TESDA: Transform Enabled Statistical Detection of Attacks in Deep Neural Networks
arXiv:2110.08447
Abstract
Deep neural networks (DNNs) are now the de facto choice for computer vision tasks such as image classification. However, their complexity and "black box" nature often renders the systems they're deployed in vulnerable to a range of security threats. Successfully identifying such threats, especially in safety-critical real-world applications is thus of utmost importance, but still very much an open problem. We present TESDA, a low-overhead, flexible, and statistically grounded method for {online detection} of attacks by exploiting the discrepancies they cause in the distributions of intermediate layer features of DNNs. Unlike most prior work, we require neither dedicated hardware to run in real-time, nor the presence of a Trojan trigger to detect discrepancies in behavior. We empirically establish our method's usefulness and practicality across multiple architectures, datasets and diverse attacks, consistently achieving detection coverages of above 95% with operation count overheads as low as 1-2%.
arXiv comment10 pages, 2 reference pages, 2 appendix pages, 14 figures, 2 tables
References in corpus (6)
- PyTorch: An Imperative Style, High-Performance Deep Learning Library
- A Tutorial on Principal Component Analysis
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
- On the (Statistical) Detection of Adversarial Examples
- You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle