DEEPSEC: A Uniform Platform for Security Analysis of Deep Learning Model

Abstract

Deep learning (DL) models are inherently vulnerable to adversarial examples -maliciously crafted inputs to trigger target DL models to misbehave -which significantly hinders the application of DL in security-sensitive domains. Intensive research on adversarial learning has led to an arms race between adversaries and defenders. Such plethora of emerging attacks and defenses raise many questions: Which attacks are more evasive, preprocessing-proof, or transferable? Which defenses are more effective, utility-preserving, or general? Are ensembles of multiple defenses more robust than individuals? Yet, due to the lack of platforms for comprehensive evaluation on adversarial attacks and defenses, these critical questions remain largely unsolved.In this paper, we present the design, implementation, and evaluation of DEEPSEC, a uniform platform that aims to bridge this gap. In its current implementation, DEEPSEC incorporates 16 state-of-the-art attacks with 10 attack utility metrics, and 13 state-of-the-art defenses with 5 defensive utility metrics. To our best knowledge, DEEPSEC is the first platform that enables researchers and practitioners to (i) measure the vulnerability of DL models, (ii) evaluate the effectiveness of various attacks/defenses, and (iii) conduct comparative studies on attacks/defenses in a comprehensive and informative manner. Leveraging DEEPSEC, we systematically evaluate the existing adversarial attack and defense methods, and draw a set of key findings, which demonstrate DEEPSEC's rich functionality, such as (1) the trade-off between misclassification and imperceptibility is empirically confirmed;(2) most defenses that claim to be universally applicable can only defend against limited types of attacks under restricted settings;(3) it is not necessary that adversarial examples with higher perturbation magnitude are easier to be detected; (4) the ensemble of multiple defenses cannot improve the overall defense capability, but can improve the lower bound of the defense effectiveness of individuals. Extensive analysis on DEEPSEC demonstrates its capabilities and advantages as a benchmark platform which can benefit future adversarial learning research.

Correlations between deep neural network model coverage criteria and model quality

“…We then perform adversarial training using 1 , 2 , ... and , yielding 1 , 2 , ... and , respectively, just like fixing software bugs disclosed by new test inputs. Then we use existing methods [37] to measure model robustness and study the correlations between robustness and coverage. Ideally, we would expect to see these models have increasing levels of robustness.…”

“…They fall into three categories: model accuracy in the presence of adversarial examples, adversarial example impreceptiblity that measures if an adversarial example looks natural, and adversarial example robustness. These are the metrics commonly used by adversarial machine learning [37,39]. Details are explained in the subsections.…”

SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems

“…However, such models are inherently vulnerable to adversarial inputs, which are maliciously crafted samples (typically by adding human-imperceptible noise to legitimate samples) to trigger target models to misbehave [17,47]. Despite the plethora of work on the image domain [24,28,32,34,45,56] and text domain [30,31], the research of adversarial attacks on the audio domain is still limited, due to a number of non-trivial challenges. First, the acoustic systems need to deal with information changes in the time dimension, which is more complex than image classication systems.…”

A Tale of Evil Twins: Adversarial Inputs versus Poisoned Models

“…Another line of work attempts to improve DNN resilience against adversarial attacks by devising new training strategies (e.g., adversarial training) [22,28,39,49] or detection mechanisms [19,33,35,53]. However, the existing defenses are often penetrated or circumvented by even stronger attacks [2,30], resulting in a constant arms race between the attackers and defenders.…”