Publishing Efficient On-device Models Increases Adversarial Vulnerability
Not on the map. Why?
Abstract (arXiv)
Recent increases in the computational demands of deep neural networks (DNNs) have sparked interest in efficient deep learning mechanisms, e.g., quantization or pruning. These mechanisms enable the construction of a small, efficient version of commercial-scale models with comparable accuracy, accelerating their deployment to resource-constrained devices. In this paper, we study the security considerations of publishing on-device variants of large-scale models. We first show that an adversary can exploit on-device models to make attacking the large models easier. In evaluations across 19 DNNs, by exploiting the published on-device models as a transfer prior, the adversarial vulnerability of the original commercial-scale models increases by up to 100x. We then show that the vulnerability increases as the similarity between a full-scale and its efficient model increase. Based on the insights, we propose a defense, similarity-unpairing, that fine-tunes on-device models with the objective of reducing the similarity. We evaluated our defense on all the 19 DNNs and found that it reduces the transferability up to 90% and the number of queries required by a factor of 10-100x. Our results suggest that further research is needed on the security (or even privacy) threats caused by publishing those efficient siblings.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 56 of its 78 references that are in the map. First posted on arXiv 28 Dec 2022.
Builds on
56 of 78 references.
References · 56
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2015Distilling the Knowledge in a Neural Networkcited by 10,076
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
- 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2016Neural Architecture Search with Reinforcement Learningcited by 1,489
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
38 more
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2016Pruning Filters for Efficient ConvNetscited by 1,129
- 2017Learning Transferable Architectures for Scalable Image Recognitioncited by 1,097
- 2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,059
- 2016SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model sizecited by 1,054
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2016XNOR-Net: ImageNet Classification Using Binary Convolutional Neural Networkscited by 829
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2019Once-for-All: Train One Network and Specialize it for Efficient Deploymentcited by 778
- 2017Evasion Attacks against Machine Learning at Test Timecited by 686
- 2018ProxylessNAS: Direct Neural Architecture Search on Target Task and Hardwarecited by 666
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2015BinaryConnect: Training Deep Neural Networks with binary weights during propagationscited by 571
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2018PACT: Parameterized Clipping Activation for Quantized Neural Networkscited by 456
- 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
- 2019On the Efficacy of Knowledge Distillationcited by 377
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2016Designing Neural Network Architectures using Reinforcement Learningcited by 277
- 2018LQ-Nets: Learned Quantization for Highly Accurate and Compact Deep Neural Networkscited by 272
- 2017Variational Dropout Sparsifies Deep Neural Networkscited by 265
- 2020Proving the Lottery Ticket Hypothesis: Pruning is All You Needcited by 200
- 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
- 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
- 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
- 2019Adversarially Robust Distillationcited by 124
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
- 2019When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attackscited by 87
- 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
- 2020Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examplescited by 66
- 2019Stateful Detection of Black-Box Adversarial Attackscited by 55
50 most cited of 56 All 56 (JSON)
Built on by
Citing papers per year: 2024: 2; 2025: 1.
3 papers.