Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation
Abstract In recent years, classification techniques based on deep neural networks (DNN) were widely used in many fields such as computer vision, natural language processing, and self-driving cars. However, the vulnerability of the DNN-based classification systems to adversarial attacks questions the...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
SpringerOpen
2020-06-01
|
| Series: | EURASIP Journal on Information Security |
| Subjects: | |
| Online Access: | http://link.springer.com/article/10.1186/s13635-020-00106-x |
| _version_ | 1819073345583316992 |
|---|---|
| author | Olga Taran Shideh Rezaeifar Taras Holotyak Slava Voloshynovskiy |
| author_facet | Olga Taran Shideh Rezaeifar Taras Holotyak Slava Voloshynovskiy |
| author_sort | Olga Taran |
| collection | DOAJ |
| description | Abstract In recent years, classification techniques based on deep neural networks (DNN) were widely used in many fields such as computer vision, natural language processing, and self-driving cars. However, the vulnerability of the DNN-based classification systems to adversarial attacks questions their usage in many critical applications. Therefore, the development of robust DNN-based classifiers is a critical point for the future deployment of these methods. Not less important issue is understanding of the mechanisms behind this vulnerability. Additionally, it is not completely clear how to link machine learning with cryptography to create an information advantage of the defender over the attacker. In this paper, we propose a key-based diversified aggregation (KDA) mechanism as a defense strategy in a gray- and black-box scenario. KDA assumes that the attacker (i) knows the architecture of classifier and the used defense strategy, (ii) has an access to the training data set, but (iii) does not know a secret key and does not have access to the internal states of the system. The robustness of the system is achieved by a specially designed key-based randomization. The proposed randomization prevents the gradients’ back propagation and restricts the attacker to create a “bypass” system. The randomization is performed simultaneously in several channels. Each channel introduces its own randomization in a special transform domain. The sharing of a secret key between the training and test stages creates an information advantage to the defender. Finally, the aggregation of soft outputs from each channel stabilizes the results and increases the reliability of the final score. The performed experimental evaluation demonstrates a high robustness and universality of the KDA against state-of-the-art gradient-based gray-box transferability attacks and the non-gradient-based black-box attacks (The results reported in this paper have been partially presented in CVPR 2019 (Taran et al., Defending against adversarial attacks by randomized diversification, 2019) & ICIP 2019 (Taran et al., Robustification of deep net classifiers by key-based diversified aggregation with pre-filtering, 2019)). |
| first_indexed | 2024-12-21T17:52:09Z |
| format | Article |
| id | doaj.art-a3d1cbf94f944c20a11b4cc382875a72 |
| institution | Directory Open Access Journal |
| issn | 2510-523X |
| language | English |
| last_indexed | 2024-12-21T17:52:09Z |
| publishDate | 2020-06-01 |
| publisher | SpringerOpen |
| record_format | Article |
| series | EURASIP Journal on Information Security |
| spelling | doaj.art-a3d1cbf94f944c20a11b4cc382875a722022-12-21T18:55:19ZengSpringerOpenEURASIP Journal on Information Security2510-523X2020-06-012020111810.1186/s13635-020-00106-xMachine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregationOlga Taran0Shideh Rezaeifar1Taras Holotyak2Slava Voloshynovskiy3Stochastic Information Processing Group, Department of Computer Science, University of GenevaStochastic Information Processing Group, Department of Computer Science, University of GenevaStochastic Information Processing Group, Department of Computer Science, University of GenevaStochastic Information Processing Group, Department of Computer Science, University of GenevaAbstract In recent years, classification techniques based on deep neural networks (DNN) were widely used in many fields such as computer vision, natural language processing, and self-driving cars. However, the vulnerability of the DNN-based classification systems to adversarial attacks questions their usage in many critical applications. Therefore, the development of robust DNN-based classifiers is a critical point for the future deployment of these methods. Not less important issue is understanding of the mechanisms behind this vulnerability. Additionally, it is not completely clear how to link machine learning with cryptography to create an information advantage of the defender over the attacker. In this paper, we propose a key-based diversified aggregation (KDA) mechanism as a defense strategy in a gray- and black-box scenario. KDA assumes that the attacker (i) knows the architecture of classifier and the used defense strategy, (ii) has an access to the training data set, but (iii) does not know a secret key and does not have access to the internal states of the system. The robustness of the system is achieved by a specially designed key-based randomization. The proposed randomization prevents the gradients’ back propagation and restricts the attacker to create a “bypass” system. The randomization is performed simultaneously in several channels. Each channel introduces its own randomization in a special transform domain. The sharing of a secret key between the training and test stages creates an information advantage to the defender. Finally, the aggregation of soft outputs from each channel stabilizes the results and increases the reliability of the final score. The performed experimental evaluation demonstrates a high robustness and universality of the KDA against state-of-the-art gradient-based gray-box transferability attacks and the non-gradient-based black-box attacks (The results reported in this paper have been partially presented in CVPR 2019 (Taran et al., Defending against adversarial attacks by randomized diversification, 2019) & ICIP 2019 (Taran et al., Robustification of deep net classifiers by key-based diversified aggregation with pre-filtering, 2019)).http://link.springer.com/article/10.1186/s13635-020-00106-xAdversarial examplesDefenseRandomizationDiversified aggregationBlack-box attacksNon-gradient/gradient-based attacks |
| spellingShingle | Olga Taran Shideh Rezaeifar Taras Holotyak Slava Voloshynovskiy Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation EURASIP Journal on Information Security Adversarial examples Defense Randomization Diversified aggregation Black-box attacks Non-gradient/gradient-based attacks |
| title | Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation |
| title_full | Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation |
| title_fullStr | Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation |
| title_full_unstemmed | Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation |
| title_short | Machine learning through cryptographic glasses: combating adversarial attacks by key-based diversified aggregation |
| title_sort | machine learning through cryptographic glasses combating adversarial attacks by key based diversified aggregation |
| topic | Adversarial examples Defense Randomization Diversified aggregation Black-box attacks Non-gradient/gradient-based attacks |
| url | http://link.springer.com/article/10.1186/s13635-020-00106-x |
| work_keys_str_mv | AT olgataran machinelearningthroughcryptographicglassescombatingadversarialattacksbykeybaseddiversifiedaggregation AT shidehrezaeifar machinelearningthroughcryptographicglassescombatingadversarialattacksbykeybaseddiversifiedaggregation AT tarasholotyak machinelearningthroughcryptographicglassescombatingadversarialattacksbykeybaseddiversifiedaggregation AT slavavoloshynovskiy machinelearningthroughcryptographicglassescombatingadversarialattacksbykeybaseddiversifiedaggregation |