Neural Network Obfuscation via Dummy Nodes and Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks are vulnerable to adversarial attacks that aim to reveal proprietary information such as weights, biases, and activation functions, compromising their security and integrity.
Innovation Solution
The method involves obfuscating neural network operations by expanding weights and biases with dummy values, masking them using linear or reversible non-linear transformations, and obfuscating activation functions, thereby making it difficult for attackers to determine the actual network parameters and architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If neural network parameters (weights, biases, activation functions) are made publicly accessible for analysis, then ease of operation and transparency are improved, but security and protection against adversarial attacks deteriorate
Solution Approach 1:
The patent introduces an intermediary obfuscation layer between the neural network parameters and the external environment. This layer includes dummy weights, dummy biases, and dummy activation functions that mask the actual parameters. The intermediary layer allows the network to operate transparently for legitimate users while protecting against adversarial attacks by preventing direct access to real parameters.
Solution Approach 2:
The patent creates copies of neural network parameters (dummy weights, dummy biases, dummy activation functions) that appear identical to the real parameters from an attacker's perspective but are functionally different. These copies are used to obfuscate the actual parameters while maintaining the network's operational functionality for authorized users.
2Object-affected harmful factors
If obfuscation techniques are applied to neural network parameters, then security against adversarial attacks is improved, but device complexity increases
Solution Approach 1:
The patent merges the obfuscation components (dummy weights, dummy biases, dummy activation functions) with the actual neural network parameters into a unified structure. The obfuscated parameters are integrated into the network layers alongside the real parameters, allowing the network to function as a single cohesive system without requiring separate obfuscation modules that would increase complexity.
Solution Approach 2:
The obfuscation components serve multiple functions: they protect against adversarial attacks, maintain network functionality for authorized users, and can be dynamically configured. The dummy parameters act as universal placeholders that work across different network architectures and attack scenarios, reducing the need for architecture-specific obfuscation solutions.
3Difficulty of detecting and measuring
If dummy operations and inconsequential inputs are added to neural network nodes, then difficulty of detecting and measuring actual network operations is improved, but productivity and computational efficiency deteriorate
Solution Approach 1:
The patent applies local quality by making only specific portions of the neural network obfuscated while keeping other portions intact. The dummy operations are localized to specific nodes or layers where they provide maximum obfuscation benefit, while the majority of the network maintains its original computational efficiency. This selective obfuscation allows the system to achieve security without uniformly degrading performance across the entire network.
Data Source
AI summary
Aspects of the present disclosure involve implementations that may be used to protect neural network models against adversarial attacks by obfuscating neural network operations and architecture. Obfuscation techniques include obfuscating weights and biases of neural network nodes, obfuscating activation functions used by neural networks, as well as obfuscating neural network architecture by introducing dummy operations, dummy nodes, and dummy layers into the neural networks.