Neural Network Cloning Attack Protection via Domain Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate in preventing and detecting neural network cloning attacks, as adversaries can effectively clone neural networks using non-problem domain samples, which are easily accessible and inexpensive, allowing them to generate competing services or compromise data privacy.
Innovation Solution
Implement a method that differentiates between problem domain and non-problem domain queries, limiting the processing of non-problem domain queries and employing countermeasures such as preventing access or modifying responses to prevent cloning attacks, while maintaining top-1 accuracy and minimizing computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented to prevent cloning attacks, then neural network protection is improved, but device complexity increases
Solution Approach 1:
The security system segments the input domain into problem domain samples and non-problem domain samples using a separate domain classification network. This segmentation allows the main neural network to focus on its primary function while the classification network handles security verification, reducing the complexity burden on the main network.
Solution Approach 2:
A domain classification network acts as an intermediary between the input samples and the main neural network. This intermediary performs the security check by classifying whether samples belong to the problem domain, preventing direct cloning attacks without requiring complex modifications to the main network architecture.
2Reliability
If non-problem domain queries are limited, then cloning attack prevention is improved, but productivity decreases
Solution Approach 1:
The system applies partial action by only restricting non-problem domain queries that exceed a specified threshold, rather than blocking all such queries. This allows legitimate queries to proceed while preventing cloning attacks that require large volumes of non-problem domain samples, thus maintaining productivity while improving security.
3Measurement precision
If domain classification is performed for each query, then cloning detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The domain classification network performs self-service by independently classifying input samples without requiring complex computational resources from the main neural network. The classification network is trained separately and can quickly determine whether samples belong to the problem domain, reducing the computational overhead on the main system while maintaining detection accuracy.
Data Source
AI summary
A method of protecting an implementation of a neural network against a cloning attack, the neural network configured to generate a result based on an input sample from a predetermined domain of possible samples, the neural network trained to provide functionality corresponding to a subset of the domain, wherein the method comprises: receiving, from a user, a plurality of queries having a corresponding query sample from the domain and, for each query, performing a first test to determine whether or not the corresponding query sample is a member of the subset; performing a second test to identify whether the user is performing a cloning attack against the neural network, wherein the second test identifies that the user is performing a cloning attack against the neural network if a number of queries from the plurality of queries for which the corresponding query sample is determined to not be a member of the subset exceeds a first threshold value; and in response to the second test identifying that the user is performing a cloning attack against the neural network, performing one or more countermeasures for the cloning attack.