{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/understanding-the-robustness-of-randomized","title":"Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks","arxiv_id":"2310.00567","date":"2023-10-01","proceeding":null,"authors":["Quang H. Nguyen","Yingjie Lao","Tung Pham","Kok-Seng Wong","Khoa D. Doan"],"abstract":"Recent works have shown that deep neural networks are vulnerable to adversarial examples that find samples close to the original image but can make the model misclassify. Even with access only to the model's output, an attacker can employ black-box attacks to generate such adversarial examples. In this work, we propose a simple and lightweight defense against black-box attacks by adding random noise to hidden features at intermediate layers of the model at inference time. Our theoretical analysis confirms that this method effectively enhances the model's resilience against both score-based and decision-based black-box attacks. Importantly, our defense does not necessitate adversarial training and has minimal impact on accuracy, rendering it applicable to any pre-trained model. Our analysis also reveals the significance of selectively adding noise to different parts of the model based on the gradient of the adversarial objective function, which can be varied during the attack. We demonstrate the robustness of our defense against multiple black-box attacks through extensive empirical experiments involving diverse models with various architectures.","url_abs":"https://arxiv.org/abs/2310.00567v1","url_pdf":"https://arxiv.org/pdf/2310.00567v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"understanding-the-robustness-of-randomized","repo_url":"https://github.com/mail-research/randomized_defenses","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"GPL-3.0"}}],"tasks":[{"task_slug":"image-classification","task_name":"Image Classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/image-classification-on-imagenet-1","task":"Image Classification","dataset":"delete","model":"","rank_in_archive_order":1,"of":1,"metrics":{"Top 1 Accuracy":"36.2"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2310.00567","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.00567"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/mail-research/randomized_defenses","reach":{"status":"ok","spdx":"GPL-3.0"}}],"summary":{"ran":14,"ran_honours":1,"unverified":5},"by_repo_kind":{"official":{"samples":20,"ran":15,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":20,"samples":[{"code_sha256_prefix":"f80e7f6342bb06ff","entry":"add_defense","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"f80e7f6342bb06ff"}},{"code_sha256_prefix":"de9aaff4c2936743","entry":"create_aa","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/resnet.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"de9aaff4c2936743"}},{"code_sha256_prefix":"d903e362d00e661c","entry":"defense_token","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"d903e362d00e661c"}},{"code_sha256_prefix":"176dfa1e026fb136","entry":"dense_to_onehot","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"176dfa1e026fb136"}},{"code_sha256_prefix":"eea0376ea397a1c7","entry":"downsample_conv","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"eea0376ea397a1c7"}},{"code_sha256_prefix":"3cb33b36db4150ca","entry":"get_idx","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"attack/nes.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/attack/nes.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"3cb33b36db4150ca"}},{"code_sha256_prefix":"59a538c2bf7701e7","entry":"get_margin","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"attack/nes.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/attack/nes.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"59a538c2bf7701e7"}},{"code_sha256_prefix":"9b02c1068795fd5b","entry":"get_padding","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"9b02c1068795fd5b"}},{"code_sha256_prefix":"0c48a3a1bc51d3e9","entry":"random_classes_except_current","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"0c48a3a1bc51d3e9"}},{"code_sha256_prefix":"e3593b2830ad0418","entry":"tojpeg","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/wrapper.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/wrapper.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"e3593b2830ad0418"}},{"code_sha256_prefix":"6acddfe42148f8f2","entry":"tv","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/tvm.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/tvm.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"6acddfe42148f8f2"}},{"code_sha256_prefix":"13910d402badb827","entry":"tv_dx","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/tvm.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/tvm.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"13910d402badb827"}},{"code_sha256_prefix":"cd56898dd1531f85","entry":"vanilla_resnet20","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"cd56898dd1531f85"}},{"code_sha256_prefix":"cab91481ef35184c","entry":"vanilla_resnet32","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"cab91481ef35184c"}},{"code_sha256_prefix":"2acb1379b48508e4","entry":"vanilla_resnet44","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"2acb1379b48508e4"}},{"code_sha256_prefix":"4e82d32ad5df0e01","entry":"checkpoint_seq","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/robust_vit.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/robust_vit.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"4e82d32ad5df0e01"}},{"code_sha256_prefix":"4f4087e87730c76c","entry":"create_robust_model","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"4f4087e87730c76c"}},{"code_sha256_prefix":"45164c859a619736","entry":"noise_resnet20","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/noise_resnet.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/noise_resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"45164c859a619736"}},{"code_sha256_prefix":"8bf374c9e1999142","entry":"softmax","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"utils.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"8bf374c9e1999142"}},{"code_sha256_prefix":"9c87fc8acd9c2789","entry":"tv_l2","repo":"mail-research/randomized_defenses","repo_kind":"official","path":"models/tvm.py","file_url":"https://github.com/mail-research/randomized_defenses/blob/HEAD/models/tvm.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"9c87fc8acd9c2789"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}