Security and Privacy Issues in Deep Learning

Abstract

To promote secure and private artificial intelligence (SPAI), we review studies on the model security and data privacy of DNNs. Model security allows system to behave as intended without being affected by malicious external influences that can compromise its integrity and efficiency. Security attacks can be divided based on when they occur: if an attack occurs during training, it is known as a poisoning attack, and if it occurs during inference (after training) it is termed an evasion attack. Poisoning attacks compromise the training process by corrupting the data with malicious examples, while evasion attacks use adversarial examples to disrupt entire classification process. Defenses proposed against such attacks include techniques to recognize and remove malicious data, train a model to be insensitive to such data, and mask the model's structure and parameters to render attacks more challenging to implement. Furthermore, the privacy of the data involved in model training is also threatened by attacks such as the model-inversion attack, or by dishonest service providers of AI applications. To maintain data privacy, several solutions that combine existing data-privacy techniques have been proposed, including differential privacy and modern cryptography techniques. In this paper, we describe the notions of some of methods, e.g., homomorphic encryption, and review their advantages and challenges when implemented in deep-learning models.

References in corpus (82)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Distilling the Knowledge in a Neural Network
• Deep Learning with Differential Privacy
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Learning Important Features Through Propagating Activation Differences
• Ensemble Adversarial Training: Attacks and Defenses
• Binarized Neural Networks: Training Deep Neural Networks with Weights and Activations Constrained to +1 or -1
• Conditional Image Synthesis With Auxiliary Classifier GANs
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Deep EHR: A Survey of Recent Advances in Deep Learning Techniques for Electronic Health Record (EHR) Analysis
• Federated Optimization: Distributed Machine Learning for On-Device Intelligence
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Pixel Recurrent Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Understanding Black-box Predictions via Influence Functions
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Theoretically Principled Trade-off between Robustness and Accuracy
• Learning Differentially Private Recurrent Language Models
• Poisoning Attacks against Support Vector Machines
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Synthesizing Robust Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Domain Adaptation: Learning Bounds and Algorithms
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Generating Natural Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Spectral Signatures in Backdoor Attacks
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• A generic framework for privacy preserving deep learning
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Scalable Private Learning with PATE
• Differentially Private Generative Adversarial Network
• CryptoDL: Deep Neural Networks over Encrypted Data
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Algorithms that Remember: Model Inversion Attacks and Data Protection Law
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Spatially Transformed Adversarial Examples
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• On Detecting Adversarial Perturbations
• Adversarial Robustness through Local Linearization
• Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
• Efficient Formal Safety Analysis of Neural Networks
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Simple Black-box Adversarial Attacks
• Generative Poisoning Attack Method Against Neural Networks
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Faster CryptoNets: Leveraging Sparsity for Real-World Encrypted Inference
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• Adversarial Attacks Against Medical Deep Learning Systems
• Provably Minimally-Distorted Adversarial Examples
• Functional Adversarial Attacks
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Accurate, reliable and fast robustness evaluation
• Towards Measuring Membership Privacy
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• TAPAS: Tricks to Accelerate (encrypted) Prediction As a Service
• Stealing Hyperparameters in Machine Learning
• Chameleon: A Hybrid Secure Computation Framework for Machine Learning Applications
• Boosting Adversarial Attacks with Momentum
• Poisoning Attacks with Generative Adversarial Nets
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Label-Consistent Backdoor Attacks
• Generating Artificial Data for Private Deep Learning
• Adversary A3C for Robust Reinforcement Learning
• Assessing Threat of Adversarial Examples on Deep Neural Networks
• Adaptive Laplace Mechanism: Differential Privacy Preservation in Deep Learning
• Auditing Data Provenance in Text-Generation Models
• Training Augmentation with Adversarial Examples for Robust Speech Recognition
• Differentially Private Variational Dropout

Cited by in corpus (9)

• An Overview of Federated Learning at the Edge and Distributed Ledger Technologies for Robotic and Autonomous Systems
• Free-riders in Federated Learning: Attacks and Defenses
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Towards Security Threats of Deep Learning Systems: A Survey
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Efficient Privacy Preserving Edge Computing Framework for Image Classification
• Identifying Risk of Opioid Use Disorder for Patients Taking Opioid Medications with Deep Learning
• AnomiGAN: Generative adversarial networks for anonymizing private medical data
• SLSGD: Secure and Efficient Distributed On-device Machine Learning