With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning
With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning
复制标题
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Bolun Wang;Yuanshun Yao;Bimal Viswanath;Haitao Zheng;Ben Y. Zhao
中科院分区：
文献类型：
--
作者：
Bolun Wang;Yuanshun Yao;Bimal Viswanath;Haitao Zheng;Ben Y. Zhao
迁移学习是一种强大的方法，允许用户通过从使用大型数据集（例如Google的InceptionV3）预训练的集中式（教师）模型中“学习”来快速构建准确的深度学习（学生）模型。我们假设，模型训练的集中化增加了它们对错误分类攻击的脆弱性，这些攻击利用了可公开访问的教师模型的知识。在本文中，我们描述了我们的努力，以了解和实验验证这种攻击的背景下，图像识别。我们确定了允许攻击者将学生模型与教师模型相关联的技术，并对黑盒学生模型发起高效的错误分类攻击。我们在野外广泛使用的教师模型上验证了这一点。最后，我们提出并评估了多种防御方法，包括一种神经元距离技术，它成功地防御了这些攻击，同时也模糊了教师和学生模型之间的联系。
Transfer learning is a powerful approach that allows users to quickly build accurate deep-learning (Student) models by “learning” from centralized (Teacher) models pretrained with large datasets, e.g. Google’s InceptionV3. We hypothesize that the centralization of model training increases their vulnerability to misclassification attacks leveraging knowledge of publicly ac-cessible Teacher models. In this paper, we describe our efforts to understand and experimentally validate such attacks in the context of image recognition. We identify techniques that allow attackers to associate Student models with their Teacher counterparts, and launch highly effective misclassification attacks on black-box Student models. We validate this on widely used Teacher models in the wild. Finally, we propose and evaluate multiple approaches for defense, including a neuron-distance technique that successfully defends against these attacks while also obfuscates the link between Teacher and Student models.