论文标题
Obfunas：基于神经架构的DNN混淆方法
ObfuNAS: A Neural Architecture Search-based DNN Obfuscation Approach
论文作者
论文摘要
恶意建筑提取已成为对深神经网络（DNN）安全性的关键关注。作为辩护，提议建筑混淆，以将受害者DNN改造为不同的建筑。尽管如此，我们观察到，只有提取混淆的DNN结构，对手仍然可以重新训练具有高性能（例如精度）的替代模型，从而使混淆技术无效。为了减轻这种探索不足的漏洞，我们提出了obfunas，将DNN体系结构混淆转换为神经体系结构搜索（NAS）问题。 Obfunas结合使用具有功能性的混淆策略，确保混淆的DNN架构只能达到比受害者更低的精度。我们使用NAS Bench-101和NAS Bench-301（Nas-Bench-101和NAS-Bench-301）的开源架构数据集验证了Obfunas的性能。实验结果表明，在给定的Flops约束中，Obfunas可以成功地找到受害者模型的最佳掩码，导致对只有0.14倍FLOPS开销的攻击者的推理精度降解，高达2.6％。该代码可在以下网址获得：https：//github.com/tongzhou0101/obfunas。
Malicious architecture extraction has been emerging as a crucial concern for deep neural network (DNN) security. As a defense, architecture obfuscation is proposed to remap the victim DNN to a different architecture. Nonetheless, we observe that, with only extracting an obfuscated DNN architecture, the adversary can still retrain a substitute model with high performance (e.g., accuracy), rendering the obfuscation techniques ineffective. To mitigate this under-explored vulnerability, we propose ObfuNAS, which converts the DNN architecture obfuscation into a neural architecture search (NAS) problem. Using a combination of function-preserving obfuscation strategies, ObfuNAS ensures that the obfuscated DNN architecture can only achieve lower accuracy than the victim. We validate the performance of ObfuNAS with open-source architecture datasets like NAS-Bench-101 and NAS-Bench-301. The experimental results demonstrate that ObfuNAS can successfully find the optimal mask for a victim model within a given FLOPs constraint, leading up to 2.6% inference accuracy degradation for attackers with only 0.14x FLOPs overhead. The code is available at: https://github.com/Tongzhou0101/ObfuNAS.
