UNB Researchers Build a Mixture-of-Experts Defence Against Adversarial AI Attacks

Tiny, nearly imperceptible changes to an input can be enough to fool a machine learning model into misclassifying almost anything — a car, a face, a network packet. Researchers at UNB's Canadian Institute for Cybersecurity are working on a defence that doesn't just patch one model, but spreads the job across several.

Adversarial Attack Mitigation via Mixture-of-Experts, a poster from researchers Mohammad Meymani and Roozbeh Razavi-Far, will be at the institute's PST Cybersecurity Summit 2026 in Fredericton on Aug. 20.

The problem: white-box evasion

The work targets white-box evasion attacks — where an attacker knows the model's internals and crafts inputs designed to push a classification over a wrong answer. The two standard stress tests are FGSM and PGD: fast gradient-sign attacks that perturb an image just enough to flip a model's verdict while remaining invisible to a human eye.

The approach: don't trust one expert

Rather than relying on a single network, the proposed system combines adversarial training with a Mixture-of-Experts (MoE) architecture — nine ResNet-18-based experts that specialise and are routed through a gating mechanism, so the model can lean on the expert best suited to a given input.

In testing on the CIFAR-10 and SVHN image datasets, the researchers report the approach outperformed state-of-the-art MoE-based defences under strong FGSM and PGD attacks.

The poster isn't preliminary work: the method behind it is published in the journal Information Sciences under the title "Divided We Fall", which gives the technique its full name — a soft-gated fractional Mixture-of-Experts trained with randomized adversarial training. The "soft-gated fractional" part matters: rather than handing an input to a single winning expert, the gate blends fractional contributions from several, so an attacker can't craft a perturbation that defeats one specialist and wins the whole verdict.

Why it matters

Adversarial robustness is a practical concern for any AI making security or safety decisions — from spam and malware classification to fraud detection and autonomous perception. New Brunswick's cybersecurity industry has been built on models that must not be easy to fool; the institute's research pipeline is where much of that technique is developed before it reaches local companies. A defence that survives stronger attacks than previous MoE approaches is one more building block for models deployed in hostile environments.

Sources

• Canadian Institute for Cybersecurity: Research Spotlight post — project summary, authors, results on CIFAR-10 and SVHN
• Divided We Fall: Defending against adversarial attacks via soft-gated fractional mixture-of-experts with randomized adversarial training — Meymani and Razavi-Far, Information Sciences, July 2026 (DOI 10.1016/j.ins.2026.123427); the peer-reviewed paper linked from the institute's post