{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-attack-on-attackers-post-process","title":"Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks","arxiv_id":"2205.12134","date":"2022-05-24","proceeding":null,"authors":["Sizhe Chen","Zhehao Huang","Qinghua Tao","Yingwen Wu","Cihang Xie","Xiaolin Huang"],"abstract":"The score-based query attacks (SQAs) pose practical threats to deep neural networks by crafting adversarial perturbations within dozens of queries, only using the model's output scores. Nonetheless, we note that if the loss trend of the outputs is slightly perturbed, SQAs could be easily misled and thereby become much less effective. Following this idea, we propose a novel defense, namely Adversarial Attack on Attackers (AAA), to confound SQAs towards incorrect attack directions by slightly modifying the output logits. In this way, (1) SQAs are prevented regardless of the model's worst-case robustness; (2) the original model predictions are hardly changed, i.e., no degradation on clean accuracy; (3) the calibration of confidence scores can be improved simultaneously. Extensive experiments are provided to verify the above advantages. For example, by setting $\\ell_\\infty=8/255$ on CIFAR-10, our proposed AAA helps WideResNet-28 secure 80.59% accuracy under Square attack (2500 queries), while the best prior defense (i.e., adversarial training) only attains 67.44%. Since AAA attacks SQA's general greedy strategy, such advantages of AAA over 8 defenses can be consistently observed on 8 CIFAR-10/ImageNet models under 6 SQAs, using different attack targets, bounds, norms, losses, and strategies. Moreover, AAA calibrates better without hurting the accuracy. Our code is available at https://github.com/Sizhe-Chen/AAA.","url_abs":"https://arxiv.org/abs/2205.12134v3","url_pdf":"https://arxiv.org/pdf/2205.12134v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-attack-on-attackers-post-process","repo_url":"https://github.com/sizhe-chen/aaa","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2205.12134","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2205.12134"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/Sizhe-Chen/AAA","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sizhe-chen/aaa","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":1,"ran":1,"ran_honours":1,"ran_violates":1,"unverified":5},"by_repo_kind":{"official":{"samples":9,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"785d346b27b67e09","entry":"softmax","repo":"sizhe-chen/aaa","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":2,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"785d346b27b67e09"}},{"code_sha256_prefix":"5b9f23733537643e","entry":"PGDGenerator2","repo":"sizhe-chen/aaa","repo_kind":"official","path":"attacker.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/attacker.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5b9f23733537643e"}},{"code_sha256_prefix":"d01a60cd25dd6599","entry":"p_selection","repo":"sizhe-chen/aaa","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d01a60cd25dd6599"}},{"code_sha256_prefix":"5be54351ad1e34da","entry":"random_classes_except_current","repo":"sizhe-chen/aaa","repo_kind":"official","path":"utils.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5be54351ad1e34da"}},{"code_sha256_prefix":"be11f64c59a474ba","entry":"NASSurrogate","repo":"sizhe-chen/aaa","repo_kind":"official","path":"attacker.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"be11f64c59a474ba"}},{"code_sha256_prefix":"cc64397ce9932968","entry":"PGDGeneratorInfty","repo":"sizhe-chen/aaa","repo_kind":"official","path":"attacker.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc64397ce9932968"}},{"code_sha256_prefix":"31557cefffffb529","entry":"QueryNet","repo":"sizhe-chen/aaa","repo_kind":"official","path":"attacker.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/attacker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"31557cefffffb529"}},{"code_sha256_prefix":"4fc8682d4d57cb91","entry":"load_model","repo":"sizhe-chen/aaa","repo_kind":"official","path":"square.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/square.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4fc8682d4d57cb91"}},{"code_sha256_prefix":"98a406e7a10b0a97","entry":"plot_curve","repo":"sizhe-chen/aaa","repo_kind":"official","path":"square.py","file_url":"https://github.com/sizhe-chen/aaa/blob/HEAD/square.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"98a406e7a10b0a97"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}