DNNobfus：一种基于混淆的端侧模型保护框架技术研究

宋飞扬; 赵鑫淼; 严飞; 程斌林; 张立强; 杨小林; 王洋

doi:10.11959/j.issn.2096-109x.2024019

您当前的位置：

首页 >

文章列表页 >

DNNobfus：一种基于混淆的端侧模型保护框架技术研究

学术论文 | 更新时间：2024-08-14

- DNNobfus：一种基于混淆的端侧模型保护框架技术研究
- DNNobfus: a study on obfuscation-based edge-side model protection framework
- 网络与信息安全学报 2024年10卷第2期页码：143-153
- 作者机构：
  
  1.武汉大学国家网络安全学院空天信息安全与可信计算教育部重点实验室, 湖北武汉 430072
  2.山东大学网络空间安全学院, 山东青岛 266237
  3.浪潮智慧科技有限公司, 山东济南 250101
  4.山东浪潮科学研究院有限公司, 山东济南 250101
- 作者简介：
  
  [ "宋飞扬（1999- ），男，湖北武汉人，武汉大学硕士生，主要研究方向为深度学习模型二进制保护。" ]
  [ "赵鑫淼（1999- ），女，吉林大安人，武汉大学硕士生，主要研究方向为深度学习模型二进制保护。" ]
  [ "严飞（1980- ），男，上海人，武汉大学教授、博士生导师，主要研究方向为系统安全与可信计算、可信人工智能和人机交互安全。" ]
  [ "程斌林（1980- ），男，湖北黄石人，山东大学副教授、硕士生导师，主要研究方向为软件安全。" ]
  [ "张立强（1979- ），男，黑龙江哈尔滨人，武汉大学副教授、博士生导师，主要研究方向为系统安全与可信计算、工业互联网安全、数据安全、安全测评和人工智能安全。" ]
  [ "杨小林（1981- ），女，山东济南人，浪潮智慧科技有限公司董事长，主要研究方向为水利、交通、农业行业的数字化转型。" ]
  [ "王洋（1987- ），男，山东济宁人，山东浪潮科学研究院有限公司安全所副所长，主要研究方向为隐私计算、零信任和数据安全架构。" ]
- 基金信息：
  
  湖北省重大研究计划项目(2023BAA027);国家自然科学基金(62172144);国家重点研发计划项目(2022YFB3103804)
- DOI：10.11959/j.issn.2096-109x.2024019
  中图分类号： TP309
- 收稿：2023-11-27，
  
  修回：2024-03-04，
  
  纸质出版：2024-04-15
- 稿件说明：
移动端阅览
宋飞扬, 赵鑫淼, 严飞, 等. DNNobfus:一种基于混淆的端侧模型保护框架技术研究[J]. 网络与信息安全学报, 2024, 10(02): 143-153.

Format: SONG F Y, ZHAO X M, YAN F, et al. DNNobfus: a study on obfuscation-based edge-side model protection framework[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 143-153.
宋飞扬, 赵鑫淼, 严飞, 等. DNNobfus:一种基于混淆的端侧模型保护框架技术研究[J]. 网络与信息安全学报, 2024, 10(02): 143-153. DOI： 10.11959/j.issn.2096-109x.2024019.

Format: SONG F Y, ZHAO X M, YAN F, et al. DNNobfus: a study on obfuscation-based edge-side model protection framework[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 143-153. DOI： 10.11959/j.issn.2096-109x.2024019.

摘要

人工智能模型自广泛使用以来，面临诸多安全风险。随着深度学习模型大规模在端侧设备上的部署，端侧模型面临新的安全挑战。由于深度神经网络具有相似的结构特征，攻击者得以运用反编译技术以获取模型的结构信息及其参数，从而重建模型。此过程会损害模型的知识产权并使模型面临白盒攻击的风险。针对模型反编译器对模型算子的定位与识别、参数获取、网络拓扑解析过程，提出了一种基于模型编译过程的混淆框架以防御模型提取攻击；在深度学习编译器的前端优化过程中设计并实现了算子混淆、参数混淆和网络拓扑混淆3种混淆手段；采用构造不透明谓词，插入虚假控制流，添加冗余内存访问等手段，干扰模型反编译器对模型的逆向工程。实验结果表明，提出的混淆框架DNNobfus能有效降低前沿的模型反编译工具对模型算子类型及网络连接识别的准确率，分别下降至21.63%和48.24%。此外，该框架平均时间效率为67.93%，平均空间效率为88.37%，均优于混淆工具Obfuscator-LLVM。

Abstract

The proliferation of artificial intelligence models has rendered them vulnerable to a myriad of security threats. The extensive integration of deep learning models into edge devices has introduced novel security challenges. Given the analogous structural characteristics of deep neural networks

adversaries can employ decompilation tactics to extract model structural details and parameters

facilitating the reconstruction of these models. Such actions can compromise the intellectual property rights of the model and increase the risk of white-box attacks. To mitigate the capability of model decompilers to locate and identify model operators

acquire parameters

and parse network topologies

an obfuscation framework was proposed. This framework was embedded within the model compilation process to safeguard against model extraction attacks. During the frontend optimization phase of deep learning compilers

three obfuscation techniques were developed and integrated: operator obfuscation

parameter obfuscation

and network topology obfuscation. The framework introduced opaque predicates

incorporated fake control flows

and embedded redundant memory access to thwart the reverse engineering efforts of model decompilers. The experimental findings demonstrate that the obfuscation framework

named DNNobfus

significantly diminishes the accuracy of state-of-the-art model decompilation tools in identifying model operator types and network connections to 21.63% and 48.24%

respectively. Additionally

DNNobfus achieves an average time efficiency of 67.93% and an average space efficiency of 88.37%

surpassing the performance of the obfuscation tool Obfuscator-LLVM in both respects.

关键词

Keywords

references

任奎 , 孟泉润 , 闫守琨 , 等 . 人工智能模型数据泄露的攻击与防御研究综述 [J ] . 网络与信息安全学报 , 2021 , 7 ( 1 ): 1 - 10 .

REN K , MENG Q R , YAN S K , et al . Survey of artificial intelligence data security and privacy protection [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 1 ): 1 - 10 .

宋蕾 , 马春光 , 段广晗 . 机器学习安全及隐私保护研究进展 .[J ] . 网络与信息安全学报 , 2018 , 4 ( 8 ): 1 - 11 .

SONG L , MA C G , DUAN G H . Machine learning security and privacy: a survey [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 8 ): 1 - 11 .

WU R , KIM T , TIAN D J , et al . DnD: a cross-architecture deep neural network decompiler [C ] // Proceedings of the Proceedings of the 31st USENIX Conference on Security Symposium . Boston : ACM press , 2022 : 2135 - 2152 .

LIU Z B , YUAN Y Y , WANG S , et al . Decompiling x86 deep neural network executables [C ] // Proceedings of the Proceedings of the 32nd USENIX Conference on Security Symposium . New York : ACM press , 2023 : 7357 - 7374 .

LI Z , HU C Y , ZHANG Y , et al . How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN [C ] // Proceedings of the Proceedings of the 35th Annual Computer Security Applications Conference . New York : ACM press , 2019 : 126 - 137 .

HANZLIK L , ZHANG Y , GROSSE K , et al . MLCapsule: guarded offline deployment of machine learning as a service [C ] // Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) . Piscataway : IEEE Press , 2021 : 3295 - 3304 .

SABT M , ACHEMLAL M , BOUABDALLAH A . Trusted execution environment: what it is, and what it is not [C ] // Proceedings of the 2015 IEEE Trustcom/BigDataSE/ISPA . Piscataway : IEEE Press , 2015 : 57 - 64 .

SHEN T , QI J , JIANG J , et al . SOTER: guarding black-box inference for general neural networks at the edge [C ] // 2022 USENIX Annual Technical Conference . Carlsbad : 2022 : 723 - 738 .

CHEN T Q , MOREAU T , JIANG Z H , et al . TVM: an automated end-to-end optimizing compiler for deep learning [C ] // Proceedings of the 13th USENIX conference on Operating Systems Design and Implementation . New York : ACM press , 2018 : 579 - 594 .

JUNOD P , RINALDINI J , WEHRLI J , et al . Obfuscator-LLVM: software protection for the masses [C ] // Proceedings of the 2015 IEEE/ACM 1st International Workshop on Software Protection . Piscataway : IEEE Press , 2015 : 3 - 9 .

HUA W Z , ZHANG Z R , SUH G E . Reverse engineering convolutional neural networks through side-channel information leaks [C ] // Proceedings of the 2018 55th ACM/ESDA/IEEE Design Automation Conference (DAC) . Piscataway : IEEE Press , 2018 : 1 - 6 .

BATINA L , BHASIN S , JAP D , et al . CSI NN: reverse engineering of neural network architectures through electromagnetic side channel [C ] // Proceedings of the Proceedings of the 28th USENIX Conference on Security Symposium . New York : ACM press , 2019 : 515 - 532 .

YAN M , FLETCHER C , TORRELLAS J . Cache telepathy: leveraging shared resource attacks to learn DNN architectures [C ] // Proceedings of the Proceedings of the 29th USENIX Conference on Security Symposium . 2020 : 2003 - 2020 .

HOCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

LUO Y K , DUAN S J , CHENG G Y , et al . NNReArch: a tensor program scheduling framework against neural network architecture reverse engineering [C ] // Proceedings of the 2022 IEEE 30th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM) . Piscataway : IEEE Press , 2022 : 1 - 9 .

LI J T , HE Z Z , RAKIN A S , et al . NeurObfuscator: a full-stack obfuscation tool to mitigate neural architecture stealing [C ] // Proceedings of the 2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) . Piscataway : IEEE Press , 2021 : 248 - 258 .

ZHOU T , REN S L , XU X L . ObfuNAS: a neural architecture search-based DNN obfuscation approach [C ] // Proceedings of the Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design . New York : ACM press , 2022 : 1 - 9 .

XU H , SU Y , ZHAO Z , et al . Deepobfuscation: securing the structure of convolutional neural networks via knowledge distillation [EB ] . arXiv preprint arXiv: 1806.10313.2018 .

SZENTANNAI K , AL-AFANDI J , HORVÁTH A . Preventing neural network weight stealing via network obfuscation [C ] //ARAI K, KAPOOR S, BHATIA R. Science and Information Conference . Cham : Springer , 2020 : 1 - 11 .

CHAKRABORTY A , MONDAI A , SRIVASTAVA A . Hardware-assisted intellectual property protection of deep learning models [C ] // Proceedings of the 2020 57th ACM/IEEE Design Automation Conference (DAC) . Piscataway : IEEE Press , 2020 : 1 - 6 .

赵玉洁 , 汤战勇 , 王妮 , 等 . 代码混淆算法有效性评估 [J ] . 软件学报 , 2012 , 23 ( 3 ): 700 - 711 .

ZHAO Y J , TANG Z Y , WANG N , et al . Evaluation of code obfuscating transformation [J ] . Journal of Software , 2012 , 23 ( 3 ): 700 - 711 .

TARG S , ALMEIDA D , LYMAN K . Resnet in Resnet: generalizing residual architectures [EB ] . arXiv preprint arXiv: 1603.08029.2016 .

SENGUPTA A , YE Y T , WANG R , et al . Going deeper in spiking neural networks: VGG and residual architectures [J ] . Frontiers in Neuroscience , 2019 ( 13 ): 95 .

SZEGEDY C , VANHOUCKE V , IOFFE S , et al . Rethinking the inception architecture for computer vision [C ] // Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2016 : 2818 - 2826 .

ZHANG X Y , ZHOU X Y , LIN M X , et al . ShuffleNet: an extremely efficient convolutional neural network for mobile devices [C ] // Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition . Piscataway : IEEE Press , 2018 : 6848 - 6856 .

HOWARD A G , ZHU M , CHEN B , et al . Mobilenets: efficient convolutional neural networks for mobile vision applications [EB ] . arXiv preprint , 2017 , arXiv: 1704.04861 .

TAN M , LE Q . Efficientnet: rethinking model scaling for convolutional neural networks [C ] // Proceedings of the 36th International Conference on Machine Learning . Long Beach : 2019 : 6105 - 6114 .

浏览量

100

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

路径分支混淆研究综述

基于浮点数类型转换和运算的不透明谓词构造方法

基于符号执行和N-scope复杂度的代码混淆度量方法

基于API调用的抗混淆Android应用相似性检测方法