Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
Deep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-04-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/8/3725 |
| _version_ | 1797437061626593280 |
|---|---|
| author | Xabier Echeberria-Barrio Amaia Gil-Lerchundi Raul Orduna-Urrutia Iñigo Mendialdua |
| author_facet | Xabier Echeberria-Barrio Amaia Gil-Lerchundi Raul Orduna-Urrutia Iñigo Mendialdua |
| author_sort | Xabier Echeberria-Barrio |
| collection | DOAJ |
| description | Deep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering a long list of threats from which every model should be defended. The weight modification attack is presented and discussed among researchers, who have presented several versions and analyses about such a threat. It focuses on detecting multiple vulnerable weights to modify, misclassifying the desired input data. Therefore, analysis of the different approaches to this attack helps understand how to defend against such a vulnerability. This work presents a new version of the weight modification attack. Our approach is based on three processes: input data clusterization, weight selection, and modification of the weights. Data clusterization allows a directed attack to a selected class. Weight selection uses the gradient given by the input data to identify the most-vulnerable parameters. The modifications are incorporated in each step via limited noise. Finally, this paper shows how this new version of fault injection attack is capable of misclassifying the desired cluster completely, converting the 100% accuracy of the targeted cluster to 0–2.7% accuracy, while the rest of the data continues being well-classified. Therefore, it demonstrates that this attack is a real threat to neural networks. |
| first_indexed | 2024-03-09T11:13:33Z |
| format | Article |
| id | doaj.art-fce5c9fc822f43dcb36716867f4e5a88 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T11:13:33Z |
| publishDate | 2022-04-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-fce5c9fc822f43dcb36716867f4e5a882023-12-01T00:37:25ZengMDPI AGApplied Sciences2076-34172022-04-01128372510.3390/app12083725Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning ModelsXabier Echeberria-Barrio0Amaia Gil-Lerchundi1Raul Orduna-Urrutia2Iñigo Mendialdua3Vicomtech Foundation, Basque Research and Technology Alliance (BRTA), Mikeletegi 57, 20009 Donostia-San Sebastián, SpainVicomtech Foundation, Basque Research and Technology Alliance (BRTA), Mikeletegi 57, 20009 Donostia-San Sebastián, SpainVicomtech Foundation, Basque Research and Technology Alliance (BRTA), Mikeletegi 57, 20009 Donostia-San Sebastián, SpainDepartment of Computer Languages and Systems, University of the Basque Country (UPV/EHU), 20018 Donostia-San Sebastián, SpainDeep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering a long list of threats from which every model should be defended. The weight modification attack is presented and discussed among researchers, who have presented several versions and analyses about such a threat. It focuses on detecting multiple vulnerable weights to modify, misclassifying the desired input data. Therefore, analysis of the different approaches to this attack helps understand how to defend against such a vulnerability. This work presents a new version of the weight modification attack. Our approach is based on three processes: input data clusterization, weight selection, and modification of the weights. Data clusterization allows a directed attack to a selected class. Weight selection uses the gradient given by the input data to identify the most-vulnerable parameters. The modifications are incorporated in each step via limited noise. Finally, this paper shows how this new version of fault injection attack is capable of misclassifying the desired cluster completely, converting the 100% accuracy of the targeted cluster to 0–2.7% accuracy, while the rest of the data continues being well-classified. Therefore, it demonstrates that this attack is a real threat to neural networks.https://www.mdpi.com/2076-3417/12/8/3725deep learning vulnerabilitiesdeep learning attacksdeep learning threats |
| spellingShingle | Xabier Echeberria-Barrio Amaia Gil-Lerchundi Raul Orduna-Urrutia Iñigo Mendialdua Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models Applied Sciences deep learning vulnerabilities deep learning attacks deep learning threats |
| title | Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models |
| title_full | Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models |
| title_fullStr | Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models |
| title_full_unstemmed | Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models |
| title_short | Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models |
| title_sort | optimized parameter search approach for weight modification attack targeting deep learning models |
| topic | deep learning vulnerabilities deep learning attacks deep learning threats |
| url | https://www.mdpi.com/2076-3417/12/8/3725 |
| work_keys_str_mv | AT xabierecheberriabarrio optimizedparametersearchapproachforweightmodificationattacktargetingdeeplearningmodels AT amaiagillerchundi optimizedparametersearchapproachforweightmodificationattacktargetingdeeplearningmodels AT raulordunaurrutia optimizedparametersearchapproachforweightmodificationattacktargetingdeeplearningmodels AT inigomendialdua optimizedparametersearchapproachforweightmodificationattacktargetingdeeplearningmodels |