Defend Bit-Flip Attacks with ModelShield Framework Extension
Explore ModelShield, a generic and portable framework extension designed to defend against bit-flip-based adversarial weight attacks in deep neural networks. Learn about the protection mechanism, performance optimization, and results achieved in enhancing DNN security and integrity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
ModelShield: A Generic and Portable Framework Extension for Defending Bit-Flip based Adversarial Weight Attacks Yanan Guo1, Liang Liu1, Yueqiang Cheng2, Youtao Zhang1, Jun Yang1 1University of Pittsburgh 2NIO Security Group
Defend Bit Flip Attack Hardware Modification High overhead. Takes a time long to verify and deploy the defense. Increase DNN s robustness Can only makes bit flip attack harder but not impossible. Baseline: Modifying 28 weights can make ResNet-20 malfunction. Binarization-aware training: Modifying >500 weights can make ResNet-20 malfunction. Requirements Easy implementation. Compatible with current frameworks. Negligible performance overhead.
ModelShield Protect the integrity of the DNN weights Pre-calculate a hash of the weights in each layer. Use a cryptographic non-keyed hash. Store the hash together with weights in memory. Real-time hash verification. Verify the hash after the inference completes, before sending user the results. Problems What if the attacker change the weights back after inference? What if the attacker modify the weights and hashes together? Answers Hash values are diffused and random. Rowhammer attackers can only perform one-direction flip in a memory row.
Performance Optimization Use high-performance non-cryptographic hash Software hash tree
Results Performance Security
