Neural Network Security via Identity Approximation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks are vulnerable to reverse engineering and adversarial attacks, which threaten the security of sensitive data and models, particularly in high-value commercial applications and personal data protection.
Innovation Solution
Integrating a convolutional neural network approximating the identity function into the neural network architecture, specifically at selected layers and channels, to complicate hyperplane structures and disrupt attacker attempts without compromising network performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the size, number of layers and number of parameters of the neural network are increased to complicate reverse engineering, then security against attacks is improved, but device complexity and training difficulty worsen
Solution Approach 1:
A noise network is introduced as an intermediary component between the input and the target neural network. This noise network adds controlled randomness to the input data, serving as a mediator that prevents attackers from directly observing the true input-output relationships of the target network, thereby enhancing security without modifying the target network's architecture
Solution Approach 2:
The invention changes the parameters of the noise network (such as noise magnitude, distribution characteristics, and network depth) to optimize the balance between security and performance. By adjusting these parameters, the system can dynamically control the level of protection while maintaining acceptable functionality
2Reliability
If input restrictions are imposed to detect suspicious sequences, then security is improved, but ease of operation and accessibility worsen
Solution Approach 1:
The noise network performs self-service by automatically generating and applying noise to inputs without requiring external validation or restriction mechanisms. This self-service approach maintains security while allowing unrestricted access to the neural network, as the noise injection is an automatic, transparent process that does not interfere with legitimate usage
Data Source
AI summary
A method for secure use of a first neural network on an input datum, the method comprising implementing, by data processing circuitry of a terminal: (a) constructing a second neural network which corresponds to the first neural network and receives at least one convolutional neural network approximating the identity function, (b) using the second neural network on the input datum. Further including a method for training parameters of the second neural network.