Protection of neural networks by obfuscation of neural network architecture
Aspects of the present disclosure involve implementations that may be used to protect neural network models against adversarial attacks by obfuscating neural network operations and architecture. Obfuscation techniques include obfuscating weights and biases of neural network nodes, obfuscating activation functions used by neural networks, as well as obfuscating neural network architecture by introducing dummy operations, dummy nodes, and dummy layers into the neural networks.
1. A method comprising:
modifying a neural network (NN) model to obtain a modified NN model, wherein each of the NN model and the modified NN model is configured, when applied to an input, to generate a same output, wherein the modified NN model comprises:
a first node to provide one or more output values to a second node, wherein the one or more output values provided by the first node comprise one or more inconsequential input values into the second node; and
a downstream portion of the modified NN model, the downstream portion comprising the second node and configured to compensate for the one or more inconsequential input values into the second node.
2. The method of claim 1 , wherein the one or more inconsequential input values into the second node comprise a constant input value output by the first node for each of a plurality of inputs into the first node.
3. The method of claim 2 , wherein the constant input value is zero.
4. The method of claim 2 , wherein the constant input value is non-zero, and wherein the second node is configured to compensate for the constant input value.
5. The method of claim 4 , wherein the modified NN model further comprises one or more additional nodes that are configured to output one or more additional input values into the second node.
6. The method of claim 1 , wherein the modified NN model further comprises a third node, and wherein the first node is further to provide the one or more input values into the third node.
7. The method of claim 6 , wherein the one or more output values comprise an obfuscated input into the third node, and wherein the third node is to apply a de-obfuscation transformation to the one or more output values.
8. The method of claim 1 , wherein the second node is a pass-through node configured to receive one or more additional input values from a third node, and wherein an output of the second node is based on the one or more additional input values and is independent of the one or more inconsequential input values into the second node.
9. The method of claim 8 , wherein the output of the second node comprises an obfuscated representation of the one or more additional input values.
10. The method of claim 8 , wherein the second node is a node of a plurality of pass-through nodes of the modified NN model.
11. The method of claim 10 , wherein the plurality of pass-through nodes comprises one or more layers of pass-through nodes.
12. A method comprising:
applying a neural network (NN) model to an input to generate an output, wherein the NN model is modified, from a reference NN model, by one or more obfuscation operations, wherein each of the NN model and the reference NN model is configured, being applied to the input, to generate the same output, and wherein the one or more obfuscation operations comprise:
a first node to provide one or more output values to a second node, wherein the one or more output values provided by the first node comprise one or more inconsequential input values into the second node; and
a downstream portion of the NN model, the downstream portion comprising the second node and configured to compensate for the one or more inconsequential input values into the second node.
13. The method of claim 12 , wherein the second node is a pass-through node configured to receive one or more additional input values from a third node, and wherein an output of the second node is based on the one or more additional input values and is independent of the one or more inconsequential input values into the second node.
14. A system comprising:
a memory device; and
a processing device communicatively coupled to the memory device, the processing device to:
modify a neural network (NN) model to obtain a modified NN model, wherein each of the NN model and the modified NN model is configured, when applied to an input, to generate a same output, wherein the modified NN model comprises:
a first node to provide one or more output values to a second node, wherein the one or more output values provided by the first node comprise one or more inconsequential input values into the second node; and
a downstream portion of the modified NN model, the downstream portion comprising the second node and configured to compensate for the one or more inconsequential input values into the second node.
15. The system of claim 14 , wherein the one or more inconsequential input values into the second node comprise a constant input value output by the first node for each of a plurality of inputs into the first node.
16. The system of claim 14 , wherein the modified NN model further comprises a third node, and wherein the first node is further to provide the one or more input values into the third node.
17. The system of claim 16 , wherein the one or more output values comprise an obfuscated input into the third node, and wherein the third node is to apply a de-obfuscation transformation to the one or more output values.
18. The system of claim 14 , wherein the second node is a pass-through node configured to receive one or more additional input values from a third node, and wherein an output of the second node is based on the one or more additional input values and is independent of the one or more inconsequential input values into the second node.
19. The system of claim 18 , wherein the second node is a node of a plurality of pass-through nodes of the modified NN model.
20. A method comprising:
applying a neural network (NN) model to an input to generate an output, wherein the NN model is modified, from a reference NN model, by one or more obfuscation operations, wherein each of the NN model and the reference NN model is configured, being applied to the input, to generate the same output, and wherein the one or more obfuscation operations comprise:
a first node to provide one or more output values to a second node, wherein the one or more output values provided by the first node comprise one or more inconsequential input values into the second node; and
a downstream portion of the NN model, the downstream portion comprising the second node and configured to compensate for the one or more inconsequential input values into the second node.