Game Theoretical Adversarial Deep Learning With Variational Adversaries

• Published in: IEEE transactions on knowledge and data engineering Vol. 33; no. 11; pp. 3568 - 3581
• Main Authors: Chivukula, Aneesh Sreevallabh, Yang, Xinghao, Liu, Wei, Zhu, Tianqing, Zhou, Wanlei
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.11.2021; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Adversarial learning; Artificial neural networks; Classifiers; Computational modeling; convolutional neural networks; Deep learning; Game theory; Games; Machine learning; Nash equilibrium; Neural networks; Optimization; Perturbation methods; Simulated annealing; Training; variational autoencoders
• ISSN: 1041-4347; 1558-2191
• DOI: 10.1109/TKDE.2020.2972320

A critical challenge in machine learning is the vulnerability of learning models in defending attacks from malicious adversaries. In this research, we propose game theoretical learning between a variational adversary and a Convolutional Neural Network (CNN), participating in a variable-sum two-player sequential Stackelberg game. Our adversary manipulates the input data distribution to make the CNN misclassify the manipulated data. Our ideal adversarial manipulation is a minimum change to the data which yet is large enough to mislead the CNNs. We propose an optimization procedure to find optimal adversarial manipulations by solving for the Nash equilibrium of the Stackelberg game. Specifically, the adversary's payoff function depends on the data manipulation which is determined by a Variational Autoencoder, while the CNN classifier's payoff functions are evaluated by misclassification errors. The optimization of our adversarial manipulations is defined by Alternating Least Squares and Simulated Annealing. Experimental results demonstrate that our game-theoretic manipulations are able to mislead CNNs that are well trained on the original data as well as on data generated by other models. We then let the CNNs to incorporate our manipulated data which leads to secure classifiers that are empirically the most robust in defending various types of adversarial attacks.