DNNobfus: a study on obfuscation-based edge-side model protection framework

SONG Feiyang; ZHAO Xinmiao; YAN Fei; CHENG Binlin; ZHANG Liqiang; YANG Xiaolin; WANG Yang

doi:10.11959/j.issn.2096-109x.2024019

您当前的位置：

首页 >

文章列表页 >

DNNobfus: a study on obfuscation-based edge-side model protection framework

Papers | 更新时间：2024-08-14

- DNNobfus: a study on obfuscation-based edge-side model protection framework
- Chinese Journal of Network and Information Security Vol. 10, Issue 2, Pages: 143-153(2024)
- 作者机构：
  
  1.武汉大学国家网络安全学院空天信息安全与可信计算教育部重点实验室, 湖北武汉 430072
  2.山东大学网络空间安全学院, 山东青岛 266237
  3.浪潮智慧科技有限公司, 山东济南 250101
  4.山东浪潮科学研究院有限公司, 山东济南 250101
- 作者简介：
- 基金信息：
  
  The Major Research Plan of Hubei Province(2023BAA027);The National Natural Science Foundation of China(62172144);The National Key Research and Development Program of China(2022YFB3103804)
- DOI：10.11959/j.issn.2096-109x.2024019
  CLC： TP309
- Received：27 November 2023，
  
  Revised：2024-03-04，
  
  Published：15 April 2024
- 稿件说明：
移动端阅览
宋飞扬, 赵鑫淼, 严飞, 等. DNNobfus:一种基于混淆的端侧模型保护框架技术研究[J]. 网络与信息安全学报, 2024, 10(02): 143-153.

Format: SONG F Y, ZHAO X M, YAN F, et al. DNNobfus: a study on obfuscation-based edge-side model protection framework[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 143-153.
宋飞扬, 赵鑫淼, 严飞, 等. DNNobfus:一种基于混淆的端侧模型保护框架技术研究[J]. 网络与信息安全学报, 2024, 10(02): 143-153. DOI： 10.11959/j.issn.2096-109x.2024019.

Format: SONG F Y, ZHAO X M, YAN F, et al. DNNobfus: a study on obfuscation-based edge-side model protection framework[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 143-153. DOI： 10.11959/j.issn.2096-109x.2024019.

摘要

人工智能模型自广泛使用以来，面临诸多安全风险。随着深度学习模型大规模在端侧设备上的部署，端侧模型面临新的安全挑战。由于深度神经网络具有相似的结构特征，攻击者得以运用反编译技术以获取模型的结构信息及其参数，从而重建模型。此过程会损害模型的知识产权并使模型面临白盒攻击的风险。针对模型反编译器对模型算子的定位与识别、参数获取、网络拓扑解析过程，提出了一种基于模型编译过程的混淆框架以防御模型提取攻击；在深度学习编译器的前端优化过程中设计并实现了算子混淆、参数混淆和网络拓扑混淆3种混淆手段；采用构造不透明谓词，插入虚假控制流，添加冗余内存访问等手段，干扰模型反编译器对模型的逆向工程。实验结果表明，提出的混淆框架DNNobfus能有效降低前沿的模型反编译工具对模型算子类型及网络连接识别的准确率，分别下降至21.63%和48.24%。此外，该框架平均时间效率为67.93%，平均空间效率为88.37%，均优于混淆工具Obfuscator-LLVM。

Abstract

The proliferation of artificial intelligence models has rendered them vulnerable to a myriad of security threats. The extensive integration of deep learning models into edge devices has introduced novel security challenges. Given the analogous structural characteristics of deep neural networks

adversaries can employ decompilation tactics to extract model structural details and parameters

facilitating the reconstruction of these models. Such actions can compromise the intellectual property rights of the model and increase the risk of white-box attacks. To mitigate the capability of model decompilers to locate and identify model operators

acquire parameters

and parse network topologies

an obfuscation framework was proposed. This framework was embedded within the model compilation process to safeguard against model extraction attacks. During the frontend optimization phase of deep learning compilers

three obfuscation techniques were developed and integrated: operator obfuscation

parameter obfuscation

and network topology obfuscation. The framework introduced opaque predicates

incorporated fake control flows

and embedded redundant memory access to thwart the reverse engineering efforts of model decompilers. The experimental findings demonstrate that the obfuscation framework

named DNNobfus

significantly diminishes the accuracy of state-of-the-art model decompilation tools in identifying model operator types and network connections to 21.63% and 48.24%

respectively. Additionally

DNNobfus achieves an average time efficiency of 67.93% and an average space efficiency of 88.37%

surpassing the performance of the obfuscation tool Obfuscator-LLVM in both respects.

关键词

Keywords

references

任奎 , 孟泉润 , 闫守琨 , 等 . 人工智能模型数据泄露的攻击与防御研究综述 [J ] . 网络与信息安全学报 , 2021 , 7 ( 1 ): 1 - 10 .

REN K , MENG Q R , YAN S K , et al . Survey of artificial intelligence data security and privacy protection [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 1 ): 1 - 10 .

宋蕾 , 马春光 , 段广晗 . 机器学习安全及隐私保护研究进展 .[J ] . 网络与信息安全学报 , 2018 , 4 ( 8 ): 1 - 11 .

SONG L , MA C G , DUAN G H . Machine learning security and privacy: a survey [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 8 ): 1 - 11 .

WU R , KIM T , TIAN D J , et al . DnD: a cross-architecture deep neural network decompiler [C ] // Proceedings of the Proceedings of the 31st USENIX Conference on Security Symposium . Boston : ACM press , 2022 : 2135 - 2152 .

LIU Z B , YUAN Y Y , WANG S , et al . Decompiling x86 deep neural network executables [C ] // Proceedings of the Proceedings of the 32nd USENIX Conference on Security Symposium . New York : ACM press , 2023 : 7357 - 7374 .

LI Z , HU C Y , ZHANG Y , et al . How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN [C ] // Proceedings of the Proceedings of the 35th Annual Computer Security Applications Conference . New York : ACM press , 2019 : 126 - 137 .

HANZLIK L , ZHANG Y , GROSSE K , et al . MLCapsule: guarded offline deployment of machine learning as a service [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . Piscataway : IEEE Press , 2021 : 3295 - 3304 .

SABT M , ACHEMLAL M , BOUABDALLAH A . Trusted execution environment: what it is, and what it is not [C ] // Proceedings of the 2015 IEEE Trustcom/BigDataSE/ISPA . Piscataway : IEEE Press , 2015 : 57 - 64 .

SHEN T , QI J , JIANG J , et al . SOTER: guarding black-box inference for general neural networks at the edge [C ] // 2022 USENIX Annual Technical Conference . Carlsbad : 2022 : 723 - 738 .

CHEN T Q , MOREAU T , JIANG Z H , et al . TVM: an automated end-to-end optimizing compiler for deep learning [C ] // Proceedings of the 13th USENIX conference on Operating Systems Design and Implementation . New York : ACM press , 2018 : 579 - 594 .

JUNOD P , RINALDINI J , WEHRLI J , et al . Obfuscator-LLVM: software protection for the masses [C ] // Proceedings of the 2015 IEEE/ACM 1st International Workshop on Software Protection . Piscataway : IEEE Press , 2015 : 3 - 9 .

HUA W Z , ZHANG Z R , SUH G E . Reverse engineering convolutional neural networks through side-channel information leaks [C ] // Proceedings of the 2018 55th ACM/ESDA/IEEE Design Automation Conference (DAC) . Piscataway : IEEE Press , 2018 : 1 - 6 .

BATINA L , BHASIN S , JAP D , et al . CSI NN: reverse engineering of neural network architectures through electromagnetic side channel [C ] // Proceedings of the Proceedings of the 28th USENIX Conference on Security Symposium . New York : ACM press , 2019 : 515 - 532 .

YAN M , FLETCHER C , TORRELLAS J . Cache telepathy: leveraging shared resource attacks to learn DNN architectures [C ] // Proceedings of the Proceedings of the 29th USENIX Conference on Security Symposium . 2020 : 2003 - 2020 .

HOCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

LUO Y K , DUAN S J , CHENG G Y , et al . NNReArch: a tensor program scheduling framework against neural network architecture reverse engineering [C ] // Proceedings of the 2022 IEEE 30th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM) . Piscataway : IEEE Press , 2022 : 1 - 9 .

LI J T , HE Z Z , RAKIN A S , et al . NeurObfuscator: a full-stack obfuscation tool to mitigate neural architecture stealing [C ] // Proceedings of the 2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) . Piscataway : IEEE Press , 2021 : 248 - 258 .

ZHOU T , REN S L , XU X L . ObfuNAS: a neural architecture search-based DNN obfuscation approach [C ] // Proceedings of the Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design . New York : ACM press , 2022 : 1 - 9 .

XU H , SU Y , ZHAO Z , et al . Deepobfuscation: securing the structure of convolutional neural networks via knowledge distillation [EB ] . arXiv preprint arXiv: 1806.10313.2018 .

SZENTANNAI K , AL-AFANDI J , HORVÁTH A . Preventing neural network weight stealing via network obfuscation [C ] //ARAI K, KAPOOR S, BHATIA R. Science and Information Conference . Cham : Springer , 2020 : 1 - 11 .

CHAKRABORTY A , MONDAI A , SRIVASTAVA A . Hardware-assisted intellectual property protection of deep learning models [C ] // Proceedings of the 2020 57th ACM/IEEE Design Automation Conference (DAC) . Piscataway : IEEE Press , 2020 : 1 - 6 .

赵玉洁 , 汤战勇 , 王妮 , 等 . 代码混淆算法有效性评估 [J ] . 软件学报 , 2012 , 23 ( 3 ): 700 - 711 .

ZHAO Y J , TANG Z Y , WANG N , et al . Evaluation of code obfuscating transformation [J ] . Journal of Software , 2012 , 23 ( 3 ): 700 - 711 .

TARG S , ALMEIDA D , LYMAN K . Resnet in Resnet: generalizing residual architectures [EB ] . arXiv preprint arXiv: 1603.08029.2016 .

SENGUPTA A , YE Y T , WANG R , et al . Going deeper in spiking neural networks: VGG and residual architectures [J ] . Frontiers in Neuroscience , 2019 ( 13 ): 95 .

SZEGEDY C , VANHOUCKE V , IOFFE S , et al . Rethinking the inception architecture for computer vision [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 2818 - 2826 .

ZHANG X Y , ZHOU X Y , LIN M X , et al . ShuffleNet: an extremely efficient convolutional neural network for mobile devices [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 6848 - 6856 .

HOWARD A G , ZHU M , CHEN B , et al . Mobilenets: efficient convolutional neural networks for mobile vision applications [EB ] . arXiv preprint , 2017 , arXiv: 1704.04861 .

TAN M , LE Q . Efficientnet: rethinking model scaling for convolutional neural networks [C ] // Proceedings of the 36th International Conference on Machine Learning . Long Beach : 2019 : 6105 - 6114 .

Views

100

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Review of path branch obfuscation

Constructing method of opaque predicate based on type conversion and operation of floating point numbers

Metrics for code obfuscation based on symbolic execution and N-scope complexity

Anti-obfuscation Android application similarity detection method based on API call

Related Author

Pu GENG

Yuefei ZHU

Qingfeng WANG

Hao LIANG

Yawen WANG

Genlin XIE

Benwei HE

Yuqiang XIAO

Related Institution

School of Cyberspace Security，Beijing University of Post and Telecommunications

Beijing Key Laboratory of integration with the world Internet

School of Computer Science, Sichuan University

⁰