Game Theoretic Mixed Experts for Combinational Adversarial Machine Learning

TL;DR

This paper introduces a game-theoretic framework called GaME for designing robust ensemble defenses against compositional adversarial attacks, incorporating new attack algorithms and analyzing transferability between defenses.

Contribution

It develops a novel game-theoretic approach for ensemble adversarial defenses and proposes three new attack algorithms targeting randomized and multi-model defenses.

Findings

Transferability between defenses is low, enabling game-theoretic strategies.

GaME effectively finds optimal mixed strategies for defenses and attackers.

New attack algorithms improve robustness testing of ensemble defenses.

Abstract

Recent advances in adversarial machine learning have shown that defenses considered to be robust are actually susceptible to adversarial attacks which are specifically customized to target their weaknesses. These defenses include Barrage of Random Transforms (BaRT), Friendly Adversarial Training (FAT), Trash is Treasure (TiT) and ensemble models made up of Vision Transformers (ViTs), Big Transfer models and Spiking Neural Networks (SNNs). We first conduct a transferability analysis, to demonstrate the adversarial examples generated by customized attacks on one defense, are not often misclassified by another defense. This finding leads to two important questions. First, how can the low transferability between defenses be utilized in a game theoretic framework to improve the robustness? Second, how can an adversary within this framework develop effective multi-model attacks? In this paper, we provide a game-theoretic framework for ensemble adversarial attacks and defenses. Our framework is called Game theoretic Mixed Experts (GaME). It is designed to find the Mixed-Nash strategy for both a detector based and standard defender, when facing an attacker employing compositional adversarial attacks. We further propose three new attack algorithms, specifically designed to target defenses with randomized transformations, multi-model voting schemes, and adversarial detector architectures. These attacks serve to both strengthen defenses generated by the GaME framework and verify their robustness against unforeseen attacks. Overall, our framework and analyses advance the field of adversarial machine learning by yielding new insights into compositional attack and defense formulations.