# Robust Attacks against Multiple Classifiers

arXiv: https://arxiv.org/abs/1906.02816 · HTML: https://mlsanity.com/paper/1906.02816/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jun 2019.

## Built on by (most cited first, 7 of 7)

- [Mixed Nash Equilibria in the Adversarial Examples Game](https://mlsanity.com/paper/2102.06905/) (2021)
- [Nash Equilibria and Pitfalls of Adversarial Training in Adversarial Robustness Games](https://mlsanity.com/paper/2210.12606/) (2022)
- [On the Role of Randomization in Adversarially Robust Classification](https://mlsanity.com/paper/2302.07221/) (2023)
- [Adversarial attacks for mixtures of classifiers](https://mlsanity.com/paper/2307.10788/) (2023)
- [Scalable Optimal Classifiers for Adversarial Settings under Uncertainty](https://mlsanity.com/paper/2106.14702/) (2021)
- [Towards Optimal Randomized Strategies in Adversarial Example Game](https://mlsanity.com/paper/2306.16738/) (2023)
- [Lattice Climber Attack: Adversarial attacks for randomized mixtures of classifiers](https://mlsanity.com/paper/2506.10888/) (2025)

## Abstract (arXiv)

We address the challenge of designing optimal adversarial noise algorithms for settings where a learner has access to multiple classifiers. We demonstrate how this problem can be framed as finding strategies at equilibrium in a two-player, zero-sum game between a learner and an adversary. In doing so, we illustrate the need for randomization in adversarial attacks. In order to compute Nash equilibrium, our main technical focus is on the design of best response oracles that can then be implemented within a Multiplicative Weights Update framework to boost deterministic perturbations against a set of models into optimal mixed strategies. We demonstrate the practical effectiveness of our approach on a series of image classification tasks using both linear classifiers and deep neural networks.