Security Risks in Deep Learning Implementations

By Qixue Xiao, Kang Li, Deyue Zhang, Weilin Xu. 2017

85 citations recorded by the source corpus.

Advances in deep learning algorithms overshadow their security risk in software implementations. This paper discloses a set of vulnerabilities in popular deep learning frameworks including Caffe, TensorFlow, and Torch. Contrary to the small code size of deep learning models, these deep learning frameworks are complex, and they heavily depend on numerous open source packages. This paper considers the risks caused by these vulnerabilities by studying their impact on common deep learning applications such as voice recognition and image classification. By exploiting these framework implementations, attackers can launch denial-of-service attacks that crash or hang a deep learning application, or control-flow hijacking attacks that lead to either system compromise or recognition evasions. The goal of this paper is to draw attention to software implementations and call for community collaborative effort to improve security of deep learning frameworks.

Subfields: Artificial Intelligence, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Model-Reuse Attacks on Deep Learning Systems (2018, neutral): “[63] investigate the vulnerabilities (e.”
Machine Learning Testing: Survey, Landscapes and Horizons (2019, background): “[238] focused on the security vulnerabilities of popular deep learning frameworks including Caffe, TensorFlow, and Torch.”
Adversarial Initialization - when your network performs the way I want (2019, background): “The same authors [41] investigate in how far the loading of the model can be manipulated by an adversary.”
On the security relevance of weights in deep learning. (2020, background): “The idea that trusting libraries can be recognized as a threat [9, 1, 18] has also been recognized in ML [23, 40].”
Red Alarm for Pre-trained Models: Universal Vulnerabilities by Neuron-Level Backdoor Attacks (2021, methodology): “Backdoor attacks insert triggers to the machine learning models to make the system perform maliciously on the trigger instances while behaving normally in the absence of the triggers (Li et al., 2020; Xiao et al., 2018).”
Seeing is Not Believing: Camouflage Attacks on Image Scaling Algorithms (2019, background): “Vulnerabilities in code implementation, such as control-flow hijacking, also could lead to recognition evasions [32].”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, background): “The literature abounds with a variety of attempts to provide greater protection to users’ private data in a neural processing system [19, 21, 54–56].”