[论文解读] Towards Privacy and Security of Deep Learning Systems: A Survey.

Yingzhe He, Guozhu Meng+3 more|arXiv (Cornell University)|Nov 28, 2019

Adversarial Robustness in Machine Learning被引用 8

一句话总结

本综述对深度学习系统面临的四大主要安全与隐私威胁——模型提取、模型反演、投毒攻击和对抗性攻击——进行了全面分析。系统评估了攻击工作流程、攻击者能力及评估指标，识别出查询效率和扰动距离等关键因素，并提出了17项可操作的发现，涵盖攻击有效性、复杂性及缓解潜力。

ABSTRACT

Deep learning has gained tremendous success and great popularity in the past few years. However, recent research found that it is suffering several inherent weaknesses, which can threaten the security and privacy of the stackholders. Deep learning's wide use further magnifies the caused consequences. To this end, lots of research has been conducted with the purpose of exhaustively identifying intrinsic weaknesses and subsequently proposing feasible mitigation. Yet few is clear about how these weaknesses are incurred and how effective are these attack approaches in assaulting deep learning. In order to unveil the security weaknesses and aid in the development of a robust deep learning system, we are devoted to undertaking a comprehensive investigation on attacks towards deep learning, and extensively evaluating these attacks in multiple views. In particular, we focus on four types of attacks associated with security and privacy of deep learning: model extraction attack, model inversion attack, poisoning attack and adversarial attack. For each type of attack, we construct its essential workflow as well as adversary capabilities and attack goals. Many pivot metrics are devised for evaluating the attack approaches, by which we perform a quantitative and qualitative analysis. From the analysis, we have identified significant and indispensable factors in an attack vector, \eg, how to reduce queries to target models, what distance used for measuring perturbation. We spot light on 17 findings covering these approaches' merits and demerits, success probability, deployment complexity and prospects. Moreover, we discuss other potential security weaknesses and possible mitigation which can inspire relevant researchers in this area.

研究动机与目标

• 系统调查深度学习系统内在安全与隐私弱点的根本原因及其影响。
• 阐明不同攻击类型（模型提取、反演、投毒及对抗性攻击）在实际中的运作机制。
• 通过标准化指标（包括查询效率、扰动距离和成功率）评估攻击有效性。
• 识别影响真实场景中攻击成功率与部署复杂性的关键因素。
• 突出潜在的缓解策略及构建鲁棒深度学习系统的未来研究方向。

提出的方法

• 将攻击分类为四类：模型提取、模型反演、数据投毒和对抗性攻击，明确其工作流程与攻击者能力。
• 为每类攻击定义攻击目标与攻击者能力，如查询访问权限或数据操纵能力。
• 引入并应用关键评估指标以衡量攻击性能，包括查询减少量与扰动测量值。
• 通过多条攻击路径进行定量与定性分析，评估攻击的有效性与可行性。
• 将研究发现整合为17项可操作的见解，涵盖攻击优势、劣势、成功率与部署复杂性。
• 讨论潜在的未来安全弱点与缓解技术，以指导鲁棒深度学习系统的设计。

实验结果

研究问题

• RQ1 深度学习中模型提取、模型反演、投毒与对抗性攻击的核心工作流程与攻击者能力是什么？
• RQ2 查询效率与扰动距离等因素如何影响攻击成功率与实际部署？
• RQ3 从成功率与复杂性角度出发，不同攻击方法的相对优势与劣势是什么？
• RQ4 哪些指标在定量与定性评估攻击性能方面最为有效？
• RQ5 哪些缓解策略最具前景，未来研究方向应如何引导以保障深度学习系统的安全性？

主要发现

• 减少对目标模型的查询次数是提升模型提取攻击效率与可行性的关键因素。
• 扰动距离度量的选择显著影响对抗性攻击的评估结果与成功率。
• 在特定攻击者能力下，模型反演攻击可高保真度地重建敏感输入数据。
• 当攻击者可访问训练数据并能注入精心构造的样本时，投毒攻击表现出高成功率。
• 即使扰动极小，对抗性攻击也极为有效，但其成功率高度依赖于扰动测量所采用的距离度量。
• 本研究识别出17项关键发现，综合揭示了攻击成功率、复杂性与可检测性之间的权衡，为未来防御机制提供指导。