Model Compression Hardens Deep Neural Networks: A New Perspective to Prevent Adversarial Attacks.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning Security

Background:

• Deep neural networks (DNNs) achieve high performance but are vulnerable to adversarial examples, posing security risks.
• Existing defenses against adversarial attacks are often limited in scope and incur high implementation costs, such as complete retraining.
• A need exists for a comprehensive and cost-effective defense framework against diverse adversarial attacks.

Purpose of the Study:

• To develop a low-cost, comprehensive defense framework against adversarial examples for DNNs.
• To identify critical conditions for mitigating adversarial attacks: a defensive decision boundary and small gradients.
• To propose novel retraining-free methods for enhancing DNN security.

Main Methods:

• Proposed a "defensive hash classifier" using hash compression as a first line of defense.
• Introduced retraining-free "gradient inhibition" (GI) methods to suppress and randomize adversarial gradients.
• Integrated the hash classifier and GI methods into a comprehensive defense framework.

Main Results:

• The proposed framework significantly decreases the attack success rate of various adversarial attacks.
• Effectiveness demonstrated across traditional white-box, strong adaptive white-box, and black-box attack settings.
• The defense framework offers a low deployment cost compared to existing methods.

Conclusions:

• The combined approach of a defensive hash classifier and gradient inhibition provides robust protection against adversarial examples.
• The developed framework addresses the limitations of current defenses by offering broad applicability and low implementation costs.
• This research contributes to enhancing the security and reliability of DNN-based systems in real-world applications.