Towards Scalable and Robust Model Versioning
Towards Scalable and Robust Model Versioning
复制标题
DOI：
10.1109/satml59370.2024.00036
复制
发表时间：
2024-01
期刊：
影响因子：
--
通讯作者：
Wenxin Ding;A. Bhagoji;Ben Y. Zhao;Haitao Zheng
中科院分区：
文献类型：
--
作者：
Wenxin Ding;A. Bhagoji;Ben Y. Zhao;Haitao Zheng
随着深度学习模型的部署不断在各个行业扩展，旨在获取这些已部署模型的恶意入侵的威胁正在不断增加。如果攻击者获得对已部署模型的访问权限，无论是通过服务器破坏、内部攻击还是模型反转技术，他们都可以构建白盒对抗性攻击来操纵模型的分类结果，从而给依赖这些模型来执行关键任务的组织带来重大风险。模型所有者需要机制来保护自己免受此类损失，而无需获取新的训练数据，这一过程通常需要大量的时间和资本投资。在本文中，我们探讨了在不获取新的训练数据或更改模型架构的情况下生成具有不同攻击属性的模型的多个版本的可行性。模型所有者可以一次部署一个版本，并立即用新版本替换泄漏的版本。新部署的模型版本可以抵御利用白盒访问一个或所有先前泄露的版本而产生的对抗性攻击。我们从理论上证明，这可以通过将参数化隐藏分布合并到模型训练数据中来实现，迫使模型学习由所选数据唯一定义的与任务无关的特征。此外，隐藏分布的最佳选择可以产生一系列模型版本，能够随着时间的推移抵抗复合可转移性攻击。利用我们的分析见解，我们设计并实现了一种适用于 DNN 分类器的实用模型版本控制方法，这使得现有方法的鲁棒性得到了显着提高。我们相信，我们的工作为保护 DNN 服务超出其初始部署提供了一个有希望的方向。
As the deployment of deep learning models continues to expand across industries, the threat of malicious incursions aimed at gaining access to these deployed models is on the rise. Should an attacker gain access to a deployed model, whether through server breaches, insider attacks, or model inversion techniques, they can then construct white-box adversarial attacks to manipulate the model’s classification outcomes, thereby posing significant risks to organizations that rely on these models for critical tasks. Model owners need mechanisms to protect themselves against such losses without the necessity of acquiring fresh training data - a process that typically demands substantial investments in time and capital.In this paper, we explore the feasibility of generating multiple versions of a model that possess different attack properties, without acquiring new training data or changing model architecture. The model owner can deploy one version at a time and replace a leaked version immediately with a new version. The newly deployed model version can resist adversarial attacks generated leveraging white-box access to one or all previously leaked versions. We show theoretically that this can be accomplished by incorporating parameterized hidden distributions into the model training data, forcing the model to learn task-irrelevant features uniquely defined by the chosen data. Additionally, optimal choices of hidden distributions can produce a sequence of model versions capable of resisting compound transferability attacks over time. Leveraging our analytical insights, we design and implement a practical model versioning method for DNN classifiers, which leads to significant robustness improvements over existing methods. We believe our work presents a promising direction for safeguarding DNN services beyond their initial deployment.