Adversarial Initialization - when your network performs the way I want

By Kathrin Grosse, Thomas Alexander Trost, Marius Mosbach, Michael Backes, Dietrich Klakow. 2019

8 citations recorded by the source corpus.

The increase in computational power and available data has fueled a wide deployment of deep learning in production environments. Despite their successes, deep architectures are still poorly understood and costly to train. We demonstrate in this paper how a simple recipe enables a market player to harm or delay the development of a competing product. Such a threat model is novel and has not been considered so far. We derive the corresponding attacks and show their efficacy both formally and empirically. These attacks only require access to the initial, untrained weights of a network. No knowledge of the problem domain and the data used by the victim is needed. On the initial weights, a mere permutation is sufficient to limit the achieved accuracy to for example 50% on the MNIST dataset or double the needed training time. While we can show straightforward ways to mitigate the attacks, the respective steps are not part of the standard procedure taken by developers so far.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Salvaging Federated Learning by Local Adaptation (2020, methodology): “As a consequence, the federated model is so bad for these participants than when it is used to initialize local adaptation, the ﬁnal adapted model still has poor accuracy (Grosse et al., 2019; Hanin & Rolnick, 2018).”