Adaptive Attractors: A Defense Strategy Against Adversarial Collusion Attacks in Machine Learning

Le résumé fourni par la source

In the seller-buyer setting on machine learning models, the seller generates different copies based on the original model and distributes them to buyers, such that adversarial samples generated on one buyer's copy would likely not work on other copies. A known approach achieves this using attractor-based rewriter which injects different attractors to different copies. This induces different adversarial regions in different copies, making adversarial samples generated on one copy not replicable on others. In this paper, we focus on a scenario where multiple malicious buyers collude to attack. We first give two formulations and conduct empirical studies to analyze effectiveness of collusion attack under different assumptions on the attacker's capabilities and properties of the attractors. We observe that existing attractor-based methods do not effectively mislead the colluders as number of colluders increases (Figure 2). To address this, we propose adaptive attractors whose weight is guided by a U-shape curve. Experimental results demonstrate the efficacy of our approach. With 40 copies used for collusion, our method achieves a convergence of approximately 15% and 6% attack success rates on CIFAR-10 and GTSRB datasets respectively. In contrast, employing the original attractor-based rewriter leads to linear increase in attack success rates, reaching 29% and 19% respectively.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.