SupplementaryMaterialsofRandomNoiseDefense againstQuery-BasedBlack-BoxAttacks

In Section A, we talk about the societal impacts of our work In Section B, we provide detailed experimental settings as well as further evaluation results on CIFAR-10 and ImageNet. Forreal-worldapplications,theDNNmodelaswellas the training dataset, are often hidden from users. Extensive experiments verify our theoretical analysis and showtheeffectiveness ofourdefense methods against several state-of-the-art query-based attacks. On ImageNet, [23] released the ResNet-50 model fine-tuned with Gaussian noise sampled from N(0,0.5I)andwedirectlyadoptit. The experimental results on ImageNet are shown in Figure 3 (a-d).