Abstract:Due to their low latency and high privacy preservation, there is currently a burgeoning demand for deploying deep learning (DL) models on ubiquitous edge Internet of Things (IoT) devices. However, DL models are often large in size and require large-scale computation, which prevents them from being placed directly onto IoT devices, where resources are constrained, and 32-bit floating-point (float-32) operations are unavailable. Commercial framework (i.e., a set of toolkits) empowered model quantization is a pragmatic solution that enables DL deployment on mobile devices and embedded systems by effortlessly post-quantizing a large high-precision model (e.g., float-32) into a small low-precision model (e.g., int-8) while retaining the model inference accuracy. However, their usability might be threatened by security vulnerabilities. This work reveals that standard quantization toolkits can be abused to activate a backdoor. We demonstrate that a full-precision backdoored model which does not have any backdoor effect in the presence of a trigger—as the backdoor is dormant—can be activated by (i) TensorFlow-Lite (TFLite) quantization, the only product-ready quantization framework to date, and (ii) the beta released PyTorch Mobile framework. In our experiments, we employ three popular model architectures (VGG16, ResNet18, and ResNet50), and train each across three popular datasets: MNIST, CIFAR10 and GTSRB. We ascertain that all trained float-32 backdoored models exhibit no backdoor effect even in the presence of trigger inputs . Particularly, four influential backdoor defenses are evaluated, and they fail to identify a backdoor in the float-32 models. When each of the float-32 models is converted into an int-8 format model through the standard TFLite or PyTorch Mobile framework's post-training quantization, the backdoor is activated in the quantized model, which shows a stable attack success rate close to 100% upon inputs with the trigger, while it usually behaves upon non-trigger inputs. This work highlights that a stealthy security threat occurs when an end-user utilizes the on-device post-training model quantization frameworks, informing security researchers of a cross-platform overhaul of DL models post-quantization even if these models pass security-aware front-end backdoor inspections. Significantly, we have identified Gaussian noise injection into the malicious full-precision model as an easy-to-use preventative defense against the PQ backdoor. The attack source code is released at https://github.com/quantization-backdoor .

Deep Neural Network Quantization Framework for Effective Defense against Membership Inference Attacks

Hessian-based Mixed-Precision Quantization with Transition Aware Training for Neural Networks

Defensive Quantization: When Efficiency Meets Robustness

Quantization Backdoors to Deep Learning Commercial Frameworks

Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training

Double-Win Quant: Aggressively Winning Robustness of Quantized Deep Neural Networks Via Random Precision Training and Inference

Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networks

FPGA Adaptive Neural Network Quantization for Adversarial Image Attack Defense

A White Paper on Neural Network Quantization

Towards Robustness Evaluation of Backdoor Defense on Quantized Deep Learning Models

Error-Silenced Quantization: Bridging Robustness and Compactness

Saliency Assisted Quantization for Neural Networks

Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks

Understanding and defending against White-box membership inference attack in deep learning

Adaptive Quantization for Deep Neural Network

Membership reconstruction attack in deep neural networks

Scalable Membership Inference Attacks via Quantile Regression

Towards Low-Bit Quantization of Deep Neural Networks with Limited Data.

Integer Quantization for Deep Learning Inference: Principles and Empirical Evaluation

Understanding the Threats of Trojaned Quantized Neural Network in Model Supply Chains.

Quantization-aware Neural Architectural Search for Intrusion Detection