Towards Security Threats of Deep Learning Systems: A Survey
arXiv:1911.12562
Abstract
Deep learning has gained tremendous success and great popularity in the past few years. However, deep learning systems are suffering several inherent weaknesses, which can threaten the security of learning models. Deep learning's wide use further magnifies the impact and consequences. To this end, lots of research has been conducted with the purpose of exhaustively identifying intrinsic weaknesses and subsequently proposing feasible mitigation. Yet few are clear about how these weaknesses are incurred and how effective these attack approaches are in assaulting deep learning. In order to unveil the security weaknesses and aid in the development of a robust deep learning system, we undertake an investigation on attacks towards deep learning, and analyze these attacks to conclude some findings in multiple views. In particular, we focus on four types of attacks associated with security threats of deep learning: model extraction attack, model inversion attack, poisoning attack and adversarial attack. For each type of attack, we construct its essential workflow as well as adversary capabilities and attack goals. Pivot metrics are devised for comparing the attack approaches, by which we perform quantitative and qualitative analyses. From the analysis, we have identified significant and indispensable factors in an attack vector, e.g., how to reduce queries to target models, what distance should be used for measuring perturbation. We shed light on 18 findings covering these approaches' merits and demerits, success probability, deployment complexity and prospects. Moreover, we discuss other potential security weaknesses and possible mitigation which can inspire relevant research in this area.
arXiv comment28 pages, 6 figures
References in corpus (62)
- Deep Learning with Differential Privacy
- Ensemble Adversarial Training: Attacks and Defenses
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- How To Backdoor Federated Learning
- Poisoning Attacks against Support Vector Machines
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Fast is better than free: Revisiting adversarial training
- Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
- Guiding Deep Learning System Testing using Surprise Adequacy
- The Space of Transferable Adversarial Examples
- Can You Really Backdoor Federated Learning?
- Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
- DLFuzz: Differential Fuzzing Testing of Deep Learning Systems
- Is feature selection secure against training data poisoning?
- Formal Security Analysis of Neural Networks using Symbolic Intervals
- Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
- Learning with a Strong Adversary
- Algorithms that Remember: Model Inversion Attacks and Data Protection Law
- Exploring the Landscape of Spatial Robustness
- Support Vector Machines under Adversarial Label Contamination
- Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition
- Robust Audio Adversarial Example for a Physical Attack
- Adversarial Attacks on Node Embeddings via Graph Poisoning
- Understanding Membership Inferences on Well-Generalized Learning Models
- Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
- Adversarial examples from computational constraints
- Towards Proving the Adversarial Robustness of Deep Neural Networks
- White-box vs Black-box: Bayes Optimal Strategies for Membership Inference
- Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
- Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
- Black-Box Attacks against RNN based Malware Detection Algorithms
- Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
- Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustness
- Towards Demystifying Membership Inference Attacks
- Cross-Domain Transferability of Adversarial Perturbations
- Efficient Deep Learning on Multi-Source Private Data
- Adversarial Attacks on Neural Network Policies
- Unrestricted Adversarial Examples via Semantic Manipulation
- Privacy-preserving Machine Learning through Data Obfuscation
- Defending Neural Backdoors via Generative Distribution Modeling
- Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
- Adversarial camera stickers: A physical camera-based attack on deep learning systems
- First-order Adversarial Vulnerability of Neural Networks and Input Dimension
- Security and Privacy Issues in Deep Learning
- On the Effectiveness of Defensive Distillation
- Improving Neural Language Modeling via Adversarial Training
- Data Poisoning Attacks against Online Learning
- Weight Poisoning Attacks on Pre-trained Models
- Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
- Robust Decision Trees Against Adversarial Examples
- Adversarial Deep Learning for Robust Detection of Binary Encoded Malware
- PRADA: Protecting against DNN Model Stealing Attacks
- Generalized No Free Lunch Theorem for Adversarial Robustness
- Private Empirical Risk Minimization Beyond the Worst Case: The Effect of the Constraint Set Geometry
- Data Poisoning Attacks on Stochastic Bandits
- A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning
- Defense against Universal Adversarial Perturbations
- Debugging Machine Learning Tasks
- Robust High Dimensional Sparse Regression and Matching Pursuit
- On Certifying Non-uniform Bound against Adversarial Attacks