Fast identification of trustworthy deep neural networks
A system and method including receiving a set of deep neural networks (DNN) including DNNs trained with an embedded trojan and DNNs trained without any embedded trojan, each of the trained DNNs being represented by a mathematical formulation learned by the DNNs and expressing a relationship between an input of the DNNs and an output of the DNNs; extracting at least one characteristic feature from the mathematical formulation of each of the trained DNNs; statistically analyzing the at least one characteristic feature to determine whether there is a difference between the DNNs trained with the embedded trojan and the DNNs trained without any embedded trojan; generating, in response to the determination indicating there is a difference, a detector model to execute the statistical analyzing on deep neural networks; and storing a file including the generated detector model in a memory device.
1. A system comprising:
a memory storing processor-executable program code; and
a processor to execute the processor-executable program code in order to cause the system to:
receive a set of deep neural networks (DNN) including a first plurality of the DNNs trained with an embedded trojan and a second plurality of the DNNs trained without any embedded trojan, each of the first plurality and the second plurality of the trained DNNs being represented by a mathematical formulation learned by each respective DNN and expressing a relationship between an input of each respective DNN and an output of each respective DNN;
extract at least one characteristic feature from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs;
statistically analyze the at least one characteristic feature extracted from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs to determine whether there is a difference between the first plurality of the DNNs trained with the embedded trojan and the second plurality of the DNNs trained without any embedded trojan;
generate, in response to the determination indicating there is a difference between the first plurality of the DNNs trained with the embedded trojan and the second plurality of the DNNs trained without any embedded trojan, a detector model to execute the statistical analyzing on deep neural networks; and
store a file including the generated detector model in a memory device.
2. The system of claim 1 , wherein the at least one characteristic feature extracted from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs is at least one of a structural feature of the mathematical formulation of each respective DNN of each of the first plurality and the second plurality of trained DNNs, an activation behavior of each respective DNN of each of the first plurality and the second plurality of trained DNNs, and a backpropagation of an error for each respective DNN of each of the first plurality and the second plurality of trained DNNs.
3. The system of claim 2 , wherein the generated detector model executes a statistical analysis based on two or more of the structural features of the mathematical formulation of each respective DNN of each of the first plurality and the second plurality of trained DNNs, the activation behavior of each respective DNN of each of the first plurality and the second plurality of trained DNNs, and the backpropagation of the error for each respective DNN of each of the first plurality and the second plurality of trained DNNs.
4. The system of claim 1 , further comprising validating the determination against a set of test data.
5. The system of claim 4 , wherein the validating is accomplished using at least one of a support vector machine analysis and other machine learning-based classification process.
6. The system of claim 1 , wherein the difference between the first plurality of the DNNs trained with the embedded trojan and the second plurality of the DNNs trained without any embedded trojan is indicated by a decision boundary for the first plurality of the DNNs trained with the embedded trojan being more complex than a decision boundary for the second plurality of the DNNs trained without any embedded trojan.
7. The system of claim 6 , wherein the complexity of the decision boundary for the first plurality of the DNNs trained with the embedded trojan is discernable from inherent training noise of the DNNs trained with the embedded trojan.
8. The system of claim 1 , wherein the statistical analysis is performed for one or more layers of the DNNs of each of the first plurality and the second plurality of trained DNNs.
9. The system of claim 3 , wherein the generated detector model is one of a machine learning-based model or a statistical classification model.
10. A computer-implemented method, the method comprising:
receiving a set of deep neural networks (DNN) including a first plurality of the DNNs trained with an embedded trojan and a second plurality of the DNNs trained without any embedded trojan, each of the first plurality and the second plurality of the trained DNNs being represented by a mathematical formulation learned by each respective DNN and expressing a relationship between an input of the DNN and an output of each respective DNN;
extracting at least one characteristic feature from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs;
statistically analyzing the at least one characteristic feature extracted from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs to determine whether there is a difference between the first plurality of the DNNs trained with the embedded trojan and the second plurality of the DNNs trained without any embedded trojan;
generating in response to the determination indicating there is a difference between the first plurality of the DNNs trained with the embedded troj an and the second plurality of the DNNs trained without any embedded trojan, a detector model to execute the statistical analyzing on deep neural networks; and
storing a file including the generated detector model in a memory device.
11. The method of claim 10 , wherein the at least one characteristic feature extracted from the mathematical formulation of each of the first plurality and the second plurality of trained DNNs is at least one of a structural feature of the mathematical formulation of each respective DNN of each of the first plurality and the second plurality of trained DNNs, an activation behavior of each respective DNN of each of the first plurality and the second plurality of trained DNNs, and a backpropagation of an error for each respective DNN of each of the first plurality and the second plurality of trained DNNs.
12. The method of claim 11 , wherein the generated detector model executes a statistical analysis based on two or more of the structural feature of the mathematical formulation of each respective DNN of each of the first plurality and the second plurality of trained DNNs, the activation behavior of each respective DNN of each of the first plurality and the second plurality of trained DNNs, and the backpropagation of the error for each respective DNN of each of the first plurality and the second plurality of trained DNNs.
13. The method of claim 10 , further comprising validating the determination against a set of test data.
14. The method of claim 13 , wherein the validating is accomplished using at least one of a support vector machine analysis and other machine learning-based classification process.
15. The method of claim 10 , wherein the difference between the first plurality of the DNNs trained with the embedded trojan and the second plurality of the DNNs trained without any embedded trojan is indicated by a decision boundary for the first plurality of the DNNs trained with the embedded trojan being more complex than a decision boundary for the second plurality of the DNNs trained without any embedded troj an.
16. The method of claim 15 , wherein the complexity of the decision boundary for the first plurality of the DNNs trained with the embedded trojan is discernable from inherent training noise of the DNNs trained with the embedded trojan.
17. The method of claim 10 , wherein the statistical analysis is performed for one or more layers of the DNNs of each of the first plurality and the second plurality of trained DNNs.
18. The method of claim 12 , wherein the generated detector model is one of a machine learning-based model or a statistical classification model.