Adversarial attacks for mixtures of classifiers
Lucas Gnecco Heredia Benjamin Negrevergne Yann Chevaleyre
Mixtures of classifiers (a.k.a. randomized ensembles) have been proposed as a
way to improve robustness against adversarial attacks. However, it has been
shown that existing attacks are not well suited for this kind of classifiers.
In this paper, we discuss the problem of attacking a mixture in a principled
way and introduce two desirable properties of attacks based on a geometrical
analysis of the problem (effectiveness and maximality). We then show that
existing attacks do not meet both of these properties. Finally, we introduce a
new attack called lattice climber attack with theoretical guarantees on the
binary linear setting, and we demonstrate its performance by conducting
experiments on synthetic and real datasets.