🤖 machine learning

Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attacks

This paper introduces Random Logit Scaling (RLS), a plug-and-play post-processing defense that effectively counters black-box score-based adversarial attacks by randomly scaling logits to confuse attackers while preserving model accuracy, and simultaneously exposes the vulnerability of the state-of-the-art AAA defense to adaptive attacks.

Original authors: Hamid Dashtbani, Mehdi Dousti Gandomani, AmirMahdi Sadeghzadeh

Published 2026-07-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hamid Dashtbani, Mehdi Dousti Gandomani, AmirMahdi Sadeghzadeh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of artificial intelligence as a giant, super-smart library where computers learn to recognize things—like spotting a cat in a photo or identifying a song. For a long time, these computers were like shy students who only answered questions if you showed them the textbook (the internal code). But in the real world, we often just ask them questions and get answers without seeing how they think. This is called a "black box."

The trouble starts when a mischievous hacker tries to trick the computer. They don't need to break into the library; they just need to whisper a tiny, almost invisible change into a picture—like adding a few specks of dust to a photo of a panda. To our eyes, it still looks like a panda, but the computer suddenly screams, "That's a toaster!" This is called an "adversarial attack." It's a huge problem because if we can't trust these smart systems to see the world correctly, we can't use them for important jobs like self-driving cars or medical diagnosis. Hackers have found clever ways to do this even when they can't see the computer's brain, just by asking it questions over and over again and watching how it changes its mind.

Now, enter the heroes of this story: a team of researchers who decided to fight back with a trick of their own. They call their new defense "Random Logit Scaling" (RLS). Think of the computer's brain as a chef who tastes a soup and decides if it's "very salty" or "slightly salty." Usually, the chef gives a precise number, like "8 out of 10." But the hacker uses that number to figure out exactly how to tweak the recipe to make the soup taste like something else.

The researchers' idea is simple but brilliant: what if the chef lies? Every time the hacker asks, "How salty is this?", the chef randomly decides to multiply the answer by a secret number. Sometimes the chef says "16 out of 10" (making it seem super salty), and other times "0.8 out of 10" (making it seem barely salty). The chef still knows the soup is salty, so they still serve the right dish (the correct answer), but the numbers they shout out are completely scrambled.

This is where the magic happens. The hacker, who is trying to solve a math puzzle to trick the computer, suddenly finds that the clues they are getting are all over the place. One second the numbers go up, the next they go down, and the pattern is so chaotic that the hacker gets completely confused. It's like trying to find a hidden treasure when the map keeps changing the location of the X every time you look at it. The researchers tested this against some of the smartest, most aggressive hackers in the world. They found that this simple trick made the hackers' success rate drop dramatically—sometimes by as much as 80%—without making the computer any slower or less accurate at its actual job.

However, the paper also warns us that not all defenses are perfect. They looked at another popular defense called "AAA," which tries to reshape the numbers in a specific, predictable way to confuse hackers. The researchers showed that if a hacker knows about this trick, they can adapt and break through it, kind of like a lockpicker who learns the specific pattern of a new lock. But the Random Logit Scaling defense is different because it uses pure randomness, making it much harder to predict or break.

In short, the paper suggests that by adding a layer of random noise to the computer's confidence scores, we can create a "fog of war" for attackers. The computer stays sharp and accurate, but the hacker is left stumbling in the dark, unable to find the path to trick it. It's a lightweight, easy-to-use shield that doesn't require rebuilding the whole computer, just a simple tweak to how it speaks its answers. While it does change the numbers the computer shouts out (which might matter for some very specific tasks), it keeps the final decision correct and makes it incredibly difficult for hackers to cause trouble.

Technical Summary: Random Logit Scaling (RLS)

Problem Statement

Deep neural networks (DNNs) are increasingly deployed in critical domains such as image classification, face recognition, and malware detection. However, these models remain vulnerable to adversarial example attacks, where inputs are perturbed with imperceptible noise to cause misclassification. While early research focused on white-box scenarios, recent advancements have produced powerful black-box score-based attacks. In these scenarios, adversaries lack access to model parameters but can query the model to obtain confidence scores (probability vectors). Notable attacks, such as the Square attack, can generate successful adversarial examples with only dozens of queries, posing a significant threat to the reliable deployment of ML models.

Existing defenses face a critical trade-off. Adversarial Training (AT) improves robustness but often degrades accuracy on benign samples and incurs high computational costs. Ensemble methods increase robustness but raise storage and deployment overhead. Randomization-based defenses (e.g., adding noise to inputs or logits) offer a lighter alternative but frequently suffer from reduced model accuracy and significant distortion of confidence scores, which can be detrimental in applications relying on calibrated probabilities. Furthermore, deterministic defenses like Adversarial Attack on Attackers (AAA) have been shown to be vulnerable to adaptive attacks.

Methodology

1. Random Logit Scaling (RLS)

The primary contribution of this work is Random Logit Scaling (RLS), a plug-and-play, post-processing defense designed specifically for black-box score-based attacks.

Mechanism: RLS operates by scaling the model's output logits ( $z$ ) by a random coefficient ( $m$ ) sampled from a continuous uniform distribution $U(a, b)$ , where $a, b > 0$ . The scaled logits are defined as $z' = m \times z$ .
Core Intuition: The defense aims to confuse the attacker by outputting falsified confidence scores while preserving the ranking of the classes. Since the scaling factor $m$ is positive, the relative order of the logits remains unchanged, ensuring the predicted label (top-1 class) stays the same. However, the absolute values of the logits and the gaps between classes fluctuate randomly with every query.
Impact on Attacks:
- Gradient Estimation: Attacks relying on zeroth-order optimization (e.g., NES, ZOO) attempt to estimate gradients based on score differences. RLS introduces noise into these score differences, leading to falsified gradient estimates.
- Random Search: Attacks like the Square attack use search-based methods to find directions that reduce the loss. RLS causes the objective function values to fluctuate unpredictably (e.g., a query with a small $m$ might output a deceptively low score), misleading the attacker into selecting suboptimal directions or skipping valid ones.
Deployment: RLS requires no retraining of the underlying model. It is a lightweight, zero-effort addition that can be implemented on top of any existing ML model.

2. The Pendulum Attack

To demonstrate the vulnerability of existing non-randomized defenses, the authors introduce a novel adaptive attack called the Pendulum attack, targeting AAA-sine (a state-of-the-art defense that reshapes the loss function into a sine-like curve).

Mechanism: Standard attacks get trapped in local minima created by the sine-shaped loss function. The Pendulum attack overcomes this by iteratively switching directions. If the attacker fails to reduce the loss for $k$ consecutive iterations, it flips to the opposite direction (increasing the loss). If it fails to increase the loss for another $k$ iterations, it flips back. This oscillation allows the attacker to escape local minima and maxima generated by the defense.
Result: This adaptive strategy successfully bypasses AAA-sine, increasing the attack success rate by over 35% compared to standard attacks.

Key Contributions

Proposal of RLS: A lightweight, zero-effort defense that significantly reduces the success rate of state-of-the-art black-box score-based attacks while preserving model accuracy.
Analysis of Logit Scaling: The paper provides a theoretical and empirical analysis showing how random logit scaling corrupts the objective functions used by both gradient-based and search-based attackers without altering the predicted class.
Adaptive Attack (Pendulum): The introduction of the Pendulum attack demonstrates the vulnerability of deterministic defenses like AAA to adaptive strategies, highlighting the advantage of randomized defenses like RLS.
Comprehensive Evaluation: Extensive experiments on CIFAR-10 and ImageNet datasets using six SOTA attacks (NES, Bandit, Square, SignHunter, ZO-signSGD, and BruSLe) across $\ell_\infty$ , $\ell_2$ , and $\ell_0$ norm spaces.

Experimental Results

The authors evaluated RLS against four baselines: Random Noise Defense (iRND), Randomized Feature Defense (RFD), Boundary Defense (oRND), and AAA.

Robustness: RLS significantly outperforms baselines in resisting attacks. For instance, on the CIFAR-10 dataset using ResNet-18, RLS reduced the success rate of the Square attack from 100% (no defense) to 59.85% (with range 0.5–10) and further to 43.05% (with range 0.5–1000). Against the Bandit attack, RLS reduced success rates to as low as 1.56%.
Accuracy Preservation: Unlike iRND, RFD, and oRND, which cause accuracy drops ranging from 0.32% to 3.95%, RLS maintains 0% accuracy drop across all tested models and configurations because it preserves the class ranking.
Confidence Score Distortion: While RLS does distort confidence scores, it generally causes less distortion (measured by L2 norm of probability vector differences) than iRND and RFD. However, the paper notes that RLS increases the Expected Calibration Error (ECE) more than RFD and AAA, though less than iRND.
Query Efficiency: RLS forces attackers to use significantly more queries to succeed. For example, against the Square attack on ResNet-18, the average number of queries required for a successful attack increased from ~115 (no defense) to ~735 (RLS 0.5–10).

Significance and Claims

The paper claims that RLS offers a unique solution to the robustness-performance trade-off. By decoupling the defense from the training process and utilizing randomization that preserves class ranking, RLS allows for the deployment of test-time defenses without:

Sacrificing model accuracy on benign samples.
Incurring the computational overhead of adversarial training or ensemble methods.
Requiring complex architectural changes.

The authors position RLS as particularly suitable for applications where maintaining top-1 prediction accuracy is paramount. They acknowledge a trade-off: while RLS improves robustness, the distortion of confidence scores may require additional calibration techniques for applications heavily dependent on precise probability estimates (e.g., medical diagnosis or out-of-distribution detection). The work concludes that randomized defenses like RLS provide a more resilient barrier against adaptive attackers compared to deterministic methods like AAA.