SaTC: CORE: Medium: Digital Forensics for Deep Neural Networks

SaTC：核心：媒介：深度神经网络的数字取证

• 批准号: 2241303
• 负责人: Ben Zhao
• 金额: $ 121.6万
• 依托单位: University of Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-04-01 至 2027-03-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2241303&HistoricalAwards=false
• 关键词: SaTC; CORE; Medium; Digital; Forensics

The vulnerability of Deep Neural Networks (DNNs) to adversarial attacks remains a major hurdle limiting their use in a wide range of safety-critical applications, such as self-driving cars, medical diagnosis, and financial market analysis. Existing research around adversarial robustness has developed a series of promising defenses, but these are generally broken shortly thereafter by stronger adaptive attacks. This seems unlikely to change, calling for complementary security efforts that increase the cost (in time and computing resources) for successful attacks, reduce the impact of attacks, and identify attackers and vulnerabilities following an attack. This project targets the final goal through developing attack forensics methods to improve the robustness of deep learning systems. The project can alter the playing field between attackers and defenders, by expanding the defense toolset beyond attack prevention to include post-attack analysis.The project will consider three main avenues of attacks on DNNs. The first focuses on analyzing training time poisoning attacks, using clustering and machine unlearning-inspired methods to identify poisoned samples and developing model training methods that trace training provenance to support later forensics. The second focuses on inference time attacks while models are in use, through developing variations of target models that include additional data; the additional data is chosen to maintain accuracy while allowing defenders to make inferences about the models being used to generate attacks. The third focuses on identifying new vulnerabilities arising from neural synthesis models used to generate images, text, and other content, characterizing the space of possible goals attackers might have and methods they might use to poison these models. The project team will also work with industry partners to ground the work and increase the chance of it transferring into real systems, as well as with their department's efforts to increase the number and diversity of people doing research around cybersecurity.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

深度神经网络 (DNN) 面对对抗性攻击的脆弱性仍然是限制其在广泛的安全关键应用中使用的主要障碍，例如自动驾驶汽车、医疗诊断和金融市场分析。围绕对抗鲁棒性的现有研究已经开发出了一系列有希望的防御措施，但这些防御措施通常很快就会被更强大的自适应攻击所打破。这似乎不太可能改变，需要采取补充性安全措施，增加成功攻击的成本（时间和计算资源），减少攻击的影响，并识别攻击者和攻击后的漏洞。该项目的最终目标是通过开发攻击取证方法来提高深度学习系统的鲁棒性。该项目可以通过将防御工具集扩展到攻击预防之外，包括攻击后分析来改变攻击者和防御者之间的竞争环境。该项目将考虑对 DNN 进行攻击的三种主要途径。 第一个重点是分析训练时间中毒攻击，使用聚类和机器学习启发的方法来识别中毒样本，并开发可追踪训练来源以支持后续取证的模型训练方法。第二个重点是通过开发包含附加数据的目标模型变体，在使用模型时进行推理时间攻击；选择附加数据是为了保持准确性，同时允许防御者对用于生成攻击的模型进行推断。第三个重点是识别用于生成图像、文本和其他内容的神经合成模型所产生的新漏洞，描述攻击者可能具有的目标空间以及他们可能用来毒害这些模型的方法。项目团队还将与行业合作伙伴合作，为工作奠定基础，增加其转化为实际系统的机会，并与他们的部门合作，增加围绕网络安全进行研究的人员的数量和多样性。该奖项反映了 NSF 的法定使命通过使用基金会的智力优点和更广泛的影响审查标准进行评估，并被认为值得支持。

项目成果

Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models

Glaze：通过文本到图像模型保护艺术家免受风格模仿

• 发表时间: 2023-08
• 期刊: Proceedings of the 32nd USENIX Security Symposium
• 作者: Shan, Shawn;Cryan, Jenna;Wenger, Emily;Zheng, Haitao;Hanocka, Rana;Zhao, Ben Y.
• 通讯作者: Zhao, Ben Y.

Data Isotopes for Data Provenance in DNNs

DNN 中数据来源的数据同位素

• DOI: 10.56553/popets-2024-0024
• 发表时间: 2024-01
• 期刊: Proceedings on Privacy Enhancing Technologies
• 作者: Wenger, Emily;Li, Xiuyu;Zhao, Ben Y.;Shmatikov, Vitaly
• 通讯作者: Shmatikov, Vitaly

"My face, my rules": Enabling Personalized Protection Against Unacceptable Face Editing

“我的脸，我的规则”：针对不可接受的面部编辑启用个性化保护

• DOI: 10.56553/popets-2023-0080
• 发表时间: 2023-07
• 期刊: Proceedings on Privacy Enhancing Technologies
• 作者: Xiao, Zhujun;Cryan, Jenna;Yao, Yuanshun;Cheo, Yi Hong;Shu, Yuanchao;Saroiu, Stefan;Zhao, Ben Y.;Zheng, Haitao
• 通讯作者: Zheng, Haitao

Towards Scalable and Robust Model Versioning

迈向可扩展且稳健的模型版本控制

• 发表时间: 2024-04
• 期刊: Proceedings of IEEE Conference on Secure and Trustworthy Machine Learning (SaTML
• 作者: Ding, Wenxin;Bhagoji, Arjun Nitin;Zhao, Ben Y;Zheng, Haitao
• 通讯作者: Zheng, Haitao

Towards a General Video-based Keystroke Inference Attack

走向通用的基于视频的击键推理攻击

• 发表时间: 2023-08
• 期刊: Proceedings of the 32nd USENIX Security Symposium
• 作者: Yang, Zhuolin;Chen, Yuxin;Sarwar, Zain;Schwartz, Hadleigh;Zhao, Ben Y.;Zheng, Haitao
• 通讯作者: Zheng, Haitao