Year: 2024
Type: preprint
Abstract: This paper explores a scenario in which a malicious actor employs a multi-armed attack strategy to manipulate data samples, offering them various avenues to introduce noise into the dataset. Our central objective is to protect the data by detecting any alterations to the input. We approach this defensive strategy with utmost caution, operating in an environment where the defender possesses significantly less information compared to the attacker. Specifically, the defender is unable to utilize any data samples for training a defense model or verifying the integrity of the channel. Instead, the defender relies exclusively on a set of pre-existing detectors readily available "off the shelf". To tackle this challenge, we derive an innovative information-theoretic defense approach that optimally aggregates the decisions made by these detectors, eliminating the need for any training data. We further explore a practical use-case scenario for empirical evaluation, where the attacker possesses a pre-trained classifier and launches well-known adversarial attacks against it. Our experiments highlight the effectiveness of our proposed solution, even in scenarios that deviate from the optimal setup.
Source: arXiv (Cornell University)
Authors: Granese, Federica, Romanelli, Marco, Piantanida, Pablo
Institutions: Sorbonne Université, Unité de Modélisation Mathématique et Informatique des Systèmes Complexes, Institut de Recherche pour le Développement, New York University, Centre National de la Recherche Scientifique, Université Paris-Saclay, CentraleSupélec, Mila - Quebec Artificial Intelligence Institute, International Laboratory on Learning Systems
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
Funder: Agence Nationale de la Recherche
OpenAlex ID: W4392223738