A Protection against the Extraction of Neural Network Models

2020/05/26 by Chabanne, Hervé, Despiegel, Vincent, Guiga, Linda
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · doi:10.48550/arxiv.2005.12782

Abstract

Given oracle access to a Neural Network (NN), it is possible to extract its underlying model. We here introduce a protection by adding parasitic layers which keep the underlying NN's predictions mostly unchanged while complexifying the task of reverse-engineering. Our countermeasure relies on approximating a noisy identity mapping with a Convolutional NN. We explain why the introduction of new parasitic layers complexifies the attacks. We report experiments regarding the performance and the accuracy of the protected NN.

Related

• Cryptanalytic Extraction of Neural Network Models
• High Accuracy and High Fidelity Extraction of Neural Networks
• Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks
• Towards Reverse-Engineering Black-Box Neural Networks
• Practical Defences Against Model Inversion Attacks for Split Neural Networks