Block-Wise Image Transformation With Secret Key for Adversarially Robust Defense

A protection method of trained CNN model with a secret key from unauthorized access

“…3. The three transformations (SHF, NP, and FFX) were confirmed to have different performances in terms of classification accuracy and key estimation attack in [12, 13], so these transformations are compared again under model protection in this paper. In particular, parameter affects the classification accuracy and resistance to key estimation attacks.…”

“…LIE is to perceptually encrypt images to mainly protect visual information on plain images while maintaining the network ability to learn the encrypted ones for classification tasks. Conventional LIE methods are classified into two classes in terms of application: LIE for privacy-preserving deep learning [15, 16, 18, 25–28] and LIE for adversarial robustness [12, 13].…”

“…LIE methods for adversarial defenses [12, 13] have three requirements: a high classification accuracy, robustness against adversarial attacks, and resistance to key estimation attacks. The methods in this class do not aim to protect the visual information of plain images.…”

“…We adopt the methods in [12, 13] for a new application, model protection, for the first time. The proposed model protection method is carried out on the basis of LIE methods for adversarial defenses [12, 13], but hyperparameters are carefully tuned for model protection purposes. LIE methods have never been applied to model protection applications.…”

“…Recently, a key-based adversarial defense was proposed to combat adversarial examples [12, 13], which was in turn inspired by perceptual image encryption methods, which were proposed for privacy-preserving machine learning [14] and encryption-then-compression systems [15–21]. The uniqueness of the key for the model in [12, 13] motivated us to use a key-based transformation technique for model protection.…”