Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
Recently, researchers have discovered that the state-of-the-art object classifiers can be fooled easily by small perturbations in the input unnoticeable to human eyes. It is also known that an attacker can generate strong adversarial examples if she knows the classifier parameters. Conversely, a defender can robustify the classifier by retraining if she has access to the adversarial examples. We explain and formulate this adversarial example problem as a two-player continuous zero-sum game, and demonstrate the fallacy of evaluating a defense or an attack as a static problem. To find the best worst-case defense against whitebox attacks, we propose a continuous minimax optimization algorithm. We demonstrate the minimax defense with two types of attack classes -- gradient-based and neural network-based attacks. Experiments with the MNIST and the CIFAR-10 datasets demonstrate that the defense found by numerical minimax optimization is indeed more robust than non-minimax defenses. We discuss directions for improving the result toward achieving robustness against multiple types of attack classes.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
Generalized Likelihood Ratio Test for Adversarially Robust Hypothesis Testing
Machine learning models are known to be susceptible to adversarial attacks which can cause misclassification by introducing small but well designed perturbations. In this paper, we consider a classical hypothesis testing…
Minimax Defense against Gradient-based Adversarial Attacks
State-of-the-art adversarial attacks are aimed at neural network classifiers. By default, neural networks use gradient descent to minimize their loss function. The gradient of a classifier's loss function is used by grad…
Generative Adversarial NetworkAdversarially Robust Classification based on GLRT
Machine learning models are vulnerable to adversarial attacks that can often cause misclassification by introducing small but well designed perturbations. In this paper, we explore, in the setting of classical composite …
ClassificationGeneral ClassificationRobust classificationTwo-sample testingMinimax rates of convergence for nonparametric regression under adversarial attacks
Recent research shows the susceptibility of machine learning models to adversarial attacks, wherein minor but maliciously chosen perturbations of the input can significantly degrade model performance. In this paper, we t…
regressionStronger Data Poisoning Attacks Break Data Sanitization Defenses
Machine learning models trained on data from the outside world can be corrupted by data poisoning attacks that inject malicious points into the models' training sets. A common defense against these attacks is data saniti…
Data PoisoningSentiment AnalysisSentiment ClassificationSpam detection