[Paper Review] On Hiding Neural Networks Inside Neural Networks

Chuan Guo, Ruihan Wu+1 more|arXiv (Cornell University)|Feb 24, 2020

Adversarial Robustness in Machine Learning26 references4 citations

TL;DR

This paper proposes TrojanNet, a steganographic framework that hides a secret neural network within a publicly released carrier network by exploiting excess model capacity. Using a secret key to permute network weights during training, the method enables undetectable co-training of public and secret tasks; without the key, the secret model remains computationally indistinguishable from random, and detection is proven NP-complete.

ABSTRACT

Modern neural networks often contain significantly more parameters than the size of their training data. We show that this excess capacity provides an opportunity for embedding secret machine learning models within a trained neural network. Our novel framework hides the existence of a secret neural network with arbitrary desired functionality within a carrier network. We prove theoretically that the secret network's detection is computationally infeasible and demonstrate empirically that the carrier network does not compromise the secret network's disguise. Our paper introduces a previously unknown steganographic technique that can be exploited by adversaries if left unchecked.

Motivation & Objective

• To develop a method for concealing a secret neural network within a publicly released, seemingly benign carrier network.
• To ensure the secret model remains computationally undetectable without knowledge of a secret key.
• To leverage excess model capacity in large neural networks to simultaneously train public and secret tasks without performance degradation.
• To prove theoretically that detecting the presence of a hidden model is NP-complete, ensuring strong covertness.
• To demonstrate empirically that the hidden model can be extracted only with the secret key, while the carrier maintains high performance on both tasks.

Proposed method

• The method uses a secret key to define a specific permutation of network weights during training, which is applied to embed a hidden neural network within a pre-trained carrier network.
• The carrier network is trained to perform a public task while simultaneously learning the secret task via weight permutations, with no shared features between the two tasks.
• The secret model is extracted only by applying the inverse permutation using the secret key, which restores the original weight configuration for the hidden network.
• The framework relies on the redundancy of overparameterized neural networks to embed the secret model without increasing the total number of parameters.
• Theoretical analysis shows that determining whether any permutation triggers a hidden functionality is an NP-complete decision problem, ensuring computational infeasibility of detection.
• Empirical validation is conducted on ResNet50 using CIFAR-10 and CIFAR-100, showing that both public and secret tasks achieve performance comparable to single-task training.

Experimental results

Research questions

• RQ1 Can a neural network be hidden inside another neural network in a way that is computationally undetectable without a secret key?
• RQ2 Is it possible to train a single network to perform both a public task and a secret task simultaneously without compromising performance?
• RQ3 What is the computational complexity of detecting the presence of a hidden neural network within a carrier model?
• RQ4 How does model capacity affect the number of hidden tasks that can be embedded and the performance of individual models?
• RQ5 Can this method be used for applications beyond steganography, such as model watermarking or copyright protection?

Key findings

• The detection of a hidden neural network within a carrier model is proven to be an NP-complete decision problem, making it computationally infeasible to detect without the secret key.
• On CIFAR-10 and CIFAR-100, the TRN50 model trained with up to 10 different keys shows only a 1.5% and 2.9% drop in individual model accuracy, respectively, demonstrating efficient weight sharing.
• Without the secret key, the hidden model’s performance is indistinguishable from random, and the carrier network maintains high accuracy on the public task.
• The method achieves performance on both public and secret tasks comparable to training separate models, with no increase in parameters.
• Larger models like TRN50 show significantly better capacity for embedding multiple secret models than smaller ones like TRN18, confirming the role of excess capacity.
• The framework enables the creation of ensembles of hidden models that are as de-correlated as independent models, suggesting utility in boosting performance under memory constraints.