Publishing Efficient On-device Models Increases Adversarial Vulnerability
This addresses a security problem for developers and users of on-device AI models, highlighting an incremental but critical vulnerability in model deployment practices.
The paper tackles the security risk of publishing efficient on-device models derived from large-scale models, showing that adversaries can exploit these to increase the adversarial vulnerability of the original models by up to 100x. It proposes a defense called similarity-unpairing that reduces transferability by up to 90% and cuts query requirements by 10-100x.
Recent increases in the computational demands of deep neural networks (DNNs) have sparked interest in efficient deep learning mechanisms, e.g., quantization or pruning. These mechanisms enable the construction of a small, efficient version of commercial-scale models with comparable accuracy, accelerating their deployment to resource-constrained devices. In this paper, we study the security considerations of publishing on-device variants of large-scale models. We first show that an adversary can exploit on-device models to make attacking the large models easier. In evaluations across 19 DNNs, by exploiting the published on-device models as a transfer prior, the adversarial vulnerability of the original commercial-scale models increases by up to 100x. We then show that the vulnerability increases as the similarity between a full-scale and its efficient model increase. Based on the insights, we propose a defense, $similarity$-$unpairing$, that fine-tunes on-device models with the objective of reducing the similarity. We evaluated our defense on all the 19 DNNs and found that it reduces the transferability up to 90% and the number of queries required by a factor of 10-100x. Our results suggest that further research is needed on the security (or even privacy) threats caused by publishing those efficient siblings.