Adversarial attacks for mixtures of classifiers

TL;DR

This paper analyzes the challenge of effectively attacking mixtures of classifiers, introduces two key properties for attacks, and proposes a new attack method with theoretical guarantees and empirical validation.

Contribution

It presents a principled approach to attacking classifier mixtures, identifies limitations of existing attacks, and introduces the lattice climber attack with proven effectiveness.

Findings

Existing attacks are inadequate for classifier mixtures.

The lattice climber attack outperforms previous methods.

The attack has theoretical guarantees in binary linear settings.

Abstract

Mixtures of classifiers (a.k.a. randomized ensembles) have been proposed as a way to improve robustness against adversarial attacks. However, it has been shown that existing attacks are not well suited for this kind of classifiers. In this paper, we discuss the problem of attacking a mixture in a principled way and introduce two desirable properties of attacks based on a geometrical analysis of the problem (effectiveness and maximality). We then show that existing attacks do not meet both of these properties. Finally, we introduce a new attack called lattice climber attack with theoretical guarantees on the binary linear setting, and we demonstrate its performance by conducting experiments on synthetic and real datasets.