsynthetic data via generative model and train surrogate network using modelstealing techniques. To minimize adversarial contamination on perturbedsamples, we propose 'wavelet noise remover' (WNR) that performs discretewavelet decomposition on input images and carefully select only a few importantcoefficients determined by our 'wavelet coefficient selection module' (WCSM).To recover the high-frequency content of the image after noise removal via WNR,we further train a 'regenerator' network with the objective of retrieving thecoefficients such that the reconstructed image yields similar to originalpredictions on the surrogate model. At test time, WNR combined with trainedregenerator network is prepended to the black box network, resulting in a highboost in adversarial accuracy. Our method improves the adversarial accuracy onCIFAR-10 by 38.98% and 32.01% on state-of-the-art Auto Attack compared tobaseline, even when the attacker uses surrogate architecture (Alexnet-half andAlexnet) similar to the black box architecture (Alexnet) with same modelstealing strategy as defender. The code is available athttps://github.com/vcl-iisc/data-free-black-box-defense

Data-free Defense of Black Box Models Against Adversarial Attacks