Abstract:DNN is presenting human-level performance for many complex intelligent tasks in real-world applications. However, it also introduces ever-increasing security concerns. For example, the emerging adversarial attacks indicate that even very small and often imperceptible adversarial input perturbations can easily mislead the cognitive function of deep learning systems (DLS). Existing DNN adversarial studies are narrowly performed on the ideal software-level DNN models with a focus on single uncertainty factor, i.e. input perturbations, however, the impact of DNN model reshaping on adversarial attacks, which is introduced by various hardware-favorable techniques such as hash-based weight compression during modern DNN hardware implementation, has never been discussed. In this work, we for the first time investigate the multi-factor adversarial attack problem in practical model optimized deep learning systems by jointly considering the DNN model-reshaping (e.g. HashNet based deep compression) and the input perturbations. We first augment adversarial example generating method dedicated to the compressed DNN models by incorporating the software-based approaches and mathematical modeled DNN reshaping. We then conduct a comprehensive robustness and vulnerability analysis of deep compressed DNN models under derived adversarial attacks. A defense technique named "gradient inhibition" is further developed to ease the generating of adversarial examples thus to effectively mitigate adversarial attacks towards both software and hardware-oriented DNNs. Simulation results show that "gradient inhibition" can decrease the average success rate of adversarial attacks from 87.99% to 4.77% (from 86.74% to 4.64%) on MNIST (CIFAR-10) benchmark with marginal accuracy degradation across various DNNs.

Exploring DNN Robustness Against Adversarial Attacks Using Approximate Multipliers

Towards Robust DNNs: an Taylor Expansion-Based Method for Generating Powerful Adversarial Examples.

Adversarial robustness improvement for deep neural networks

Leveraging Highly Approximated Multipliers in DNN Inference

ApproxDNNFlow: an Evaluation and Exploration Framework for DNNs with Approximate Multipliers

Improving Query Efficiency of Black-box Adversarial Attack

Robust Adversarial Attacks on Imperfect Deep Neural Networks in Fault Classification

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

A Tale of Two Approximations: Tightening Over-Approximation for DNN Robustness Verification Via Under-Approximation.

Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networks

Not So Robust After All: Evaluating the Robustness of Deep Neural Networks to Unseen Adversarial Attacks

Improving Adversarial Robustness via Mutual Information Estimation

An Optimized Transfer Attack Framework Towards Multi-Modal Machine Learning

Enhance DNN Adversarial Robustness and Efficiency via Injecting Noise to Non-Essential Neurons

Mitigating Adversarial Attacks for Deep Neural Networks by Input Deformation and Augmentation

An ADMM-Based Universal Framework for Adversarial Attacks on Deep Neural Networks

Security Analysis and Enhancement of Model Compressed Deep Learning Systems under Adversarial Attacks

A Framework for Robust Deep Learning Models Against Adversarial Attacks Based on a Protection Layer Approach

Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks

A CMA-ES-Based Adversarial Attack on Black-Box Deep Neural Networks

Multi-scale Features Destructive Universal Adversarial Perturbations