[Paper Review] EI-MTD:Moving Target Defense for Edge Intelligence against Adversarial Attacks

Yaguan Qian, Qiqi Shao+6 more|arXiv (Cornell University)|Sep 19, 2020

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes EI-MTD, a moving target defense framework for edge intelligence that uses differential knowledge distillation to transfer robustness from a large, adversarially trained teacher model to small student models on resource-constrained edge devices. By dynamically scheduling these diverse, robust models via a Bayesian Stackelberg game, EI-MTD reduces adversarial transferability and achieves strong defense performance in black-box settings without sacrificing accuracy.

ABSTRACT

With the boom of edge intelligence, its vulnerability to adversarial attacks becomes an urgent problem. The so-called adversarial example can fool a deep learning model on the edge node to misclassify. Due to the property of transferability, the adversary can easily make a black-box attack using a local substitute model. Nevertheless, the limitation of resource of edge nodes cannot afford a complicated defense mechanism as doing on the cloud data center. To overcome the challenge, we propose a dynamic defense mechanism, namely EI-MTD. It first obtains robust member models with small size through differential knowledge distillation from a complicated teacher model on the cloud data center. Then, a dynamic scheduling policy based on a Bayesian Stackelberg game is applied to the choice of a target model for service. This dynamic defense can prohibit the adversary from selecting an optimal substitute model for black-box attacks. Our experimental result shows that this dynamic scheduling can effectively protect edge intelligence against adversarial attacks under the black-box setting.

Motivation & Objective

• Address the heightened vulnerability of compressed, resource-constrained edge models to adversarial attacks due to limited defense capabilities.
• Mitigate the transferability of adversarial examples across models, which enables effective black-box attacks on edge intelligence systems.
• Develop a lightweight, deployable defense mechanism suitable for edge nodes that cannot support complex, cloud-scale defenses.
• Enhance model diversity and unpredictability to prevent adversaries from reliably crafting substitute models for successful attacks.
• Maintain high classification accuracy on clean inputs while significantly improving robustness against adversarial perturbations.

Proposed method

• Apply differential knowledge distillation to transfer robustness and classification knowledge from a large, adversarially trained teacher model on the cloud to multiple smaller student models deployed on edge devices.
• Use a high distillation temperature $ T $ and a regularization coefficient $ \lambda $ to enhance the knowledge transfer of robust features and gradients.
• Implement a dynamic model scheduling policy based on a Bayesian Stackelberg game, where the defender (edge system) selects the target model stochastically to confuse the attacker.
• Leverage gradient-based diversity measures to ensure that the student models differ in their gradient responses, reducing the transferability of adversarial examples.
• Integrate the defense into a real-time edge inference pipeline, enabling on-device classification with minimal computational overhead.
• Use adversarial training on the teacher model to ensure robustness before distillation, ensuring that the student models inherit this resilience.

Experimental results

Research questions

• RQ1 Can knowledge distillation from a robust, large-scale teacher model effectively transfer adversarial robustness to small, edge-deployable student models?
• RQ2 To what extent does dynamic model scheduling via a Bayesian Stackelberg game reduce the success rate of black-box adversarial attacks on edge intelligence systems?
• RQ3 How does increasing model diversity through differential distillation impact the transferability of adversarial examples across edge models?
• RQ4 Can a lightweight defense mechanism combining distillation and dynamic scheduling maintain high accuracy on clean inputs while significantly improving robustness?
• RQ5 What is the optimal configuration of distillation temperature $ T $ and regularization coefficient $ \lambda $ for maximizing defense performance on edge devices?

Key findings

• EI-MTD significantly reduces the success rate of black-box adversarial attacks by dynamically switching between diverse, robust student models, making it difficult for attackers to find an effective substitute model.
• Increasing the distillation temperature $ T $ and the regularization coefficient $ \lambda $ leads to improved robustness, with optimal values yielding higher defense accuracy under adversarial perturbations.
• The framework maintains high classification accuracy (over 90%) on clean test images, demonstrating that robustness is achieved without sacrificing inference performance.
• The use of differential knowledge distillation enables small student models to inherit robustness from a large, adversarially trained teacher model, even with limited edge resources.
• The Bayesian Stackelberg-based scheduling policy effectively confuses attackers by introducing uncertainty in model selection, reducing the effectiveness of transfer-based attacks.
• Compared to static models, EI-MTD’s dynamic defense mechanism shows a substantial improvement in robustness, especially under transferability-based attack scenarios.