In Section A, we talk about the societal impacts of our work In Section B, we provide detailed experimental settings as well as further evaluation results on CIFAR-10 and ImageNet. Forreal-worldapplications,theDNNmodelaswellas the training dataset, are often hidden from users. Extensive experiments verify our theoretical analysis and showtheeffectiveness ofourdefense methods against several state-of-the-art query-based attacks. On ImageNet, [23] released the ResNet-50 model fine-tuned with Gaussian noise sampled from N(0,0.5I)andwedirectlyadoptit. The experimental results on ImageNet are shown in Figure 3 (a-d).

In this work, we study a lightweight defense method,dubbed RandomNoiseDefense (RND),whichaddsproperGaussiannoise toeachquery.

The P is asanoperators0 P(s,).

Machine learning poses specific challenges for the solution of such systems due to their scale, characteristic structure, stochasticity and the central role of uncertainty in thefield.