Game Over Eva(sion): Securing Deep Learning with Game Theory

The project Game Over Eva(sion): Securing Deep Learning with Game Theory aims to protect deep learning classifiers against targeted attacks. Deep learning classifiers are not only popular in scientific research but are also more and more adapted to the daily life, as self-driving cars, smartphones, and digital personal assistants use these kind of algorithms. Unfortunately, recent research has shown that almost all deep learning classifiers are vulnerable to so-called evasion attacks. In an evasion attack, an attacker can slightly modify a benign object and by this achieves a misclassification with a very high probability. The robustness of deep learning classifiers to these attacks is an open problem. We will model the competition of an attacker who is able to launch an evasion attack and the defender who wants to train a deep learning classifier that is robust against such an attack with means of game theory. In a first step, we will analyze which concepts of other research areas, such as adversarial classification, can be translated to the domain of secure deep learning. Then, we will develop a game-theoretic model that captures all relevant aspects and dependencies between the attackers and the defenders strategies. In the course of the project, we expect the first theoretically well-founded results on the achievable security of deep learning classifiers in the presence of evasion attacks. Furthermore, we will evaluate existing countermeasures against evasion attacks to gain insights about their optimality when facing a strategic attacker. Finally, we want to implement the key properties from out theoretical models in a practical deep learning classifier. We will compare our classifier against other state-of- the-art classifiers in terms of robustness against evasion attacks and accuracy on benign input objects. By this, we can validate if it is possible to make deep learning classifiers robust against evasion attacks. The expected results of the project will enable us to judge if deep learning classifiers are suitable for scenarios where an attacker has incentives to explicitly fool them, i.e., security-critical areas and widespread consumer products.