通过分析推理过程图,自动修复神经网络的不可靠行为。
DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysis
- 构建推理溯源图追踪模型运行时信息流
- 单层修复可提升55%对抗准确率
- 适合安全、隐私、公平性等可靠性研究
深度神经网络(DNN)在自动驾驶、生物识别等高风险场景中广泛应用,但其在真实环境中的不可预测和不可靠行为亟需新方法进行表征与保障。本文提出DeepProv,一种可定制的系统,通过分析DNN推理过程的底层图结构,构建推理溯源图(IPG),以刻画运行时行为。IPG提供详尽的结构化表示,支持经验与结构性分析。DeepProv利用这些洞察,系统性地修复模型,实现鲁棒性、隐私或公平性等目标。以对抗鲁棒性为目标,案例研究显示其在多种分类任务、攻击场景和模型复杂度下均具有效性和可扩展性。该系统可自动识别IPG中节点和边级别的修复操作,显著提升模型鲁棒性。仅修复单层即平均提升55%对抗准确率。此外,DeepProv可与现有防御方法互补,在对抗鲁棒性上取得显著提升。除鲁棒性外,其还可扩展用于隐私审计和公平性分析等关键领域。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) are increasingly being deployed in high-stakes applications, from self-driving cars to biometric authentication. However, their unpredictable and unreliable behaviors in real-world settings require new approaches to characterize and ensure their reliability. This paper introduces DeepProv, a novel and customizable system designed to capture and characterize the runtime behavior of DNNs during inference by using their underlying graph structure. Inspired by system audit provenance graphs, DeepProv models the computational information flow of a DNN's inference process through Inference Provenance Graphs (IPGs). These graphs provide a detailed structural representation of the behavior of DNN, allowing both empirical and structural analysis. DeepProv uses these insights to systematically repair DNNs for specific objectives, such as improving robustness, privacy, or fairness. We instantiate DeepProv with adversarial robustness as the goal of model repair and conduct extensive case studies to evaluate its effectiveness. Our results demonstrate its effectiveness and scalability across diverse classification tasks, attack scenarios, and model complexities. DeepProv automatically identifies repair actions at the node and edge-level within IPGs, significantly enhancing the robustness of the model. In particular, applying DeepProv repair strategies to just a single layer of a DNN yields an average 55% improvement in adversarial accuracy. Moreover, DeepProv complements existing defenses, achieving substantial gains in adversarial robustness. Beyond robustness, we demonstrate the broader potential of DeepProv as an adaptable system to characterize DNN behavior in other critical areas, such as privacy auditing and fairness analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。