# MTDeep: Boosting the Security of Deep Neural Nets Against Adversarial Attacks with Moving Target Defense

arXiv: https://arxiv.org/abs/1705.07213 · HTML: https://mlsanity.com/paper/1705.07213/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 May 2017.

## Built on by (most cited first, 12 of 12)

- [MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.10739/) (2023)
- [Game Theoretic Mixed Experts for Combinational Adversarial Machine Learning](https://mlsanity.com/paper/2211.14669/) (2022)
- [StratDef: Strategic Defense Against Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2202.07568/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [Rethinking Machine Learning Robustness via its Link with the Out-of-Distribution Problem](https://mlsanity.com/paper/2202.08944/) (2022)
- [Morphence-2.0: Evasion-Resilient Moving Target Defense Powered by Out-of-Distribution Detection](https://mlsanity.com/paper/2206.07321/) (2022)
- [The Role of Deep Learning in Advancing Proactive Cybersecurity Measures for Smart Grid Networks: A Survey](https://mlsanity.com/paper/2401.05896/) (2024)
- [DYNASHIELD: A Black-Box Moving Target Defense for LLMs via Dynamic Decoding Customization](https://mlsanity.com/paper/2412.07672/) (2024)
- [Ares: A System-Oriented Wargame Framework for Adversarial ML](https://mlsanity.com/paper/2210.12952/) (2022)
- [Effectiveness of Moving Target Defenses for Adversarial Attacks in ML-based Malware Detection](https://mlsanity.com/paper/2302.00537/) (2023)
- [Efficient Adversarial Malware Defense via Trust-Based Raw Override and Confidence-Adaptive Bit-Depth Reduction](https://mlsanity.com/paper/2511.12827/) (2025)
- [False Floors: LLM Safety Routing Evaluations Break Under Distribution Shift](https://mlsanity.com/paper/2610.01535/) (2026)

## Abstract (arXiv)

Present attack methods can make state-of-the-art classification systems based on deep neural networks misclassify every adversarially modified test example. The design of general defense strategies against a wide range of such attacks still remains a challenging problem. In this paper, we draw inspiration from the fields of cybersecurity and multi-agent systems and propose to leverage the concept of Moving Target Defense (MTD) in designing a meta-defense for 'boosting' the robustness of an ensemble of deep neural networks (DNNs) for visual classification tasks against such adversarial attacks. To classify an input image, a trained network is picked randomly from this set of networks by formulating the interaction between a Defender (who hosts the classification networks) and their (Legitimate and Malicious) users as a Bayesian Stackelberg Game (BSG). We empirically show that this approach, MTDeep, reduces misclassification on perturbed images in various datasets such as MNIST, FashionMNIST, and ImageNet while maintaining high classification accuracy on legitimate test images. We then demonstrate that our framework, being the first meta-defense technique, can be used in conjunction with any existing defense mechanism to provide more resilience against adversarial attacks that can be afforded by these defense mechanisms. Lastly, to quantify the increase in robustness of an ensemble-based classification system when we use MTDeep, we analyze the properties of a set of DNNs and introduce the concept of differential immunity that formalizes the notion of attack transferability.