A cryptographic approach to black box adversarial machine learning
This work addresses security vulnerabilities in machine learning systems for applications requiring robustness against adversarial attacks, representing an incremental advancement with a focus on provable guarantees.
The paper tackles the problem of black-box adversarial attacks on machine learning models by proposing a randomized ensemble technique with a provable security guarantee, achieving improved adversarial accuracy as demonstrated in experiments.
We propose a new randomized ensemble technique with a provable security guarantee against black-box transfer attacks. Our proof constructs a new security problem for random binary classifiers which is easier to empirically verify and a reduction from the security of this new model to the security of the ensemble classifier. We provide experimental evidence of the security of our random binary classifiers, as well as empirical results of the adversarial accuracy of the overall ensemble to black-box attacks. Our construction crucially leverages hidden randomness in the multiclass-to-binary reduction.