[Paper Review] Adversarial Example Games

Avishek Joey Bose, Gauthier Gidel+5 more|arXiv (Cornell University)|Jul 1, 2020

Adversarial Robustness in Machine Learning79 references12 citations

TL;DR

This paper introduces Adversarial Example Games (AEG), a min-max game framework that trains a generator to produce transferable adversarial examples effective against any classifier in a given hypothesis class. Theoretically proven to converge to an equilibrium producing optimal, worst-case adversarial examples, AEG achieves state-of-the-art performance—29.9% and 47.2% average improvement—on MNIST and CIFAR-10 under non-interactive black-box settings.

ABSTRACT

The existence of adversarial examples capable of fooling trained neural network classifiers calls for a much better understanding of possible attacks to guide the development of safeguards against them. This includes attack methods in the challenging non-interactive blackbox setting, where adversarial attacks are generated without any access, including queries, to the target model. Prior attacks in this setting have relied mainly on algorithmic innovations derived from empirical observations (e.g., that momentum helps), lacking principled transferability guarantees. In this work, we provide a theoretical foundation for crafting transferable adversarial examples to entire hypothesis classes. We introduce Adversarial Example Games (AEG), a framework that models the crafting of adversarial examples as a min-max game between a generator of attacks and a classifier. AEG provides a new way to design adversarial examples by adversarially training a generator and a classifier from a given hypothesis class (e.g., architecture). We prove that this game has an equilibrium, and that the optimal generator is able to craft adversarial examples that can attack any classifier from the corresponding hypothesis class. We demonstrate the efficacy of AEG on the MNIST and CIFAR-10 datasets, outperforming prior state-of-the-art approaches with an average relative improvement of $29.9\%$ and $47.2\%$ against undefended and robust models (Table 2 & 3) respectively.

Motivation & Objective

• Address the lack of theoretical foundations for non-interactive black-box (NoBox) adversarial attacks, where attackers have no access to the target model.
• Develop a principled framework to generate adversarial examples that are transferable across entire hypothesis classes of classifiers.
• Provide a theoretical guarantee that the optimal adversarial distribution from the game is effective against the hardest-to-fool classifiers in the class.
• Design a training procedure that simultaneously strengthens the attacker and the classifier through adversarial game dynamics.
• Demonstrate empirical superiority over heuristic NoBox methods in attacking both standard and robust models.

Proposed method

• Formulate adversarial attack generation as a min-max game between a generator (producing adversarial examples) and a classifier (detecting labels on adversarial inputs).
• Define the game using a standard multi-class classification loss on adversarial examples, not a GAN-style discrimination task.
• Prove the existence of a Nash equilibrium in the AEG framework, where the optimal generator produces adversarial examples effective against any classifier in the hypothesis class.
• Show the optimal adversarial distribution maximizes a restricted conditional entropy over the target dataset, providing a theoretical characterization.
• Implement the game using neural networks for both generator and classifier, training them end-to-end via gradient-based optimization.
• Use the equilibrium generator to produce adversarial examples that are evaluated for transferability across unseen architectures and robust models.

Experimental results

Research questions

• RQ1 Can a game-theoretic framework provide a principled, theoretically grounded method for generating transferable adversarial examples in the non-interactive black-box setting?
• RQ2 Does the Nash equilibrium of such a game yield adversarial examples that are effective against the most robust classifiers in a hypothesis class?
• RQ3 How does the optimal adversarial distribution relate to information-theoretic quantities like conditional entropy?
• RQ4 Can adversarial training in this game framework lead to stronger attack performance compared to heuristic NoBox methods?
• RQ5 To what extent can the AEG framework generate adversarial examples that transfer to robustly trained models and unseen architectures?

Key findings

• The AEG framework has a guaranteed Nash equilibrium, ensuring the existence of an optimal adversarial example distribution.
• The optimal generator in AEG produces adversarial examples that are effective against any classifier within the given hypothesis class, providing a worst-case attack guarantee.
• On MNIST, AEG achieves an average 29.9% improvement over prior state-of-the-art methods in non-interactive black-box attacks.
• On CIFAR-10, AEG achieves an average 47.2% improvement over prior SOTA in both undefended and robust model attacks.
• The framework successfully generates transferable adversarial examples that generalize across different architectures and robust models.
• The optimal adversarial distribution is shown to maximize a form of restricted conditional entropy, linking the game’s solution to information-theoretic principles.