Boosting Robustness of Deep Neural Networks against Sparsity-aware Adversarial Attacks

深度神经网络（dnn）是我们这个时代最突出的技术之一，因为它们在广泛的现实世界应用中实现了最先进的性能。尽管深度神经网络取得了成功，但它们很容易受到对抗性攻击。已经证明，精心设计的输入扰动可以欺骗训练良好的dnn。这在网上银行或自动驾驶等对安全敏感的应用中引起了严重的担忧。在存在恶意攻击的情况下，dnn不能正常工作可能会导致严重的后果，如身份盗窃、经济损失，甚至危及人类生命。在这个研究项目中，我们专注于一种新型的对抗性攻击，其目标是dnn的能量和延迟，而不是它们的准确性。在过去的几年里，深度神经网络被部署到移动设备中。移动设备的电力预算有限，因为它们大多依靠电池运行。因此，保护dnn免受能量感知的对抗性攻击对于移动计算的成功至关重要。利用深度神经网络中的稀疏值已经成为一种有效的技术，可以在资源受限的应用中提高机器学习算法的能效。减少稀疏性可以增加深度神经网络的能量和执行时间。尽管在过去几年中，dnn防御对抗性攻击方面取得了重大进展，但目前还没有解决方案来保护dnn免受那些基于稀疏性的目标能量攻击。为了保护DNN免受这些类型的攻击，我们建议使用放电神经元与DNN做出的预测之间的相关性。DNN中的每组神经元负责检测输入中的特定特征。通过监测推理阶段的放电神经元，我们可以检测到那些针对给定类别被恶意激活的神经元。该项目的成果将有助于加拿大高科技产业检测和阻止影响计算系统能耗的恶意攻击。此外，通过该项目培训的高素质人才将获得强大的深度神经网络领域的宝贵经验，这反过来将帮助加拿大高科技公司，并将使他们在强大的计算领域具有优势。

Deep neural networks (DNNs) are one of the most prominent technologies of our time, as they achieve state-of-the-art performance in a wide range of real-world applications. Despite the success of DNNs, they are vulnerable to adversarial attacks. It has been shown that carefully crafted input perturbations can fool well-trained DNNs. This causes serious concerns in security-sensitive applications such as online banking or autonomous driving. Failure of DNNs to function correctly in the presence of malicious attacks can result in severe consequences such as identity theft, financial losses, and even endangering human lives. In this research project, we focus on a new type of adversarial attack that targets energy and latency of DNNs rather than their accuracy. Over the last few years, DNNs were deployed into mobile devices. Mobile devices have limited power budget as they mostly operate on battery. As a result, defending DNNs against energy-aware adversarial attacks is crucial for success of mobile computing. Exploiting sparse values in DNNs has emerged as an effective technique to improve energy-efficiency of machine learning algorithms in resource-constrained applications. Reducing sparsity increases energy and execution time of DNNs. Despite of significant advancement in defence of DNNs against adversarial attacks over the last few years, there is no solution to defend DNNs against those attacks that target energy based on sparsity. To protect DNNs against these types of attacks, we propose to use the correlation between firing neurons and predictions made by a DNN. Each set of neurons in a DNN are responsible for detecting a specific feature in an input. By monitoring the firing neurons during the inference phase, we can detect those neurons that are activated maliciously for a given class. The outcome of this project will help Canadian high-tech industry to detect and disable malicious attacks that impact energy consumption of computing systems. In addition, highly-qualified personnel that will be trained through this program will gain valuable experience in the area of robust DNNs which in turn will help Canadian high-tech companies and will give them edge in the area of robust computing.