A cryptographic approach to black box adversarial machine learning

2019/06/07 by Kevin Shi, Shi, Kevin, Daniel Hsu +3
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #Digital Media Forensic Detection #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · pdf · doi:10.48550/arxiv.1906.03231

openalex publication_date 2019/06/07 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

We propose a new randomized ensemble technique with a provable security guarantee against black-box transfer attacks. Our proof constructs a new security problem for random binary classifiers which is easier to empirically verify and a reduction from the security of this new model to the security of the ensemble classifier. We provide experimental evidence of the security of our random binary classifiers, as well as empirical results of the adversarial accuracy of the overall ensemble to black-box attacks. Our construction crucially leverages hidden randomness in the multiclass-to-binary reduction.

Citations

• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Learning Multiple Layers of Features from Tiny Images

Related

• On the Security of Randomized Defenses Against Adversarial Samples
• Defending against adversarial attacks by randomized diversification
• Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence
• Ensemble of Models Trained by Key-based Transformed Images for Adversarially Robust Defense Against Black-box Attacks
• Adversarial Examples from Cryptographic Pseudo-Random Generators