Sensitive-Sample Fingerprinting of Deep Neural Networks

He, Zecheng; Zhang, Tianwei; Lee, Ruby

doi:10.1109/cvpr.2019.00486

Cited by 58 publications

(70 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, we propose a general method for generating sensitive samples and use them to detect the completeness of the server's calculation results. We note that recent work [19], also designed an efficient way to generate sensitive samples against subtle attacks on the model's integrity. However, the way to generate sensitive samples in [19] is only for DL models that exclusively contain continuous activation functions.…”

Section: Verifiable Deep Learningmentioning

confidence: 99%

“…Deep learning(DL), as one of the promising emerging technologies, has penetrated all aspects of social life, such as face recognition [4,29], autopilot [19,63], and medical diagnosis [22,35,59]. To support automated services, many tech companies (such as Google, Microsoft, and Amazon) provide outsourced deep learning services, usually dubbed as Machine Learning as a Service (MLaaS) [24,60,63].…”

Section: Introductionmentioning

confidence: 99%

“…To address the above problems, several approaches have been proposed to mitigate privacy and security threats in DNNs [19,49,63]. For example, Ghodsi et al propose SafetyNets [63], the first approach for verifiable execution of DNNs on an untrusted cloud.…”

Section: Introductionmentioning

confidence: 99%

“…However, these approaches mainly focus on the integrity (or correctness) of DNNs computations, which can hardly detect subtle attacks on the model's integrity. For example, in neural network trojan attacks [19], an adversary can slightly modify the model's parameters to make DNNs behave correctly for normal inputs, while misclassifying inputs containing a trigger predefined by the adversary. Moreover, most existing verifiable solutions [19,27,49] do not consider privacy-protection in the outsourcing inference process.…”

Section: Introductionmentioning

confidence: 99%

“…For example, in neural network trojan attacks [19], an adversary can slightly modify the model's parameters to make DNNs behave correctly for normal inputs, while misclassifying inputs containing a trigger predefined by the adversary. Moreover, most existing verifiable solutions [19,27,49] do not consider privacy-protection in the outsourcing inference process. That is, the user's private data, such as the model's parameters, query requests, and inference results are all disclosed to the server.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Secure and Verifiable Inference in Deep Neural Networks

Ren

et al. 2020

Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Section: Verifiable Deep Learningmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Secure and Verifiable Inference in Deep Neural Networks

Ren

et al. 2020

Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Detection of Compromised Models Using Bayesian Optimization

Kuttichira

Gupta

Nguyen

et al. 2019

AI 2019: Advances in Artificial Intelligence

View full text Add to dashboard Cite

Modern AI is largely driven by machine learning. Recent machine learning algorithms such as deep neural networks (DNN) have become quite effective in many recognition tasks e.g., object recognition, face recognition, speech recognition, etc. Due to their effectiveness, these models are already catering to user needs in the real world. To handle the service requests from large number of users and meet round the clock demand, these models are usually hosted on cloud platforms (e.g., Microsoft Azure ML Studio). When hosting a model on the cloud, there may be security concerns. For example, during the transit of the model to the cloud, a malicious third party can alter the model or sometimes the cloud provider itself may use a lossy compression on the model to efficiently manage the server resources. We propose a method to detect such model compromises via sensitive samples. Finding the best sensitive sample boils down to an optimization problem where the sensitive sample maximizes the difference in the prediction between the original and the modified model. The optimization problem is challenging as (1) the altered model is unknown (2) we have to search a sensitive sample in high-dimensional data space and (3) the optimization problem is a non-convex problem. To overcome these challenges, we first use a variational autoencoder to transform high-dimensional data to a non-linear low-dimensional space and then uses Bayesian optimization to find the optimal sensitive sample. Our proposed method is capable of generating a sensitive sample that can detect model compromise without incurring much cost by multiple queries.

show abstract

Verifying the Quality of Outsourced Training on Clouds

Wang

Liu

et al. 2022

Computer Security – ESORICS 2022

View full text Add to dashboard Cite

Sensitive-Sample Fingerprinting of Deep Neural Networks

Cited by 58 publications

References 12 publications

Secure and Verifiable Inference in Deep Neural Networks

Secure and Verifiable Inference in Deep Neural Networks

Detection of Compromised Models Using Bayesian Optimization

Verifying the Quality of Outsourced Training on Clouds

Contact Info

Product

Resources

About