Defending against Stegomalware in Deep Neural Networks with Permutation Symmetry
This addresses a significant security concern for deep learning practitioners and security specialists, who have largely neglected the risk of malware in shared neural network checkpoints.
The paper tackles the threat of stegomalware embedded in deep neural network checkpoints, proposing a defense method that neutralizes state-of-the-art attacks by shuffling weight matrix columns or convolutional channel orders, achieving this at no cost to network accuracy and outperforming competing methods.
Deep neural networks are being utilized in a growing number of applications, both in production systems and for personal use. Network checkpoints are as a consequence often shared and distributed on various platforms to ease the development process. This work considers the threat of neural network stegomalware, where malware is embedded in neural network checkpoints at a negligible cost to network accuracy. This constitutes a significant security concern, but is nevertheless largely neglected by the deep learning practitioners and security specialists alike. We propose the first effective countermeasure to these attacks. In particular, we show that state-of-the-art neural network stegomalware can be efficiently and effectively neutralized through shuffling the column order of the weight- and bias-matrices, or equivalently the channel-order of convolutional layers. We show that this effectively corrupts payloads that have been embedded by state-of-the-art methods in neural network steganography at no cost to network accuracy, outperforming competing methods by a significant margin. We then discuss possible means by which to bypass this defense, additional defense methods, and advocate for continued research into the security of machine learning systems.