Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
复制标题
DOI：
10.1145/3548606.3560561
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Shawn Shan;Wen-Luan Ding;Emily Wenger;Haitao Zheng;Ben Y. Zhao
中科院分区：
文献类型：
--
作者：
Shawn Shan;Wen-Luan Ding;Emily Wenger;Haitao Zheng;Ben Y. Zhao
服务器漏洞是当今互联网上不幸的现实。在深度神经网络（DNN）模型的背景下，它们特别有害，因为泄漏的模型使攻击者“白色框”可以访问“访问对抗性”的示例，这种威胁模型没有实际的强大防御能力。对于那些已经投资了多年和数百万美元的从业人员，将其投入到专有的DNN上，例如医学成像，这似乎是灾难的灾难，这是一个不利的灾难 - 在这个问题上，这是一个不利的灾难 - 在这方面涉足这个问题。 DNN模型的恢复。 Neo能够以非常高的精度从泄漏的模型中滤除攻击，并为反复违反服务器的攻击者提供强有力的保护（7--10个回收率）。 Neo在各种强烈的适应性攻击方面表现良好，略有损坏的漏洞可追回，并证明了对野外DNN防御的补充的潜力。
Server breaches are an unfortunate reality on today's Internet. In the context of deep neural network (DNN) models, they are particularly harmful, because a leaked model gives an attacker "white-box'' access to generate adversarial examples, a threat model that has no practical robust defenses. For practitioners who have invested years and millions into proprietary DNNs, e.g. medical imaging, this seems like an inevitable disaster looming on the horizon. In this paper, we consider the problem of post-breach recovery for DNN models. We propose Neo, a new system that creates new versions of leaked models, alongside an inference time filter that detects and removes adversarial examples generated on previously leaked models. The classification surfaces of different model versions are slightly offset (by introducing hidden distributions), and Neo detects the overfitting of attacks to the leaked model used in its generation. We show that across a variety of tasks and attack methods, Neo is able to filter out attacks from leaked models with very high accuracy, and provides strong protection (7--10 recoveries) against attackers who repeatedly breach the server. Neo performs well against a variety of strong adaptive attacks, dropping slightly in # of breaches recoverable, and demonstrates potential as a complement to DNN defenses in the wild.