CNN Variant Deployment for Neural Trojan Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks, particularly convolutional neural networks (CNNs), are susceptible to stealthy attacks known as Neural Trojans, which can compromise the functionality of systems like self-driving vehicles by altering training data, making them difficult to detect and potentially spreading to other systems in an ecosystem.
Innovation Solution
Deploying a CNN as an ecosystem of structurally diverse but functionally equivalent variants through stochastic parameter mutation and delta-update techniques, amplifying the malicious impact of Neural Trojans to easily detectable levels, thereby preventing their spread and maintaining system functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If neural trojan backdoors are embedded in trained neural networks, then the networks can perform malicious actions under specific triggers, but the security and reliability of the networks are compromised
Solution Approach 1:
The patent applies preliminary action by training the neural network with adversarial examples and trigger patterns before deployment. The network is pre-hardened against trojan attacks through adversarial training, where malicious triggers and poisoned images are incorporated into the training dataset to teach the network to recognize and resist such attacks while maintaining normal functionality.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that analyzes the network's internal activations and decision pathways. This intermediary layer monitors whether trigger patterns are detected and validates that predictions are not solely driven by trigger presence, acting as a mediator between the potentially compromised network and the final output decision.
2Reliability
If traditional security measures are applied to neural networks, then security improvements may be achieved, but the computational overhead and processing time increase
Solution Approach 1:
The patent applies local quality by focusing security checks on specific critical regions of the network rather than uniformly analyzing all layers. The verification mechanism concentrates computational resources on monitoring activation patterns in layers most susceptible to trojan attacks, thereby achieving effective security with reduced overall computational overhead.
Solution Approach 2:
The patent changes parameters by adjusting the threshold for trigger detection and the depth of verification based on the specific application context. This allows the security mechanism to adapt its computational intensity dynamically, maintaining high security when threats are detected while operating efficiently during normal operation.
3Measurement precision
If comprehensive verification of neural network predictions is performed, then detection accuracy improves, but the time and computational resources required increase
Solution Approach 1:
The patent applies partial action by implementing verification at selective checkpoints rather than continuously analyzing every prediction. The system performs comprehensive verification when anomaly indicators are detected, while using lighter-weight checks for routine predictions, thereby achieving high detection accuracy without incurring constant full-verification overhead.
Solution Approach 2:
The patent implements periodic action by scheduling intensive verification at regular intervals and triggering additional verification based on contextual risk assessment. This periodic comprehensive checking maintains high detection accuracy while allowing the system to operate efficiently between verification cycles.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In some implementation, a system for identifying malicious attacks on a convolutional neural network (CNN) model includes a target computing system that performs classification of objects using a CNN model, and an attack identification computing system that identifies an injected neural attack. The attack identification computing system can be configured to generate, based on the CNN model and associated parameters, an ecosystem of CNN models by modifying original weights of the parameters associated with the CNN model; update the original weights of the parameters with the modified weights; store, in a secure data store, the updated weights of the parameters; generate, based on the updated weights, an update file for the CNN model; update, using the update file, the CNN model; and transmit the updated CNN model to a targeting computing system configured to detect neural attacks by an attacker computing system based on the updated CNN model.