Adversarial attacks for mixtures of classifiers
This addresses security vulnerabilities in machine learning systems using mixtures of classifiers, but it is incremental as it builds on prior work on adversarial attacks.
The paper tackled the problem of adversarial attacks on mixtures of classifiers, which are used for robustness, by showing existing attacks are inadequate and introducing a new attack with theoretical guarantees and experimental validation on synthetic and real datasets.
Mixtures of classifiers (a.k.a. randomized ensembles) have been proposed as a way to improve robustness against adversarial attacks. However, it has been shown that existing attacks are not well suited for this kind of classifiers. In this paper, we discuss the problem of attacking a mixture in a principled way and introduce two desirable properties of attacks based on a geometrical analysis of the problem (effectiveness and maximality). We then show that existing attacks do not meet both of these properties. Finally, we introduce a new attack called lattice climber attack with theoretical guarantees on the binary linear setting, and we demonstrate its performance by conducting experiments on synthetic and real datasets.