4 ms·
Consider how you would defend this attack. If there are extra unconnected neurons, it would be trivial to just remove them, or flag them from anti-virus.
by admax88q 5y ago
Consider how you would defend this attack.
If there are extra unconnected neurons, it would be trivial to just remove them, or flag them from anti-virus.
- Imnimo 5y agoI can trivially connect the payload subnetwork in such a way that it does not impact the final the output. For example, I could gate it behind relus with large negative biases so that the outputs from the payload neurons are always zero. Besides, if I'm a defender and am suspicious enough to be modifying my network file, I can just set a random subset of the parameters to zero, simulating dropout, or even just add a small amount of noise to the low order bits of every weight. If the defender is aware enough to modify the network, then I don't think the paper's attack is any more robust than my proposed variation.