Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models

Deep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering...

ver descrição completa

Detalhes bibliográficos
Autores: Echeberria Barrio, Xabier, Gil Lerchundi, Amaia, Orduna Urrutia, Raul, Mendialdua Beitia, Iñigo
Formato: artículo
Fecha de publicación:2022
País:España
Recursos:Universidad del País Vasco
Repositorio:Addi. Archivo Digital para la Docencia y la Investigación
OAI Identifier:oai:addi.ehu.eus:10810/56426
Acesso em linha:http://hdl.handle.net/10810/56426
Access Level:acceso abierto
Palavra-chave:deep learning vulnerabilities
deep learning attacks
deep learning threats
id ES_7dc16ff2c4187771ad4cd3e84452a787
oai_identifier_str oai:addi.ehu.eus:10810/56426
network_acronym_str ES
network_name_str España
repository_id_str
spelling Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning ModelsEcheberria Barrio, XabierGil Lerchundi, AmaiaOrduna Urrutia, RaulMendialdua Beitia, Iñigodeep learning vulnerabilitiesdeep learning attacksdeep learning threatsDeep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering a long list of threats from which every model should be defended. The weight modification attack is presented and discussed among researchers, who have presented several versions and analyses about such a threat. It focuses on detecting multiple vulnerable weights to modify, misclassifying the desired input data. Therefore, analysis of the different approaches to this attack helps understand how to defend against such a vulnerability. This work presents a new version of the weight modification attack. Our approach is based on three processes: input data clusterization, weight selection, and modification of the weights. Data clusterization allows a directed attack to a selected class. Weight selection uses the gradient given by the input data to identify the most-vulnerable parameters. The modifications are incorporated in each step via limited noise. Finally, this paper shows how this new version of fault injection attack is capable of misclassifying the desired cluster completely, converting the 100% accuracy of the targeted cluster to 0–2.7% accuracy, while the rest of the data continues being well-classified. Therefore, it demonstrates that this attack is a real threat to neural networks.This research has been partially funded by European Union’s Horizon 2020 research and innovation programme project SPARTA and by the Basque Government under ELKARTEK project (LANTEGI4.0 KK-2020/00072).MDPI2022202220222022info:eu-repo/semantics/articleapplication/pdfhttp://hdl.handle.net/10810/56426reponame:Addi. Archivo Digital para la Docencia y la Investigacióninstname:Universidad del País VascoIngléshttps://www.mdpi.com/2076-3417/12/8/3725/htminfo:eu-repo/semantics/openAccesshttp://creativecommons.org/licenses/by/3.0/es/2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).oai:addi.ehu.eus:10810/564262026-06-18T09:23:17Z
dc.title.none.fl_str_mv Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
title Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
spellingShingle Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
Echeberria Barrio, Xabier
deep learning vulnerabilities
deep learning attacks
deep learning threats
title_short Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
title_full Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
title_fullStr Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
title_full_unstemmed Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
title_sort Optimized Parameter Search Approach for Weight Modification Attack Targeting Deep Learning Models
dc.creator.none.fl_str_mv Echeberria Barrio, Xabier
Gil Lerchundi, Amaia
Orduna Urrutia, Raul
Mendialdua Beitia, Iñigo
author Echeberria Barrio, Xabier
author_facet Echeberria Barrio, Xabier
Gil Lerchundi, Amaia
Orduna Urrutia, Raul
Mendialdua Beitia, Iñigo
author_role author
author2 Gil Lerchundi, Amaia
Orduna Urrutia, Raul
Mendialdua Beitia, Iñigo
author2_role author
author
author
dc.subject.none.fl_str_mv deep learning vulnerabilities
deep learning attacks
deep learning threats
topic deep learning vulnerabilities
deep learning attacks
deep learning threats
description Deep neural network models have been developed in different fields, bringing many advances in several tasks. However, they have also started to be incorporated into tasks with critical risks. That worries researchers who have been interested in studying possible attacks on these models, discovering a long list of threats from which every model should be defended. The weight modification attack is presented and discussed among researchers, who have presented several versions and analyses about such a threat. It focuses on detecting multiple vulnerable weights to modify, misclassifying the desired input data. Therefore, analysis of the different approaches to this attack helps understand how to defend against such a vulnerability. This work presents a new version of the weight modification attack. Our approach is based on three processes: input data clusterization, weight selection, and modification of the weights. Data clusterization allows a directed attack to a selected class. Weight selection uses the gradient given by the input data to identify the most-vulnerable parameters. The modifications are incorporated in each step via limited noise. Finally, this paper shows how this new version of fault injection attack is capable of misclassifying the desired cluster completely, converting the 100% accuracy of the targeted cluster to 0–2.7% accuracy, while the rest of the data continues being well-classified. Therefore, it demonstrates that this attack is a real threat to neural networks.
publishDate 2022
dc.date.none.fl_str_mv 2022
2022
2022
2022
dc.type.none.fl_str_mv info:eu-repo/semantics/article
format article
dc.identifier.none.fl_str_mv http://hdl.handle.net/10810/56426
url http://hdl.handle.net/10810/56426
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv https://www.mdpi.com/2076-3417/12/8/3725/htm
dc.rights.none.fl_str_mv info:eu-repo/semantics/openAccess
http://creativecommons.org/licenses/by/3.0/es/
eu_rights_str_mv openAccess
rights_invalid_str_mv http://creativecommons.org/licenses/by/3.0/es/
dc.format.none.fl_str_mv application/pdf
dc.publisher.none.fl_str_mv MDPI
publisher.none.fl_str_mv MDPI
dc.source.none.fl_str_mv reponame:Addi. Archivo Digital para la Docencia y la Investigación
instname:Universidad del País Vasco
instname_str Universidad del País Vasco
reponame_str Addi. Archivo Digital para la Docencia y la Investigación
collection Addi. Archivo Digital para la Docencia y la Investigación
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869411687339130880
score 15.301603

Registos relacionados