Ensembling as a Defense Against Adversarial Examples

Adversarial attacks on machine learning systems take two main flavors. First, there are trainingtime attacks, which involve compromising the training data that the system is trained on. Unsurprisingly, machines can misclassify examples, if they are trained on malicious data. Second, there are test-time attacks, which involve crafting an adversarial example, which a human would easily classify as some class A, whereas the system erroneously classifies it as some different class B [1]. For example, both images in Figure 1 are easily classified by humans to be a stop sign. In the adversarial setting, some classifier may misclassify the image on the right to be a speed limit 45 sign instead.