SaTC: CORE: Medium: Digital Forensics for Deep Neural Networks

SaTC：核心：媒介：深度神经网络的数字取证

• 批准号: 2241303
• 负责人: Ben Zhao
• 金额: $ 121.6万
• 依托单位: University of Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-04-01 至 2027-03-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2241303&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Digital; Forensics

The vulnerability of Deep Neural Networks (DNNs) to adversarial attacks remains a major hurdle limiting their use in a wide range of safety-critical applications, such as self-driving cars, medical diagnosis, and financial market analysis. Existing research around adversarial robustness has developed a series of promising defenses, but these are generally broken shortly thereafter by stronger adaptive attacks. This seems unlikely to change, calling for complementary security efforts that increase the cost (in time and computing resources) for successful attacks, reduce the impact of attacks, and identify attackers and vulnerabilities following an attack. This project targets the final goal through developing attack forensics methods to improve the robustness of deep learning systems. The project can alter the playing field between attackers and defenders, by expanding the defense toolset beyond attack prevention to include post-attack analysis.The project will consider three main avenues of attacks on DNNs. The first focuses on analyzing training time poisoning attacks, using clustering and machine unlearning-inspired methods to identify poisoned samples and developing model training methods that trace training provenance to support later forensics. The second focuses on inference time attacks while models are in use, through developing variations of target models that include additional data; the additional data is chosen to maintain accuracy while allowing defenders to make inferences about the models being used to generate attacks. The third focuses on identifying new vulnerabilities arising from neural synthesis models used to generate images, text, and other content, characterizing the space of possible goals attackers might have and methods they might use to poison these models. The project team will also work with industry partners to ground the work and increase the chance of it transferring into real systems, as well as with their department's efforts to increase the number and diversity of people doing research around cybersecurity.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

深度神经网络（DNN）对对抗性攻击的脆弱性仍然是限制其在广泛的安全关键应用中使用的主要障碍，例如自动驾驶汽车，医疗诊断和金融市场分析。围绕对抗鲁棒性的现有研究已经开发了一系列有前途的防御，但这些防御通常很快就会被更强的自适应攻击所打破。这似乎不太可能改变，需要补充安全措施，增加成功攻击的成本（时间和计算资源），减少攻击的影响，并在攻击后识别攻击者和漏洞。该项目的最终目标是通过开发攻击取证方法来提高深度学习系统的健壮性。该项目可以改变攻击者和防御者之间的竞争环境，通过将防御工具集扩展到攻击预防之外，包括攻击后分析。该项目将考虑DNN上的三种主要攻击途径。 第一个重点是分析训练时间中毒攻击，使用集群和机器非学习启发的方法来识别中毒样本，并开发跟踪训练来源的模型训练方法以支持后续取证。第二个重点是在模型使用时的推理时间攻击，通过开发包含额外数据的目标模型的变体;选择额外数据以保持准确性，同时允许防御者对用于生成攻击的模型进行推理。第三个重点是识别用于生成图像、文本和其他内容的神经合成模型所产生的新漏洞，描述攻击者可能拥有的目标空间以及他们可能用来毒害这些模型的方法。该项目团队还将与行业合作伙伴合作，为工作打下基础，增加将其转化为真实的系统的机会，并与他们的部门合作，增加围绕网络安全进行研究的人员的数量和多样性。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Towards Scalable and Robust Model Versioning

• DOI: 10.1109/satml59370.2024.00036
• 发表时间: 2024-01
• 期刊: 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)
• 作者: Wenxin Ding;A. Bhagoji;Ben Y. Zhao;Haitao Zheng

Towards a General Video-based Keystroke Inference Attack

• 发表时间: 2023
• 作者: Zhuolin Yang;Yuxin Chen;Zain Sarwar;Hadleigh Schwartz;Ben Y. Zhao;Haitao Zheng

"My face, my rules": Enabling Personalized Protection Against Unacceptable Face Editing

• DOI: 10.56553/popets-2023-0080
• 发表时间: 2023-07
• 期刊: Proc. Priv. Enhancing Technol.
• 作者: Zhujun Xiao;Jenna Cryan;Yuanshun Yao;Yi Hong Gordon Cheo;Yuanchao Shu;S. Saroiu;Ben Y. Zhao;Haitao Zheng

Characterizing the Optimal 0-1 Loss for Multi-class Classification with a Test-time Attacker

• DOI: 10.48550/arxiv.2302.10722
• 发表时间: 2023-02
• 期刊: ArXiv
• 作者: Sihui Dai;Wen-Luan Ding;A. Bhagoji;Daniel Cullina;Ben Y. Zhao;Haitao Zheng;Prateek Mittal

GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models

• DOI: 10.48550/arxiv.2302.04222
• 发表时间: 2023-02
• 作者: Shawn Shan;Jenna Cryan;Emily Wenger;Haitao Zheng;Rana Hanocka;Ben Y. Zhao