一句话：提出全动态模型混淆策略 DynaMO，用随机耦合算子的线性变换在运行时保护移动端 DL 模型，抵御动态插桩攻击。
移动应用中部署深度学习模型日益普遍，但攻击者可逆向工程模型以窃取知识产权或构造有效攻击。现有模型混淆方法或为静态混淆，或为半动态混淆（需用户通过额外输入参数恢复模型信息），均无法在运行时隐藏敏感信息。本文先用插桩方法与工具 DLModelExplorer 动态提取运行时的正确权重与计算图，评估现有混淆策略的脆弱性，攻击性能极高（权重提取率 98.76%，混淆算子分类率 99.89%）。为抵御此类动态插桩攻击，作者提出 DynaMO——一种类似同态加密的全动态模型混淆策略：对随机耦合的合格算子权重进行简单线性变换，即可完成混淆与恢复，无需额外输入参数。实验表明，该策略相比现有混淆策略显著提升模型安全性，且对设备端模型的开销可忽略。原型工具已开源。
Deploying deep learning (DL) models on mobile applications (Apps) has become ever-more popular. However, existing studies show attackers can easily reverse-engineer mobile DL models in Apps to steal intellectual property or generate effective attacks. A recent approach, Model Obfuscation, has been proposed to defend against such reverse engineering by obfuscating DL model representations, such as weights and computational graphs, without affecting model performance. These existing model obfuscation methods use static methods to obfuscate the model representation, or they use half-dynamic methods but require users to restore the model information through additional input arguments. However, these static methods or half-dynamic methods cannot provide enough protection for on-device DL models. Attackers can use dynamic analysis to mine the sensitive information in the inference codes as the correct model information and intermediate results must be recovered at runtime for static and half-dynamic obfuscation methods. We assess the vulnerability of the existing obfuscation strategies using an instrumentation method and tool, DLModelExplorer, that dynamically extracts correct sensitive model information (i.e., weights, computational graph) at runtime. Experiments show it achieves very high attack performance (e.g., 98.76% of weights extraction rate and 99.89% of obfuscating operator classification rate). To defend against such attacks based on dynamic instrumentation, we propose DynaMO, a Dynamic Model Obfuscation strategy similar to Homomorphic Encryption. The obfuscation and recovery process can be done through simple linear transformation for the weights of randomly coupled eligible operators, which is a fully dynamic obfuscation strategy. Experiments show that our proposed strategy can dramatically improve model security compared with the existing obfuscation strategies, with only negligible overheads for on-device models. Our prototype tool is publicly available at https://github.com/zhoumingyi/DynaMO.
@inproceedings{paperbot8275,
title = {DynaMO: Protecting Mobile DL Models through Coupling Obfuscated DL Operators},
author = {Mingyi Zhou and Xiang Gao and Xiao Chen and Chunyang Chen and John Grundy and Li Li},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3694998}
}