  Recent advances in adversarial machine learning have shown that defenses
considered to be robust are actually susceptible to adversarial attacks which
are specifically customized to target their weaknesses. These defenses include
Barrage of Random Transforms (BaRT), Friendly Adversarial Training (FAT), Trash
is Treasure (TiT) and ensemble models made up of Vision Transformers (ViTs),
Big Transfer models and Spiking Neural Networks (SNNs). We first conduct a
transferability analysis, to demonstrate the adversarial examples generated by
customized attacks on one defense, are not often misclassified by another
defense.
  This finding leads to two important questions. First, how can the low
transferability between defenses be utilized in a game theoretic framework to
improve the robustness? Second, how can an adversary within this framework
develop effective multi-model attacks? In this paper, we provide a
game-theoretic framework for ensemble adversarial attacks and defenses. Our
framework is called Game theoretic Mixed Experts (GaME). It is designed to find
the Mixed-Nash strategy for both a detector based and standard defender, when
facing an attacker employing compositional adversarial attacks. We further
propose three new attack algorithms, specifically designed to target defenses
with randomized transformations, multi-model voting schemes, and adversarial
detector architectures. These attacks serve to both strengthen defenses
generated by the GaME framework and verify their robustness against unforeseen
attacks. Overall, our framework and analyses advance the field of adversarial
machine learning by yielding new insights into compositional attack and defense
formulations.
