Towards Optimal Randomized Strategies in Adversarial Example Game

Abstract

The vulnerability of deep neural network models to adversarial example attacks is a practical challenge in many artificial intelligence applications. A recent line of work shows that the use of randomization in adversarial training is the key to find optimal strategies against adversarial example attacks. However, in a fully randomized setting where both the defender and the attacker can use randomized strategies, there are no efficient algorithm for finding such an optimal strategy. To fill the gap, we propose the first algorithm of its kind, called FRAT, which models the problem with a new infinite-dimensional continuous-time flow on probability distribution spaces. FRAT maintains a lightweight mixture of models for the defender, with flexibility to efficiently update mixing weights and model parameters at each iteration. Furthermore, FRAT utilizes lightweight sampling subroutines to construct a random strategy for the attacker. We prove that the continuous-time limit of FRAT converges to a mixed Nash equilibria in a zero-sum game formed by a defender and an attacker. Experimental results also demonstrate the efficiency of FRAT on CIFAR-10 and CIFAR-100 datasets.

arXiv commentExtended version of paper https://doi.org/10.1609/aaai.v37i9.26247 which appeared in AAAI 2023

References in corpus (27)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Certified Adversarial Robustness via Randomized Smoothing
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• A Differential Equation for Modeling Nesterov's Accelerated Gradient Method: Theory and Insights
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Towards the first adversarially robust neural network model on MNIST
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Randomized Prediction Games for Adversarial Machine Learning
• Recent Advances in Adversarial Training for Adversarial Robustness
• Theoretical evidence for adversarial robustness through randomization
• Randomization matters. How to defend against strong adversarial attacks
• Finding Mixed Nash Equilibria of Generative Adversarial Networks
• Global convergence of neuron birth-death dynamics
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Adversarial Example Games
• A mean-field analysis of two-player zero-sum games
• Robust Attacks against Multiple Classifiers
• Sliced-Wasserstein Flows: Nonparametric Generative Modeling via Optimal Transport and Diffusions
• Follow the Perturbed Leader: Optimism and Fast Parallel Algorithms for Smooth Minimax Games
• Mixed Nash Equilibria in the Adversarial Examples Game
• Provably convergent quasistatic dynamics for mean-field two-player zero-sum games