Research map / Adversarial robustness and security / Certified and empirical robustness
Rethinking the Adversarial Robustness of Multi-Exit Neural Networks in an Attack-Defense Game
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Identifies an attack-defense exit mismatch that inflates robustness of multi-exit networks, proposes AIMER (game-theoretic attacker evaluation) and NEED (Nash-equilibrium randomized exit-ensemble defense).
Problem
Adversarial robustness evaluations of multi-exit neural networks use fixed exit sets for attack, which creates attack-defense exit mismatch and overestimates the robustness of defenses.
Approach
Model attack and defense over exit ensembles as a two-player zero-sum game; the attacker plays the best response to the defender's mixed strategy (AIMER) for evaluation, and the defender plays a Nash equilibrium mixed strategy over exit ensembles (NEED) to exploit residual mismatch.
Key results
- AIMER evaluates robustness 13.52% lower than max-average attack under AutoAttack for static/random defenses on ResNet-18 CIFAR-10 setting.
- NEED-enhanced multi-exit ResNet-18 on CIFAR-10 reaches 52.77% robust accuracy under PGD-20 AIMER evaluation vs 49.82% for single-exit networks.
- Combining NEED with adversarial training methods (PGD-AT, TRADES, MART, FAT) on VGG-16 CIFAR-10 yields stable robustness gains across attacks, e.g. TRADES+NEED 47.77% vs 42.06% under AutoAttack.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AIMER instead of max-average attack evaluation | Multi-exit networks with static, random, or dynamic inference · CIFAR-10 and SVHN | robust accuracy (AutoAttack): 13.52% lower than previous methods | Hurt |
| Use AIMER instead of max-average attack evaluation | ResNet-18 (4 exits), static inference · CIFAR-10 | robust accuracy (AutoAttack, %): 55.92 ± 0.10 -> 42.40 ± 0.03 | Hurt |
| Use AIMER instead of max-average attack evaluation | VGG-16 (5 exits), random inference · SVHN | robust accuracy (AutoAttack, %): 46.31 ± 0.05 -> 40.70 ± 0.10 | Hurt |
| Use NEED mixed-strategy inference instead of static inference | ResNet-18 (4 exits) · CIFAR-10 | robust accuracy (PGD-20 with AIMER, %): 50.65 ± 0.04 -> 52.77 ± 0.30 | Helped |
| Use NEED mixed-strategy inference instead of dynamic inference | ResNet-18 (4 exits) · CIFAR-10 | robust accuracy (PGD-20 with AIMER, %): 51.30 ± 0.12 -> 52.77 ± 0.30 | Helped |
| Use NEED mixed-strategy inference instead of single-exit inference | ResNet-18 (4 exits) · CIFAR-10 | robust accuracy (PGD-20 with AIMER, %): 49.82 ± 0.00 -> 52.77 ± 0.30 | Helped |
| Use NEED mixed-strategy inference instead of static inference | VGG-16 (5 exits) · SVHN | robust accuracy (PGD-20 with AIMER, %): 42.33 ± 0.03 -> 45.32 ± 0.16 | Helped |
| Use NEED mixed-strategy inference instead of dynamic inference | VGG-16 (5 exits) · SVHN | robust accuracy (PGD-20 with AIMER, %): 42.33 ± 0.04 -> 45.32 ± 0.16 | Helped |
| Use NEED mixed-strategy inference instead of single-exit inference | VGG-16 (5 exits) · SVHN | robust accuracy (PGD-20 with AIMER, %): 43.35 ± 0.00 -> 45.32 ± 0.16 | Helped |
| Add NEED inference to PGD-AT | VGG-16 trained with PGD-AT · CIFAR-10 | robust accuracy (PGD-20, %): 47.86 ± 0.03 -> 50.61 ± 0.11 | Helped |
| Add NEED inference to TRADES | VGG-16 trained with TRADES · CIFAR-10 | robust accuracy (PGD-20, %): 47.30 ± 0.04 -> 48.26 ± 0.07 | Helped |
| Add NEED inference to MART | VGG-16 trained with MART · CIFAR-10 | robust accuracy (PGD-20, %): 44.88 ± 0.03 -> 45.58 ± 0.06 | Helped |
Surprising findings
- AutoAttack is not necessarily the strongest attack against multi-exit networks, since its black-box components may fail to generalize to unattacked exits.
- Max-average attack does not always outperform single or average attacks on the MSDNet-based defense.
Limitations
- Payoff matrix is approximated using a data subset with average attack due to expensive full evaluation.
- Dynamic defenses are modeled only through exit usage frequency as a surrogate strategy.
- Attacker is assumed to know the defender's probabilistic strategy but not the sampled ensemble.
Experimental setup
Datasets: SVHN CIFAR-10 Tiny ImageNet
Benchmarks: SVHN CIFAR-10 Tiny ImageNet
Metrics: robust accuracy clean accuracy mismatch rate
Baselines: single attack average attack max-average attack AutoAttack MSDNet adversarial defense [3] input-adaptive multi-exit defense [16] PGD-AT TRADES MART FAT
Builds on: adversarial training (PGD-AT) TRADES MART FAT EoT AutoAttack
Closest papers by meaning
- Increasing Confidence in Adversarial Robustness Evaluations (NeurIPS 2022 · similarity 0.88)
- Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR 2018 · similarity 0.88)
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.88)
- Towards a Unified Game-Theoretic View of Adversarial Perturbations and Robustness (NeurIPS 2021 · similarity 0.88)
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.87)
- Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.