EAGER: Invisible Shield: Can Compression Harden Deep Neural Networks Universally Against Adversarial Attacks?

深度神经网络(DNN)在图像识别、医疗诊断和自动驾驶汽车等领域得到了广泛的应用。然而，DNN面临着安全威胁：在DNN模型的训练过程中，通过在正常输入中添加人的不可察觉的扰动而产生的敌意输入会误导决策。由于攻击载体多、对手的策略和成本未知，防御对手攻击具有挑战性。该项目研究了一种基于压缩/解压缩的防御策略，以低成本和高精度保护DNN免受任何攻击。该项目旨在通过使用信号压缩，从根本不同的角度创建保护DNN的新范例，重点是将防御整合到输入和DNN模型的压缩中。研究任务包括：(I)开发视频/音频输入的防御性压缩，在不影响测试精度的情况下最大限度地提高防御效率；(Ii)开发防御性模型压缩，以及新的不涉及再训练的梯度掩蔽/混淆方法，以普遍强化DNN模型；以及(Iii)通过算法级模拟和现场平台实验进行攻防评估。这一迫切需要的项目的任何成功都将有助于研究对深度学习、硬件和网络安全以及多媒体感兴趣的社区。这个项目通过促进深度学习在现实系统中的更广泛应用来增加经济机会，并特别关注教育来自佛罗里达国际大学传统上代表性不足/服务不足群体的妇女和学生。项目储存库将存储在佛罗里达国际大学(http://web.eng.fiu.edu/wwen/).)的可公开访问的服务器上数据将在项目期结束后至少保存5年。这一奖励反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Deep neural networks (DNNs) are finding applications in wide-ranging applications such as image recognition, medical diagnosis and self-driving cars. However, DNNs suffer from a security threat: decisions can be misled by adversarial inputs crafted by adding human-imperceptible perturbations into normal inputs during training of DNN model. Defending against adversarial attacks is challenging due to multiple attack vectors, unknown adversary's strategies and cost. This project investigates a compression/decompression-based defense strategy to protect DNNs against any attack, with low cost and high accuracy. The project aims to create a new paradigm of safeguarding DNNs from a radically different perspective by using signal compression with a focus on integrating defenses into compression of the inputs and DNN models. The research tasks include: (i) developing defensive compression for visual/audio inputs to maximize defense efficiency without compromising testing accuracy; (ii) developing defensive model compression, and novel gradient masking/obfuscating methods without involving retraining, to universally harden DNN models; and (iii) conducting attack-defense evaluations through algorithm-level simulation and live platform experimentation.Any success from this EAGER project will be useful to research community interested in deep learning, hardware- and cyber- security, and multimedia. This project enhances economic opportunities by promoting wider applications of deep learning into realistic systems, and gives special attention to educating women and students from traditionally under-represented/under-served groups in Florida International University (FIU).The project repository will be stored on a publicly accessible server at FIU (http://web.eng.fiu.edu/wwen/). Data will be maintained for at least 5 years after the project period.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.