Neural Network Sanitization via Parameter Zeroing and Retraining
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural network models can be compromised by malicious actors embedding malware code within their parameters, which can go undetected and execute on user computers, compromising the system.
Innovation Solution
A security platform that sanitizes neural network models by retraining them using a process that updates model parameters based on error values and loss functions, sets insignificant weights to zero, and iteratively modifies non-zero weights to ensure the removal of malicious code without affecting the network's functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If neural network parameters are directly used from external sources, then model deployment speed is improved, but security reliability deteriorates due to potential malware embedding
Solution Approach 1:
The patent applies preliminary action by performing sanitization checks on neural network parameters before deployment. The system detects and removes malicious code from model parameters prior to use, ensuring security concerns are addressed in advance rather than during or after deployment, thus maintaining both speed and reliability
Solution Approach 2:
The patent introduces an intermediary sanitization layer between parameter acquisition and model deployment. This intermediary process validates and cleans parameters through techniques like gradient checking and anomaly detection, acting as a mediator that ensures security without blocking the deployment workflow
2Reliability
If retraining process is performed to sanitize neural network, then security reliability is improved, but training time increases
Solution Approach 1:
The patent applies partial action by performing targeted sanitization on specific parameters or subsets of the neural network rather than complete retraining. Techniques like selective parameter validation and localized gradient checking allow the system to address security concerns in only the necessary portions of the model, reducing overall training time while maintaining security
Solution Approach 2:
The patent changes parameters related to the sanitization process itself, such as adjusting tolerance thresholds, selecting which parameters to validate, and controlling the depth of gradient checking. These parameter adjustments allow the system to balance security requirements with time constraints by making the sanitization process more or less stringent based on specific needs
3Object-generated harmful factors
If sanitization process modifies model parameters, then malicious code removal is improved, but model accuracy may deteriorate
Solution Approach 1:
The patent applies local quality by selectively modifying only those parameters that contain malicious code or anomalies, while leaving the majority of clean parameters unchanged. This localized approach ensures that sanitization actions are concentrated where needed, minimizing the impact on overall model accuracy while effectively removing harmful elements
Solution Approach 2:
The patent implements feedback mechanisms that continuously monitor model performance during and after sanitization. By measuring accuracy changes and comparing against baseline performance, the system can detect when sanitization begins to degrade model quality and adjust its actions accordingly, ensuring malicious code is removed while preserving essential model functionality
Data Source
AI summary
Systems, devices, and methods for protecting a user computer devices/network from malicious code embedded in a neural network is described. A security platform may selectively modify a downloaded neural network model and/or architecture to remove neural network parameters that may be used to reconstruct the malicious code at an end user of the neural network model. For example, the security platform may remove specific branches of the neural network and/or set specific parameters of the neural network model to zero, such that the malicious code may not be reconstructed at an end-user device.