Recent advances in adversarial machine learning have shown that defenses considered to be robust are actually susceptible to adversarial attacks which are specifically customized to target their weaknesses. These defenses include Barrage of Random Transforms (BaRT), Friendly Adversarial Training (FAT), Trash is Treasure (TiT) and ensemble models made up of Vision Transformers (ViTs), Big Transfer models and Spiking Neural Networks (SNNs). We first conduct a transferability analysis, to demonstrate the adversarial examples generated by customized attacks on one defense, are not often misclassified by another defense. This finding leads to two important questions. First, how can the low transferability between defenses be utilized in a game theoretic framework to improve the robustness? Second, how can an adversary within this framework develop effective multi-model attacks? In this paper, we provide a game-theoretic framework for ensemble adversarial attacks and defenses. Our framework is called Game theoretic Mixed Experts (GaME). It is designed to find the Mixed-Nash strategy for both a detector based and standard defender, when facing an attacker employing compositional adversarial attacks. We further propose three new attack algorithms, specifically designed to target defenses with randomized transformations, multi-model voting schemes, and adversarial detector architectures. These attacks serve to both strengthen defenses generated by the GaME framework and verify their robustness against unforeseen attacks. Overall, our framework and analyses advance the field of adversarial machine learning by yielding new insights into compositional attack and defense formulations.

翻译：近期对抗机器学习领域的进展表明，被认为具有鲁棒性的防御措施实际上容易受到专门针对其弱点定制的对抗攻击。这些防御措施包括随机变换弹幕（BaRT）、友好对抗训练（FAT）、垃圾即宝藏（TiT）以及由视觉Transformer（ViTs）、大迁移模型和脉冲神经网络（SNNs）组成的集成模型。我们首先进行迁移性分析，证明通过定制攻击针对某一防御生成的对抗样本通常不会被另一防御误分类。这一发现引出两个关键问题：第一，如何在博弈论框架中利用防御间低迁移性来提升鲁棒性？第二，该框架中的攻击者如何开发有效的多模型攻击？本文提出一个针对集成对抗攻击与防御的博弈论框架，称为博弈论混合专家模型（GaME）。该框架旨在当面对采用组合对抗攻击的攻击者时，为基于检测器的防御者和标准防御者分别寻找混合纳什策略。我们进一步提出三种新型攻击算法，专门针对具有随机变换、多模型投票机制和对抗检测器架构的防御。这些攻击既能增强由GaME框架生成的防御效果，又能验证其对未预知攻击的鲁棒性。总体而言，我们的框架与分析通过揭示组合攻击与防御公式的新见解，推动了对抗机器学习领域的发展。