arXiv:2606.04317cs.CRcs.LG2026-06

提出通用防御方法ParDef,对抗各类参数攻击并保持模型性能。

Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

论文配图:Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks
图 1 · 摘自论文原文
  • 用密钥通道重参数化隐藏敏感参数方向
  • 通过QC-LDPC量化实现纠错冗余,降低攻击成功率
  • 适合部署在云端、边缘等不可信环境中的模型防护

深度神经网络正广泛部署于异构且部分不信任的环境中,如云存储、CI/CD流水线、容器化服务和边缘执行平台。这种部署场景使模型参数面临多种完整性风险。与输入空间对抗攻击不同,参数攻击直接篡改模型内部参数,且影响持续存在于所有后续推理中。现有防御方法或需重新训练、显著降低准确率,或仅针对特定攻击类型。但在真实场景中,参数攻击形式往往不可预测。为此,本文提出ParDef,一种针对多样化参数攻击的通用防御机制。ParDef融合了密钥通道重参数化(遮蔽敏感参数方向)、QC-LDPC量化(嵌入冗余支持纠错)和自适应鲁棒推理(在不确定性下稳定预测)。在CIFAR-10、CIFAR-100和Tiny-ImageNet上使用ResNet和VGG模型的评估表明,ParDef在多种参数攻击下均显著降低攻击成功率,同时维持高模型性能,部署开销适中。结果表明,ParDef是深度神经网络部署中实用且通用的防御方案。

原文摘要 · Abstract (English)

Deep neural networks are increasingly deployed across heterogeneous and partially untrusted environments, where models are distributed through cloud storage, CI/CD pipelines, containerized services, and edge execution platforms. This broad deployment landscape exposes model parameters to various integrity risks. Unlike input-space adversarial attacks, parameter attacks directly tamper with the model's internal parameters and persist across all subsequent inferences. Existing defenses either require retraining, incur significant accuracy degradation, or are limited to specific attack classes. However, in real-world deployment scenarios, the forms of parameter attacks are often unpredictable. To address this challenge, we present ParDef, a generalized defense for deep neural networks against diverse types of parameter attacks. ParDef integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty. Our evaluation on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and VGG models demonstrates that ParDef consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead. These results highlight that ParDef is a practical and generalized defense for DNN deployments.

模型安全参数攻击防御机制深度学习

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。