Attacks, Defenses and Testing for Deep Learning

This book provides a systematic study on the security of deep learning. With its powerful learning ability, deep learning is widely used in CV, FL, GNN, RL, and other scenarios. However, during the process of application, researchers have revealed that deep learning is vulnerable to malicious attacks, which will lead to unpredictable consequences. Take autonomous driving as an example, there were more than 12 serious autonomous driving accidents in the world in 2018, including Uber, Tesla and other high technological enterprises. Drawing on the reviewed literature, we need to discover vulnerabilities in deep learning through attacks, reinforce its defense, and test model performance to ensure its robustness.

Attacks can be divided into adversarial attacks and poisoning attacks. Adversarial attacks occur during the model testing phase, where the attacker obtains adversarial examples by adding small perturbations. Poisoning attacks occur during the model training phase, wherethe attacker injects poisoned examples into the training dataset, embedding a backdoor trigger in the trained deep learning model.

An effective defense method is an important guarantee for the application of deep learning. The existing defense methods are divided into three types, including the data modification defense method, model modification defense method, and network add-on method. The data modification defense method performs adversarial defense by fine-tuning the input data. The model modification defense method adjusts the model framework to achieve the effect of defending against attacks. The network add-on method prevents the adversarial examples by training the adversarial example detector.

Testing deep neural networks is an effective method to measure the security and robustness of deep learning models. Through test evaluation, security vulnerabilities and weaknesses in deep neural networks can be identified. By identifying and fixing these vulnerabilities, the security and robustness of the model can be improved.

Our audience includes researchers in the field of deep learning security, as well as software development engineers specializing in deep learning.

Jinyin Chen received BS and Ph.D. degrees from Zhejiang University of Technology, Hangzhou, China, in 2004 and 2009, respectively. She is currently a professor and doctoral supervisor at the Institute of Cyberspace Security, Zhejiang University of Technology. Her works of the past five years are aimed at serving the security needs of intelligent applications such as national defense and public security. She has published more than 60 papers in ICSE、USENIX、ACL、ECCV、IJCAI、IEEE TDSC、IEEE TKDE、IEEE TSMC、IEEE TCAS、IEEE TNSE、IEEE TCSS、IEEE TCCN、Information Sciences、Computers and Security. More than 20 papers have been published in domestic first-level Chinese journals such as the Journal of Automation, Journal of Software, Journal of Electronics, Journal of Communication, Journal of Information Security, and Computer Research and Development. More than 200 related patents have been applied and more than 90 related invention patents have been authorized. Several platforms/tools have been developed, such as network intelligent model security intelligent immune prototype system, intelligent system data and algorithm security detection platform, intelligent system security analysis and testing and reinforcement platform. Close cooperation has been established with the Academy of Military Sciences, the Third Research Institute of Public Security, the National Network Information Office, and Huawei Singapore Research Institute. Some systems have been deployed and applied on relevant practical platforms.