mlsanityData to 7 Oct 2026

Safety and Performance, Why Not Both? Bi-Objective Optimized Model Compression against Heterogeneous Attacks Toward AI Software Deployment

arXiv 2401.00996 ↗First posted 2 Jan 2024cs.AI cs.CR cs.SEcited by 4

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

The size of deep learning models in artificial intelligence (AI) software is increasing rapidly, hindering the large-scale deployment on resource-restricted devices (e.g., smartphones). To mitigate this issue, AI software compression plays a crucial role, which aims to compress model size while keeping high performance. However, the intrinsic defects in a big model may be inherited by the compressed one. Such defects may be easily leveraged by adversaries, since a compressed model is usually deployed in a large number of devices without adequate protection. In this article, we aim to address the safe model compression problem from the perspective of safety-performance co-optimization. Specifically, inspired by the test-driven development (TDD) paradigm in software engineering, we propose a test-driven sparse training framework called SafeCompress. By simulating the attack mechanism as safety testing, SafeCompress can automatically compress a big model to a small one following the dynamic sparse training paradigm. Then, considering two kinds of representative and heterogeneous attack mechanisms, i.e., black-box membership inference attack and white-box membership inference attack, we develop two concrete instances called BMIA-SafeCompress and WMIA-SafeCompress. Further, we implement another instance called MMIA-SafeCompress by extending SafeCompress to defend against the occasion when adversaries conduct black-box and white-box membership inference attacks simultaneously. We conduct extensive experiments on five datasets for both computer vision and natural language processing tasks. The results show the effectiveness and generalizability of our framework. We also discuss how to adapt SafeCompress to other attacks besides membership inference attack, demonstrating the flexibility of SafeCompress.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 54 of its 86 references that are in the map. First posted on arXiv 2 Jan 2024.

Builds on

54 of 86 references.

References · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  5. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  6. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  7. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  8. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2022Generative Adversarial Networkscited by 5,603
  11. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  12. 2016Deep Learning with Differential Privacycited by 2,682
38 more
  1. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  2. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  5. 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,548
  6. 2019TinyBERT: Distilling BERT for Natural Language Understandingcited by 1,153
  7. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  8. 2021Scaling Vision with Sparse Mixture of Expertscited by 740
  9. 2019Adversarial Training for Free!cited by 638
  10. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  11. 2019Rigging the Lottery: Making All Tickets Winnerscited by 491
  12. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  13. 2017Scalable Training of Artificial Neural Networks with Adaptive Sparse Connectivity inspired by Network Sciencecited by 325
  14. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  15. 2016Adversarial Training Methods for Semi-Supervised Text Classificationcited by 280
  16. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 273
  17. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  18. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  19. 2019Sparse Networks from Scratch: Faster Training without Losing Performancecited by 210
  20. 2020Information Leakage in Embedding Modelscited by 199
  21. 2019Parameter Efficient Training of Deep Convolutional Neural Networks by Dynamic Sparse Reparameterizationcited by 187
  22. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  23. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  24. 2022On-Device Training Under 256KB Memorycited by 158
  25. 2021Do We Actually Need Dense Over-Parameterization? In-Time Over-Parameterization in Sparse Trainingcited by 107
  26. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
  27. 2020Quantifying Privacy Leakage in Graph Embeddingcited by 82
  28. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 79
  29. 2021Top-KAST: Top-K Always Sparse Trainingcited by 79
  30. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 68
  31. 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 63
  32. 2019Sparse evolutionary Deep Learning with over one million artificial neurons on commodity hardwarecited by 48
  33. 2020Sparse Weight Activation Trainingcited by 45
  34. 2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 42
  35. 2020Against Membership Inference Attack: Pruning is All You Needcited by 32
  36. 2022M^4I: Multi-modal Models Membership Inferencecited by 30
  37. 2019Segmentations-Leak: Membership Inference Attacks and Defenses in Semantic Image Segmentationcited by 29
  38. 2017Moonshine: Distilling with Cheap Convolutionscited by 23

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year

Citing papers per year: 2024: 1; 2025: 3.

4 papers.

  1. 2024MoLE: Enhancing Human-centric Text-to-image Diffusion via Mixture of Low-rank Expertscited by 15
  2. 2025Towards Understanding and Improving Refusal in Compressed Models via Mechanistic Interpretabilitycited by 6
  3. 2025Auditing Data Provenance in Real-world Text-to-Image Diffusion Models for Privacy and Copyright Protectioncited by 2
  4. 2025Optimizing Deep Neural Networks using Safety-Guided Self Compressioncited by 0