Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attacks

Image generated by AI

TLDR

• What: Random Logit Scaling (RLS) is a lightweight, zero-accuracy-loss, post-processing defense that dynamically multiplies logits by a random scaling factor $m \sim \mathcal{U}(a, b)$ on every query to falsify the confidence score landscape and disrupt score-based adversarial attacks.
• Who's at risk: Machine learning classification APIs (e.g., commercial face verification APIs, content moderation nodes in RAG pipelines, or visual search endpoints) that return full soft-label confidence scores (probability vectors) to users.
• Key number: RLS (with $m \in [0.5, 1000]$) reduces the query-efficient Bandit attack's success rate on CIFAR-10 (ResNet-18) from 100% to 1.56% while maintaining exactly 0.0% clean accuracy degradation.

ML classification APIs—such as those powering visual content moderation in Cursor-like RAG pipelines, face verification models, or autonomous perception systems—are highly vulnerable to score-based black-box adversarial attacks. By querying the model repeatedly and observing changes in the output confidence scores, attackers can estimate gradients or execute random searches to craft adversarial inputs that bypass security filters. While traditional defenses like adversarial training degrade clean accuracy and incur heavy computational overheads, a new paper from Hamid Dashtbani, Mehdi Dousti Gandomani, and AmirMahdi Sadeghzadeh at the Sharif University of Technology introduces Random Logit Scaling (RLS): a post-processing defense that breaks query-based black-box optimizations with zero impact on clean model accuracy.

Threat Model

Background / Problem Setup

Black-box score-based attacks rely on exploiting the differences between class confidence scores to optimize a perturbation. These attacks use objective functions to direct their search:

• Untargeted Loss (Eq. 5): $\mathcal{J}(x') = f_y(x') - \max_{k \neq y} f_k(x')$
• Targeted Loss (Eq. 4): $\mathcal{J}(x') = \max_{k \neq t} f_k(x') - f_t(x')$

By slightly modifying the input and observing how these loss objectives decrease, optimization algorithms (such as NES, Bandit, or Square Attack) converge on an adversarial perturbation.

Many defenses have attempted to mitigate this by adding noise or reshaping logits:

Methodology

RLS operates strictly as a post-processing step on the raw logits output by the model.

[ Input x ] ---> [ Deep Neural Network ] ---> [ Logits z ] ---> [ Multiply by random m ] ---> [ Softmax ] ---> [ Scaled Scores p' ]
                                                                        ^
                                                                m ~ U(a, b)

For every query, RLS samples a positive scaling factor $m$ from a continuous uniform distribution:

After scaling the raw logits $z$, the standard softmax function is applied:

Why Clean Accuracy Is Untouched

Because $m > 0$, the relative mathematical order of the logits is preserved:

If $p_i > p_j$, then $p'_i > p'_j$ is guaranteed for any positive $m$. Consequently, the top-1 predicted class remains unchanged, leading to exactly 0% accuracy drop on benign test data (as verified in Section 6.3).

How It Confuses Attackers

When $m > 1$, the gap between the top class and runner-up class is exponentially exaggerated, making the model output highly confident scores. Conversely, when $0 < m < 1$, the probability distribution is smoothed out, shrinking the gap.

Because a different $m$ is sampled on every single API query, the attacker's objective function values fluctuate wildly (illustrated in Figure 2). If an attacker attempts to calculate finite-difference gradients (like NES):

the calculation is completely corrupted because the scaling factor $m$ changes between the evaluation of $f(x)$ and $f(x + \mu u)$.

Below is an example implementation of the RLS defense:

import torch
import torch.nn as nn

class RandomLogitScaling(nn.Module):
    def __init__(self, model: nn.Module, a: float = 0.5, b: float = 1000.0):
        super(RandomLogitScaling, self).__init__()
        self.model = model
        self.a = a
        self.b = b

    def forward(self, x: torch.Tensor) -> torch.Tensor:
        # 1. Get raw model logits
        logits = self.model(x)
        
        # 2. Sample scaling factor m ~ U(a, b)
        m = torch.FloatTensor(1).uniform_(self.a, self.b).to(logits.device)
        
        # 3. Apply scaling
        scaled_logits = m * logits
        
        # 4. Return standard softmax probabilities
        return torch.softmax(scaled_logits, dim=-1)

Key Results

The authors evaluated RLS against state-of-the-art (SOTA) query attacks using CIFAR-10 (on ResNet-18, VGG-16, WRN-28-10) and ImageNet (on ResNet-50) datasets.

1. Performance against $l_\infty$ Black-Box Attacks on CIFAR-10 (Table 4)

Using a perturbation budget of $\epsilon = 0.05$ (or $12.75/255$) and a maximum budget of 10,000 queries, RLS with range$[0.5, 1000]$ yields major robustness improvements:

2. Performance against Adaptive Attackers (EOT) on ResNet-18 (Table 6)

To challenge RLS, the authors simulated an adaptive attacker utilizing Expectation over Transformations (EOT). Under this scenario, the attacker queries the model $k$ times for the same input at each step, taking the average output score to neutralize the randomness.

Even with $k = 10$ queries per step (which effectively multiplies the attacker's required query count by 10x), the attack success rate against RLS (0.5, 1000) is constrained to 42.53%, compared to 74.17% for iRND. This shows that widening the uniform range $(a, b)$ severely penalizes EOT-based bypasses.

Limitations & Open Questions

While RLS provides highly practical and lightweight protection, we must examine its trade-offs critically:

1. Ineffective against Decision-Based Attacks: Since RLS deliberately preserves the top-1 predicted class (argmax), it does nothing to stop decision-based black-box attacks (e.g., HopSkipJumpAttack, Boundary Attack) that only observe the hard predicted label. The authors justify this by noting that decision-based attacks require orders of magnitude more queries, but it remains a security gap for high-budget adversaries.
2. Confidence Calibration Distortion: Section 6.3 details how logit scaling affects Expected Calibration Error (ECE). As Table 3 shows, RLS (0.5, 1000) increases ResNet-18 ECE from 0.0268 (undefended) to 0.0448. This means the output probabilities no longer represent true confidence. If your system depends on clean confidence scores for out-of-distribution (OOD) detection, active learning pipelines, or clinical decision support, RLS will introduce serious calibration issues.
3. No Certified Robustness: As with most randomization-based defenses, RLS offers empirical security rather than certified mathematical bounds. If an attacker has an infinite budget, they can run EOT with $k = 100$ or $k = 1000$ to eventually estimate the true logits.

What Practitioners Should Do

If you are deploying neural network classifiers via external APIs and want to protect against score-based query exploitation, implement these steps:

1. Integrate RLS in API Middleware

Inject the logit-scaling step directly into your inference container (such as Triton Inference Server or FastAPI wrappers) before the softmax layer. Ensure the uniform distribution range is broad, e.g., $m \sim \mathcal{U}(0.5, 1000.0)$.

2. Restrict Output Precision

Never return full probability distributions if top-K labels suffice. If your API must output scores, truncate them to 3 or 4 decimal places. This prevents attackers from reading minute fluctuations introduced by tiny adversarial steps.

3. Implement Strict Query Rate-Limiting

Because bypassing RLS requires adaptive EOT averaging (which multiplies the attacker's query budget by $k \ge 10$), rate-limiting is highly effective. Restrict IP addresses or API keys to a maximum of 100 queries per minute. This turns a fast 10,000-query attack into a multi-hour operation, giving your intrusion detection systems ample time to flag and block the malicious user.

4. Monitor Calibration-Sensitive Applications

Do not apply RLS to safety-critical systems that rely heavily on confidence score calibration (such as medical diagnosis pipelines or autonomous collision avoidance systems) unless you have implemented secondary calibration layers.

The Takeaway

Random Logit Scaling (RLS) is an elegant, zero-effort, post-processing defense that significantly increases the query cost of black-box adversarial attacks. While it is not a silver bullet against decision-based attacks and degrades model calibration slightly, its ability to reduce attack success rates with zero impact on model accuracy makes it a highly practical patch for commercial machine learning APIs.

Den's Take

Defenses claiming "zero clean accuracy degradation" usually warrant skepticism, but Random Logit Scaling (RLS) presents an elegantly simple post-processing approach that actually delivers on this promise. By dynamically multiplying logits by a random scaling factor $m \sim \mathcal{U}(0.5, 1000)$ on every query, RLS warps the confidence score landscape without shifting the argmax prediction. The fact that it reduces the highly query-efficient Bandit attack success rate on CIFAR-10 (using ResNet-18) from 100% down to a mere 1.56% is impressive, especially when compared to computationally expensive adversarial training.

However, we must look at this with a critical eye. RLS only protects endpoints that return complete soft-label confidence scores. If an attacker switches to a decision-based black-box attack—which only relies on hard-label predictions—RLS provides zero protection because the predicted class remains entirely unchanged. Furthermore, a sophisticated adversary could attempt to average out the scaling factor over multiple queries if the API rate limits are permissive. This emphasizes why evaluating these behavioral exploits is critical; as I highlighted in Rethinking Penetration Testing for AI-Enabled Systems: From Resource Compromise to Behavioral Objective Violation, security teams must focus on defending against behavioral violations on exposed model endpoints rather than treating AI security as a solved infrastructure problem.