[Paper Review] Security analysis and enhancement of model compressed deep learning systems under adversarial attacks

Qi Liu, Tao Liu+4 more|arXiv (Cornell University)|Jan 22, 2018

Adversarial Robustness in Machine LearningComputer Science23 references24 citations

TL;DR

This paper investigates the vulnerability of compressed deep learning models to adversarial attacks by jointly analyzing model reshaping (via hash-based compression) and input perturbations. It proposes a gradient inhibition defense that reduces adversarial success rates from 87.99% (MNIST) and 86.74% (CIFAR-10) to 4.77% and 4.64%, respectively, with minimal accuracy loss.

ABSTRACT

Thanks to recent machine learning model innovation and computing hardware advancement, the state-of-the-art of Deep Neural Network (DNN) is presenting human-level performance for many complex intelligent tasks in real-world applications. However, it also introduces ever-increasing security concerns for those intelligent systems. For example, the emerging adversarial attacks indicate that even very small and often imperceptible adversarial input perturbations can easily mislead the cognitive function of deep learning systems (DLS). Existing DNN adversarial studies are narrowly performed on the ideal software-level DNN models with a focus on single uncertainty factor, i.e. input perturbations, however, the impact of DNN model reshaping on adversarial attacks, which is introduced by various hardware-favorable techniques such as hash-based weight compression during modern DNN hardware implementation, has never been discussed. In this work, we for the first time investigate the multi-factor adversarial attack problem in practical model optimized deep learning systems by jointly considering the DNN model-reshaping (e.g. HashNet based deep compression) and the input perturbations. We first augment adversarial example generating method dedicated to the compressed DNN models by incorporating the software-based approaches and mathematical modeled DNN reshaping. We then conduct a comprehensive robustness and vulnerability analysis of deep compressed DNN models under derived adversarial attacks. A defense technique named gradient inhibition is further developed to ease the generating of adversarial examples thus to effectively mitigate adversarial attacks towards both software and hardware-oriented DNNs. Simulation results show that gradient inhibition can decrease the average success rate of adversarial attacks from 87.99% to 4.77% (from 86.74% to 4.64%) on MNIST (CIFAR-10) benchmark with marginal accuracy degradation across various DNNs.

Motivation & Objective

• Address the security gap in compressed deep learning systems, where model optimization techniques like weight compression are overlooked in adversarial robustness analysis.
• Investigate the combined impact of model reshaping (e.g., HashNet-based compression) and input perturbations on adversarial vulnerability in real-world DNN deployments.
• Develop a defense mechanism effective against both software-level and hardware-optimized DNNs under adversarial conditions.
• Evaluate robustness across multiple DNN architectures and benchmark datasets (MNIST, CIFAR-10) under realistic compression and attack scenarios.

Proposed method

• Augment existing adversarial example generation methods by integrating mathematical models of DNN model reshaping, particularly hash-based compression (e.g., HashNet), to simulate real hardware-optimized models.
• Formulate a joint attack framework that considers both input-level perturbations and structural changes due to model compression, enabling realistic adversarial threat modeling.
• Propose a gradient inhibition technique that suppresses gradient flow during adversarial example generation, thereby reducing the model's susceptibility to adversarial inputs.
• Integrate gradient inhibition into both standard and compressed DNNs to ensure broad applicability across software and hardware-optimized inference pipelines.
• Use iterative optimization with gradient masking to limit the effectiveness of gradient-based attacks while preserving model accuracy.
• Validate the method on standard benchmarks (MNIST, CIFAR-10) using diverse DNN architectures under varying compression levels.

Experimental results

Research questions

• RQ1 How does hash-based model compression (e.g., HashNet) affect the robustness of deep neural networks against adversarial attacks?
• RQ2 To what extent do combined input perturbations and model reshaping amplify adversarial vulnerabilities in practical DNN systems?
• RQ3 Can a defense mechanism like gradient inhibition effectively reduce adversarial success rates across both uncompressed and compressed DNNs?
• RQ4 What is the trade-off between adversarial robustness and model accuracy when applying gradient inhibition in compressed DNNs?

Key findings

• The proposed gradient inhibition defense reduces the average adversarial attack success rate to 4.77% on the MNIST benchmark, down from 87.99%.
• On the CIFAR-10 dataset, the attack success rate is reduced from 86.74% to 4.64% after applying gradient inhibition.
• The defense maintains high model accuracy with only marginal degradation across various DNN architectures under different compression levels.
• The study reveals that model reshaping via hash-based compression significantly alters adversarial vulnerability, making traditional robustness analysis insufficient for hardware-optimized models.
• The joint consideration of input perturbations and model compression leads to more realistic and severe adversarial threat models in practical DNN deployments.
• Gradient inhibition effectively mitigates adversarial attacks in both software and hardware-oriented DNNs, demonstrating broad applicability and strong defense performance.