arXiv 2203.109022022-03cs.CRcs.AI

PublicCheck：面向运行时间深度模型服务的公共完整性验证

PublicCheck: Public Integrity Verification for Services of Run-time Deep Models

CSIRO’s Data61（澳大利亚联邦科学与工业研究组织Data61）；Cybersecurity CRC（网络安全合作研究中心）；Indian Institute of Technology Delhi（印度理工学院德里分校）；University of New South Wales（新南威尔士大学）

Shuo Wang, Sharif Abuadbba, Sidharth Agarwal, Kristen Moore, Ruoxi Sun, Minhui Xue, Surya Nepal, Seyit Camtepe, Salil Kanhere

备注：: 18 pages, 9 figures. Accepted to IEEE S&P 2023

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

摘要：

用于深度模型的现有完整性验证方法被设计用于私有验证（即，假设服务提供商是诚实的，具有对模型参数的白盒访问）。然而，私有验证方法不允许模型用户在运行时间验证模型。相反，他们必须信任服务提供商，而服务提供商可能会篡改验证结果。相比之下，考虑不诚实服务提供商可能性的公共验证方法可以使更广泛的用户受益。在本文中，我们提出了PublicCheck，一个实用的公共完整性验证解决方案的服务的运行时间深度模型。PublicCheck考虑了不诚实的服务提供商，并克服了轻量级的公共验证挑战，提供防伪保护，并拥有看起来平滑的指纹样本。为了捕获和识别运行时间模型的固有预测行为，PublicCheck生成平滑转换和增强的隐藏样本，这些样本包围在模型的决策边界周围，同时确保验证查询与正常查询无法区分。PublicCheck也适用于目标模型的知识有限的情况（例如，不知道梯度或模型参数）。对PublicCheck的全面评估表明，它对各种模型完整性攻击和模型压缩攻击具有强大的模型完整性破坏检测能力（100%检测准确率，黑盒API查询不到10个）。PublicCheck还展示了生成用于指纹识别的大量包囊样本的平滑外观、可行性和效率。

英文摘要：

Existing integrity verification approaches for deep models are designed for private verification (i.e., assuming the service provider is honest, with white-box access to model parameters). However, private verification approaches do not allow model users to verify the model at run-time. Instead, they must trust the service provider, who may tamper with the verification results. In contrast, a public verification approach that considers the possibility of dishonest service providers can benefit a wider range of users. In this paper, we propose PublicCheck, a practical public integrity verification solution for services of run-time deep models. PublicCheck considers dishonest service providers, and overcomes public verification challenges of being lightweight, providing anti-counterfeiting protection, and having fingerprinting samples that appear smooth. To capture and fingerprint the inherent prediction behaviors of a run-time model, PublicCheck generates smoothly transformed and augmented encysted samples that are enclosed around the model's decision boundary while ensuring that the verification queries are indistinguishable from normal queries. PublicCheck is also applicable when knowledge of the target model is limited (e.g., with no knowledge of gradients or model parameters). A thorough evaluation of PublicCheck demonstrates the strong capability for model integrity breach detection (100% detection accuracy with less than 10 black-box API queries) against various model integrity attacks and model compression attacks. PublicCheck also demonstrates the smooth appearance, feasibility, and efficiency of generating a plethora of encysted samples for fingerprinting.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

摘要：

英文摘要：

相关论文