Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks .key

39 Pages·2016·9.78 MB·English

Distillation as a Defense to
Adversarial Perturbations
against Deep Neural Networks
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami
May 24th, 2016 @ 37th IEEE Symposium on Security and Privacy
@NicolasPapernot
1
M components N components
p0=0.01
…
p1=0.93
… … …
“Type a quote here.”
p8=0.02
{
pN=0.01
–Johnny Appleseed
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron Weighted Link (weight is a parameter part of ✓ )
O
2
M components N components
p0=0.01
…
p1=0.02
… … …
“Type a quote here.”
p8=0.89
{
pN=0.01
–Johnny Appleseed
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron Weighted Link (weight is a parameter part of ✓ )
O
3
4
Deep Learning for Classification
5
M components N components
… … …
{
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron ✓
Weighted Link (weight is a parameter part of )
O
6
M components N components
… … …
{
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron ✓
Weighted Link (weight is a parameter part of )
O
7
M components N components
… … …
{
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron ✓
Weighted Link (weight is a parameter part of )
O
8
M components N components
… … …
{
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron ✓
Weighted Link (weight is a parameter part of )
O
9
M components N components
… … …
{
Input Layer Hidden Layers Output Layer
(e.g., convolutional, rectified linear, …)
Neuron ✓
Weighted Link (weight is a parameter part of )
O
10