DeepGuiser: Learning to Disguise Neural Architectures for Impeding Adversarial Transfer Attacks
Authors: Yi Cai
Chenyu Wang
Xuefei Ning
Zixuan Zhou
Dimin Niu
Huazhong Yang
Yu Wang
Venue: Submitted to ICLR 2023 (2023)
Keywords: Neural architecture extraction attack
neural architecture disguising
adversarial robustness
transferability predictor
policy learning

Abstract: Security is becoming increasingly critical in deep learning applications. Recent researches demonstrate that NN models are vulnerable to adversarial attacks, which can mislead them with only small input perturbations. Moreover, adversaries who know the architecture of victim models can conduct more effective attacks. Unfortunately, the architectural knowledge can usually be stolen by the adversaries by exploiting the system-level hints through many side channels, which is referred to as the neural architecture extraction attack. Conventional countermeasures for neural architecture extraction can introduce large overhead, and different hardware platforms have diverse types of side-channel leakages such that many expert efforts are needed in developing hardware-specific countermeasures. In this paper, we propose DeepGuiser, an automatic, hardware-agnostic, and retrain-free neural architecture disguising method, to disguise the neural architectures to reduce the harm of neural architecture extraction attacks. In a nutshell, given a trained model, DeepGuiser outputs a deploy model that is functionally equivalent with the trained model but with a different (i.e., disguising) architecture. DeepGuiser can minimize the harm of the follow-up adversarial transfer attacks to the deploy model, even if the disguising architecture is completely stolen by the architecture extraction attack. Experiments demonstrate that DeepGuiser can effectively disguise diverse architectures and impede the adversarial transferability by 13.87% ∼ 32.59%, while only introducing 10% ∼ 40% extra inference latency.

Under review as a conference paper at ICLR 2023
DEEPGUISER: LEARNING TO DISGUISE NEURAL AR- CHITECTURES FOR IMPEDING ADVERSARIAL TRANS- FER ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Security is becoming increasingly critical in deep learning applications. Recent researches demonstrate that NN models vulnerable adversarial attacks, which can mislead them with only small input perturbations. Moreover, adversaries who know the architecture of victim models can conduct more effective attacks. Unfortunately, the architectural knowledge can usually be stolen by the adversaries by exploiting the system-lever hints through many side channels, which is referred to as the neural architecture extraction attack. Conventional countermeasures for neural architecture extraction can introduce large overhead, and different hardware platforms have diverse types of side-channe leakages such that many expert efforts are needed developing hardware-specific countermeasures. In this paper, we propose DeepGuiser, automatic, hardware-agnostic and retrain-free neural architecture disguising method, to disguise the neural architectures to reduce the harm of neural architecture extraction attacks. In nutshell, given trained model, DeepGuiser outputs a deploy model that is functionally equivalent with the trained model but with different (i.e., disguising) architecture. DeepGuiser can minimize the harm of the follow-up adversarial transfer attacks to the deploy model, even if the disguising architecture is completely stolen by the architecture extraction attack. Experiments demonstrate that DeepGuiser can effectively disguise diverse architectures and impede the adversarial transferability by 13.87% 32.59%, while only introducing 10% ~ 40% extra inference latency.
INTRODUCTION
Deep neural networks (NNs) have made great success the field of artificial intelligence (AI) (LeCun
et al. 2015). With NN becoming increasingly complex, number of NN-specific chips (Juuppi et al.
2017
Liao et al.] 202T Markidis et al.] 2018 and intensive innovations (Chen et al., 2020 Quu et al.
2016
Chen al. (2014) have been proposed boost the efficiency of NN computing. Despite the
significant progress in hardware performance, security should also be regarded as a higher-priority feature. Especially in safety-critical applications, e.g. autonomous driving, surveillance, and forth,
security vulnerabilities can be exploited by adversaries and lead to uncontrollable consequences.
Confidentiality is an essential guarantee for systemic security. The critical confidential information contained in well-trained NN models mainly includes their neural architectures and weight parame- ters. While the encryption of weight parameters has been well discussed for protecting the weight confidentiality (Orlandi et al.) 2007: CCa et al.) 2019 Zuo et al. 2021p. the protection of neural architectures still in lack. Recent researches have alerted that many emerging or even off-the-shell Al chips are vulnerable to neural architecture extraction attacks (Batina et al. 2018 Hua et al. 2018
Yan et al. 2020 Hu et al. 2020 Wei et al. 2018 Wang et al. (002).. For example, DeepSniffer (Hu al.) 2020) exploits the system-level hints (e.g. memory access activity, cache miss rate, etc.) of NN approach to automatically identify the layer sequences. It also guantitatively shows that the neural architecture extraction
processing on GPU platform and proposes a learning-bass
significantly boost the success rate of adversarial transfer attacks by constructing a surrogate model with almost the same neural architecture the victim model (Demontis et al. 2019 Hu et al. 2020

---

Under review as a conference paper at ICLR 2023
Trained Model
Adv. Attack The Deployed Model
Trained Model
The Adversarial Transferability lowered
Generate Examples Exploiting the High Transferability of Surrogate
DeepGuiser
Deploy Model with
Disguising Architecture
Train a Surrogate Model
Deploy
Weight Bufter
Off-chip DRAM
Inpus Buffeer
Snoop The System:
Extract the Architecture
Extract Architecture And Train Surrogate
Figure 1: (Left) I: The adversary can snoop the system to extract the architecture of the deployed model. 2&3: The architecture information can be utilized to train a surrogate with high transferability and then craft effective adversarial examples to attack the trained model. (Right) DeepGuiser disguises the trained model to a functionally equivalent deploy model with disguising architecture. Then, this deploy model is deployed onto the chip. Even if the adversary extracts the disguising architecture through snooping and trains the surrogate model, the adversarial examples crafted using the surrogate have low transferability to the original trained model and also the actual deployed model.
The high risk rendered by neural architecture extraction attacks necessitates the protection of neural architectures. On one hand, from the view of intellectual property protection, neural architectures are usually manually designed by experts (He et al. 2016 Simonyan & Zisserman [014] Sandler
al. 2018) automatically designed by neural architecture search (NAS) (Cai al. 2018 8 Liu et al. 2018b Tan et al. 2019), both of which consume significant labor and resources. On the other hand, from the view of adversarial robustness, the architecture of the deploy model leaked, the adversaries can train a surrogate model with the same architecture and use it craft much more effective adversarial examples to attack the deploy model by exploiting the high transferability between the surrogate and deploy model (Hu et al. 2020
is hard to design universal protection scheme against neural architecture extraction attacks for different kinds of AI chips the system hardware level, various design options affect the hardware characteristics. Diverse run-time side-channel information can exploited to extract the neural architectures different hardware platforms, e.g. power (Wei et al. (0188), cache activity (Yan) et al., 2020), memory access (Hua et al. 2018), etc. And blocking all these side-channel leakages by designing hardware-specific countermeasures might consume huge system costs and expert efforts.
In this work, we propose an "architecture disguising" solution at the algorithm level, DeepGuiser, which protects the architecture information by disguising it before deployment and alleviates the security risk rendered from the architecture extraction and the follow-up adversarial transfer attacks. Fig (Left) illustrates the attack scenario we are concerned about, and Fig (Right) demonstrates how DeepGuiser plays its role. And as there exist diverse models to be deployed and the disguising space (introduced in Sec. 4.1 extremely large, manually finding good disguising architecture for every possible model is extremely costly and even impossible. Therefore, we design DeepGuiser to automatically and efficiently yield a good disguising architecture for given trained model. We summarize contributions follows:
DeepGuiser is automatic, hardware-agnostic, and retrain-free neural architecture disguising framework. As shown in Fig. (Right) given trained model, the disguising policy in DeepGuiser takes the original architecture the input, and outputs disguising architecture. Then, with "deploy model" that is functionally equivalent with the trained model but with the disguising architecture. This deploy model is deployed, and even its architecture is stolen, the harm of the follow-up adversarial transfer attacks to the deploy model can be largely reduced.
-rreaaarity-rseevingg weight transforms, DeepGuiser yields a
2

---

Under review as a conference paper at ICLR 2023
We use reinforcement learning (RL) to train the disguising policy to output disguising architectures with low adversarial transferability to the original architecture. During the training process,
predictor for bridging the evaluation gap of the adversarial transferability between weight-sharing super-net and standalone training.
For training the predictor, we build a dataset Trench,yBench, which collects and evaluates the adversarial transfcrability of over 8000 pairs of neural architectures. TransAdyBench can also help us study the connection between the architecture characteristics and adversarial transferability, and we list some of the knowledge in the appendix|A.2
Experimental results show that with DeepGuiser, the adversarial transferability of the surrogate model with the disguising architecture to the deploy model decreases by 13.87% 32.59% while only introducing 10% 40% extra latency for the deploy model on GPU.
2
RELATED WORK
2.1 NEURAL ARCHITECTURE EXTRACTION ATTACKS
Many studies have proposed attack methods for extracting the neural architecture of deployed models
variety of hardware platforms (Batina al.) [2018] Hua et al. 2018 Yan et al., 2020 Hu et al.)
2020: Wei et al. 2018). For example. Hua et al. (2018) reveals the network architectures by utilizing the observed memory access pattern during the NN inference. DeepSniffer (Hu al. (020) proposes a learning-based operator recognition method by utilizing long short term memory (LSTM) network. Its basic idea is learn the correlation between the system hints and the layer types. There are other side-channel information that can also be utilized to recognize the operations and topology, e.g. counting the GEMM calls via cache side-channel (Yan et al. 2020), observing the patterns and timing of operations (Batina et al. (2018), cache miss rate (Hu et al. al. 2020), etc. For example, scalar computation (e.g. ReLU) has higher cache miss rate compared tensor computation (e.g. convolution) the data reuse rate is much lower. These attack methods pose severe security risks for Al systems.
2.2 DEFENSIVE APPROACHES
There are two main streams of methods for defending against neural architecture attacks. One is to block the side channel leakage such that any adversary cannot obtain corresponding information. For example. memory access pattern and trajectory are important hints for helping the adversary reconstruct the network topology. The most promising solution, oblivious random- accesss machine (ORAM) protocol (Goldreich & Ostrovsky 1996), can prevent the attacker from obtaining the actual access behavior. However, it is practically infeasible to apply ORAM owing to the unacceptable communication blowup. The most efficient implementation, Path ORAM (Stefanov et al. 2018). still has an overhead of (log(N)) blowup. Since data moving has already taken significant proportion of time in NN computing, a great efficiency degradation will occur bandwidth-liman chips.
Another stream of work is to obfuscate the neural architecture. However, the current methods are explicitly designed for defending against specific attack methodologies or with a high obfuscation cost. For example, NeurObfuscator (Li et al. 2021 is an obfuscation framework specifically targeting at increasing layer prediction error rate of the adversaries, without considering the ultimate criterion. ObfuNAS (Zhou al. 2022) targets on hiding the accuracy performance, while requiring searching process for every victim architecture.
2.3 NEURAL ARCHITECTURE SEARCH AND TRANSFORMATION
Neural architecture search (NAS) methods (Cai et al. 2018 Tan et al. 2019 Liu et al. 2018b)
are widely studied to automatically design advanced architecture with superior performance in substitution of the hand-crafted design process. Essentially, NAS provides a convenient way for designers to explore a large architecture search space. Evaluation is one of the key components of NAS. To achieve fast and accurate estimation on the substantial architectures, predictor and architecture encoding methods are intensively discussed, e.g. GCN (Kipf & Welling) 2017; Guo jet al. 2019). MLP (Liu et al. 2018a), GATES (Ning et al., 2020), etc. These schemes encode an architecture into continuous embedding, which is used in the follow-up performance estimation.
3

---

Under review as a conference paper at ICLR 2023
0
0
0
comv5v5
0
W
con3333
0
0
sep donv 3x3
3x3
sep_ cony 5x5
0
dha cony 3x3
0
CONY 1x1
conv 3x.3
The pool 3x3
0
skip
Ixl
max pool 3x3
0
0
0
cOnv 3x3
comv 3x.3
skip comnect
2
Functional Equivalent
2
mill
cone5ss
conviga
conety Ixl
sep cast 555
sg. conte 353
wn paod 3&3
max yool 2g
auip connect
nall
Computational Different
out
out
(c)
Figure 2: (a) The inclusion matrix of diverse operations in our implementation. The vertical axis represents original type and the horizontal axis represents the transformed type. In the table, "I" means corresponding disguising is valid and "0" means invalid; (b) an example of candidate neural architecture; (c) Disguised neural architecture from (b) based
the rules in (a). For example, transforming an Ixl convolution kernel to 3x3 only needs to pad a surrounding zeros, then the two architectures are functionally equivalent while computationally different.
Neural architecture transformer (NAT) (Guo et al. 2019) aims to transform architecture into pruned one. It employs RI. to train a policy that takes the original architecture as the input, and decides how to change each operation to get an architecture with fewer FLOPS and higher performance.
THREAT MODEL
The threat model considered is neural architecture extraction through hardware side-channel attacks, e.g., controlling the off-chip memory or snooping the communication bus. The adversary will obtain some hints that can help infer the deployed neural architectures through them. In edge computing scenarios, with Al becoming ubiquitous and mobile, more and more edge devices are powered with intelligence. An adversary can easily obtain physical access to the device by acquisition or theft. In cloud computing scenario, an honest but curious cloud service provider may also seek the knowledge of NN models running the cloud. They may fail to get the weight parameters due encryption technologies (e.g., homomorphic eneryption (Orlandi et al. (007]), ) while it is much easier to reveal the model architectures because rich side-channel information can be observed.
We consider a strong threat model that the attackers can exactly extract the neural architecture of deployed models on some device while having no ability to obtain the weight parameters as the weight encryption techniques are relatively mature and strong. Then by training a surrogate model with the same neural architecture as the victim deploy model, the attackers can achieve a much higher adversarial attack success rate (Hu et al.) 20200 Demontis et al. (201)). Under this scenario (illustrated Fig F (Lef)), the goal of neural architecture disguising is to find a disguised architecture that has lowest possible adversarial transfcrability to the actual deploy model.
4 METHOD
4.1 PROBLEM DEFINITION
Given an architecture A, the objective of neural architecture disguising is to substitute subset of its operations (layers) or add some operations (layers) to change its topology. Denoting A as directed acyclic graph (DAG), it can be represented as A (V, E), where a set of nodes that represent the feature maps, and E is set of edges that represent the operations. For each operation eij. it computes on the feature map e and produces feature map zy. Assuming eiy = Ok, an operation disguising is to change O₂ to Om. satisfying that Om E I(Ox). Here we define "E" as the inclusion relationship. and I (Ox)) as the valid transformation set of operation Oş- Then, any operation transformation can only occur within its transformation set.
4

---

Under review as a conference paper at ICLR 2023
0.8
Super Evaluation
Procictor Prediction
Optimal Evaluation
0.8
Optimal Prediction
Super-net Evaluated Success
0.7
SpearmanR: 0.57
Prodicted Advercarial Accuracy
SpearmanR: 0.73
0.5
0.5
0.4
0
88
800
0.4
00
00
0.2
00
0000
0.2
0.1
0.3
Ground-truth Success Rate
Ground-truth Adversarial Accuracy
Figure 3: Adversarial transferability evaluation. Left: one-shot evaluation within super-net versus the ground-truth attack success rate; Right: evaluation with designed predictor versus the ground-truth transfer adversarial accuracy. The Spearman ranking correlation reflects the ranking quality of corresponding estimation.
Disguising Space. A principle of neural architecture disguising is maintaining equivalent functionality with the original model because functional correctness must be guaranteed. We can derive the disguising space according this requirement, and design the corresponding functionality-press weight transforms for each operation disguising. For example, as shown in FbgD)- a 1x1 convolution can be disguised the 3x3 convolution can perform equivalent function as 1xl convolution. Fig Fig a) concludes the disguising matrix of different operators. The matrix is applicable on any hardware because these rules are independent of the specific hardware implementation.
3x3 convolution by padding its surrounding values zero, then
Problem Formalization. Given an architecture A, the goal is find an architecture B disguised from A to impede the adversarial transferability from B to A. Denoting Ag = (E1, e2. en) as the aad.....rn Ends C(n+1)ds ... C(n+m)a) as operation set of the architecture B, the following constraint should be satisfied:
operation of the architecture and Bg (Cid: C2d. ...,
1 i S (mnull),
(eea),
e; E
< < a m
The objective is to minimize the loss of A on adversarial examples which are generated based on B. Considering adversarial example z'g (z). it is usually formulated as:
d's (x) argmax, (z, v), s.t.l z|1p S
where fs(()) denotes the forward function of entire model B, x denotes the clean input, denotes the label, z denotes the adversarial example, denotes the loss function (often as utilized training), and denotes the adversarial perturbation strength. llp denotes the I, norm, usually including 4, 1z, and loo, etc. Then the optimization problem for finding architecture B can be formalized as:
argming
(r (x,9)Ex
Σ
s.t.B I(A),
where X represents the dataset, and T(.) represents the disguising space of some architectures. To measure the expectation, we use the boosted adversarial accuracy of A under the transfer attack of B the reward, denoted A)B That is,
R(BIA) Adv Adc
Unfortunately, the optimization problem is challenging solve because of the problems from two aspects, i.e. evaluation and exploration.
Evaluation Problem. The evaluation of the reward is challenging. A standard evaluation requires training-generattinn generation test process, i.e. training a model with the disguised architecture B, generating adversarial examples from model B, and testing the adversarial accuracy of AA by using the adversarial
5

---

Under review as a conference paper at ICLR 2023
examples to attack A. Despite the process can give accurate transferability evaluation, all the steps (especially training) are time-conuuming The weight-sharing mechanism (Pham et al. 2018) Ning et al.) 2021) is widely used in the NAS literature to accelerate the evaluation of architecture performances, i.e., to evaluate any architecture, the model directly uses the corresponding weights from a weight-sharing super-net. In this way, the above process be simplified to generation-test process by training a single super-net before the evaluation. However, we empirically find that the adversarial transferability evaluated by the super-net has non-negligible gap with the ground-truth evaluations, is shown in Fig Figft,.... To address this problem, we propose a transferability predictor to fast and accurately estimate the adversarial performance, as will be introduced in See S.c4.2
Exploration Problem. Exploring the large disguising space also poses a challenge. Even with strict transformation constraints, the disguising spaces for most architectures still extremely large. For example, ResNet cell architecture shown in Fig. has approximately (69 x 2 x 2) >>>>> 10t1 possible disguised architectures within the DARTS (Liu al. 2018b) search space. Denoting p(-|-A) as the probability distribution of sampling architecture B from the disguising space of A, given the original architecture A, we aim to find the disguising architecture distribution p(-(A) that maximizes Eg-r(-|AA) [R(B B A)). An intuitive idea is to learn policy T--l.A) that takes A as the input and outputs the disguising architecture distribution for it. We model the disguising architecture distribution using the joint distribution of multiple operation disguising decisions. To learn this disguising policy, employ policy gradient with our specific reward design R, as will be described in Sec
The overall framework of DeepGuiser is shown in Fig 4 a). In the following, we will introduce the
two main parts of DeepGuiser.
4.2 PREDICTOR: RESOLVING THE EVALUATION PROBLEM
To simultaneously achieve a fast and accurate evaluation on the adversarial transferability of any two architectures, we design predictor to directly predict the adversarial accuracy given victim architecture A and a surrogate architecture B, i.e. the expectation (e. (r'g(
Predictor Construction. The predictor consists of an architecture encoding block for transforming a discrete architecture into a continuous embedding space, and a regression head for predicting the adversarial accuracy from the architecture embedding. Specifically, we adopt graph-based architecture encoder GATES (Ning et al. 2020) to convert an arbitrary architecture A to an embedding vector. Then, the embedding will be fed into an MLP-based regressor for regressing the adversarial accuracy, as shown in Fig Cc).
Loss Function.
The output of the predictor is regression value which indicates the adversarial accuracy of architecture A over the adversarial examples generated by B, we adopt the mean square error (MSE) loss to train the predictor.
[(pp, A, B, = (r(g(A4), 9B3)))) - +)
(5)
where r(.) denotes the regressor over two input architecture embedding, g(-) denotes the architecture encoder GATES, 0p denotes the parameters of the predictor, t denotes the ground-truth adversarial accuracy of A under the attack from B. Fig 3 (Right) shows the performance of the trained predictor. Compared to the super-net-base evaluation, the predictions are faster and more accurate.
4.3 POLICY LEARNING: RESOLVING THE EXPLORATION PROBLEM
We denote the disguiser function as fa. Specifically, the disguiser parameters 0a will be trained with the estimation of adversarial transferability given by the predictor.
Disguiser construction. Similar to the predictor, the disguiser also consists of an architecture encoding module that encodes an arbitrary architecture A to an embedding, and an MLP module that produces the policy π (-I.A). The computation of the disguiser can be represented as:
न (+I(A;0a) Softmax((f(s(A))00))
(6)
Policy Gradient. We apply policy gradient learn the disguising policy. As the goal is to maximize the final reward R(B,A) A), the objective function can be formulated as:
maxx(-1A) EA (- (R(BAA)),

---

Under review as a conference paper at ICLR 2023
DeepGuiser
Evaluation
Fast Accurate
Disguising Space
Disguiser
Disguised Architecture
S
ST
ArchiteeArh
(b)
Transferability Evaluation
PD
Predictor
(a)
stand-alone PD: predictor
super-net
GATES Encoder
Prediction:
Neural Architecture
Adversarial accuracy of 8 A
Ave pooling
Pollcy:
Max pootin
Skip cornect
Ausoona
68% connect
Conu
(c)
Architacture Embedding
Op n conv 1x1: 53%
Figure 4: The framework and structure of DeepGuiser. (a) Overall flow of learning DeepGuiser, (b) Pros and cons of different evaluation methods; (c) the basic structure of predcitor and disguiser.
where p(-) is the probability distribution for sampling some architecture A. In addition, we add two terms into the commonly-used loss function. Firstly, the operation disguising always introduces larger computational FLOPs and latency. Therefore, we add a penalty term on the reward corresponding to the transformed operation count, denoted as c(-l-A). Secondly, introduce similar entropy regularization term H (=((-IA;;aa) to encourage exploration. In summary, the objective function can be formulated as:
c(B]A)) ( (R(B)A) Lpolscy((0 (0a) = E. Amp()) [R (-1A:t
(A:8a)
(H
= p(A) ग (B]]A:0a) c(B]A)) AH (((((()):)
(8)
Specifically, in implementation, the involved functions formulated follows respectively:
R(BIA) = r(g(AA).(B)) - (lgp:))))))(((())(((())))))) (()()), c(BlA) = 2m
where na is the number disguised operations the cell architecture (i.e. n. = # Difff B)). ) hyper-parameter that controls the penalty intensity. H(-) denotes the entropy of the distribution.
Inference. To infer disguising for architecture A, we directly obtain the disguised architecture by B [aA 0a). Specifically, we obtain probability distribution for each operation in the cell architecture, and the transformation with the maximum probability will selected for disguising.
EXPERIMENTAL RESULTS
5.1 EXPERIMENT SETTINGS
Benchmark. We evaluate the effectiveness of DeepGuiser a variety neural architectures. including popular hand-crafted architectures (ResNet (He et al. 2016), VGG (Simonyan & Zisserman 2014), and MobileNet-v2 (Sandler et al., (018g) and randomly-picken
architectures. We conduct experiments three classification datasets, including CIFAR- 10 (Krizhessky et al. 2009). CIFAR- 100 (Krizhessky et al. 2009), and Tiny-ImageNet (Le & Yang 2015) to demonstrate the generalization of adversarial transferability of specific architecture disguising. We choose projected gradient descent (PGD) (addry et al.) 2017) with 10 steps under the perturbation strength generate adversarial examples and evaluate the adversarial accuracy. We also try C&W (Carlini & Wagner, 2017), Attokt (Croce & Hein 2020), and DI-FGSM (Xie et al.] 2019) adversarial example generation methods evaluate the generalization diverse attacks. For evaluating the
0.031 (8/255) to
7

---

Under review as a conference paper at ICLR 2023
Table Results of neural architecture disguising by different methods on CIFAR-10. AcCade means the adversarial accuracy of the original model under black-box transfer attack from the disguised models. The Random-Arch and Random disguising report the average values of 20 randomly sampled
architectures. The latency is tested an NVIDIA GeForee RTX 3090 by averaging 1000 times of forward inference. "I" represents higher better and "t" represents lower better.
Model
Method
#Params (M)
#FLOPS (M) 1
Latency (ms)
AcCeloan (
AcCade (S8)
0.605
91.4
14.35
91.49
13.75
Random
1.55
232.0
21.71
93.03
26.31
ResNet20
DeepGuiser-OS
155.0
32.52
91.23
39.92
DeepGuiser
182.4
89.06
46.34
0.605
91.4
13.29
88.82
24.89
Random
1.52
227.7
21,93
92.62
26.83
VGG16
DeepGuiser-OS
1.08
152.6
29.55
92.33
31.26
DeepGuiser
1.18
176.2
16.54
84.95
46.17
0.257
46.2
15.08
88.39
15.31
Random
1.16
180.6
23.18
92.97
30.05
MobileNetV2
DeepGuiser-OS
0,801
119.1
30.33
92.35
41.80
DeepGuiser
0.305
54.7
19.02
87.74
29.18
0.812
122.3
15.9
90.19
33.23
Random
1.98
276.1
22.7
92.43
44.96
Random-Arch
DeepGuiser-OS
196.5
27.7
91.70
51.38
DeepGuiser
1.49
216.3
23.3
91.49
47.58
computational cost, we provide statistics of parameter size, FLOPS, and running latency of those architectures. The "DeepGuiser-OS" method represents the disguiser trained upon the one-shot evaluation given by weight-sharing super-net.
Search Space. We take DARTS search space (Liu ct al. 2018b) effectiveness of our method. Specifically, the cells are classified into normal cell and reduction cell. Both the cells contain 2 input node and intermediate nodes. Every node be the end of at most two edges. total of 9 operation types are involved, as listed in Fig[[a), a). For every conducted architecture, the base channel set as 20 and the number of cells is set 8.
example to evalaute the
The length of embedding vector produced by GATES set as 128. Then the regressor MLPP structure is 256x64x (as will concatenate the embedding of two architectures for prediction). The disguiser MLP structure is 128x256x5 12x544, where 144 equals (8 (operations in normal cell) + 8 (operations reduction cell)) 9 (possible disguising options).
Structure.
Training Details. The training of DeepGuiser contains two parts. For the training of predictor, we utilize the constructed dataset BranshdvBench built upon the DARTS search space, including 8,082 pairs of neural architectures as train data and 484 pairs as test data (see Appendix A.1 for more details). We train the predictor by setting the learning rate as 0.001, batch size as 64, epochs as 30, and weight decay as 0.0005. For the training of disguiser, we set the learning rate as 3e-4, iteration number as 10a, entropy coefficient as 0.003, penalty controller as 10.
5.2 THE RESULTS OF IMPEDING ADVERSARIAL TRANSFERABILITY
concluues the key metrics for evaluating the effectiveness and efficiency of neural architecture disguising. As can be seen, DeepGuiser can find better policy for disguising diverse architectures to defend against architecture extraction attacks. Compared to constructing surrogate model with the same architecture as the victim model, when an adversary can only obtain the disguised fake architecture, the attack success rate will significantly drop, e.g. 33.55% higher adversarial accuracy will maintained for ResNet20 when it is attacked by the disguised ResNet20. We also evaluate the cost for disguising those architectures. Inevitably, disguising will introduce extra computation and parameters. The experiments show that DeepGuiser outperforms the other methods at even a lower latency cost. Moreover, surprisingly find that the clean accuracy of disguised architectures by DeepGuiser also significantly drops, further reducing the profits of the adversaries from the attacks, i.e. the attacker obtains much worse architectures while the actual architectures are hidden.
8

---

Under review as a conference paper at ICLR 2023
Table 2: Results of neural architecture disguising under different attack methods. All numbers are the adversarial accuracy of the original model under black-box transfer attack from the disguised models.
Model
Method
AutoAttack
C&W
DI-FGISM
Average
4.2
20.21
1.1
8.5
Random
15.49
23.77
9.45
16.24
ResNer20)
DeepGuiser-OS
17.46
24.8
10.28
17.51
DeepGuiser
15.3
30.58
11.16
19.01
8.2
22.98
3.29
11.49
Random
11.73
25.03
8.73
15.16
VGG16
DeepCiisse--OS
24.08
27.94
16.98
DeepGuiser
22.83
31.52
15.07
23.14
5.5
10.01
MobileNetV2
Random
14.96
24.25
12.02
17.08
DeepGuiser-OS
23.18
24.17
18.48
21.94
DeepCuiser
Table 3: Results of neural architecture disguising by different methods on CIFAR-100 and Tiny- ImageNet. AcCade means the adversarial accuracy of the original model under black-box -ox transfer attack from the disguised models. "1" represents higher better and represents lower better.
CIFAR 100
Tiny ImageNet
Latency (ms)
Accatos (%) L
Accade (8)
Latency (mss)
Acc.teon (9)
Accade (%)
44.92
14.46
ResNer20
DeepGuiser-OS DeepGuiser
27.12
68.54
42.84
26.20
53.28
23.38
18.01
63.86
40.70
18.66
47.62
23.72
13.25
62.39
24.77
13.96
40.76
21.65
VGG16
DeepGuiser-
DeepGuiser
23.23
53.07
39.87
15.96
41.23
25.25
15.54
15.97
41.26
MobileNetV2
DespGuiser-OS
25.21
69.74
36.71
26.41
53.92
24.64
DeepGuiser
5.3 GENERALIZATION ON DIFFERENT ATTACK METHONS
In this experiment, we evaluate the generalization of adversarial transferability under different attack methods. Table concludes the results. As can be seen, the adversarial transferability from surrogate models to victim models can still be impeded (though not as significant as under PGD attack) with different adversarial cxample generation methods. This climinates the need build dataset corresponding to each attack method and perform repeated training for all types of attacks.
5.4 GENERALIZATION OF THE DISGUISING POLICY TO OTHER DATASETS
We explore whether the disguising policy trained on CIFAR-10 10 can be utilized other datasets. We test the adversarial transferability of the disguising architecture to the original architecture on CIFAR-100 and Tiny-ImageN As shown in Table 3 the disguised architectures still demonstrate consistent results as in the experiments on CIFAR-IO. The results suggest that the transferability between architectures largely determined by their architecture characteristics and general on different datasets. That is to say, DeepGuiser can be trained on proxy dataset like CIFAR- 10 and generalized other datasets, eliminating the need to collect TransAdyBench for every new dataset.
CONCLUSION
In this work, we propose DeepGuiser to automatically disguise neural architectures for impeding the adversarial transfer attacks after neural architecture extraction. DeepGuiser employs predictor that predicts the adversarial transferability between architectures to learn a disguising policy to transform the architecture operations. DeepGuiser converts the trained model to a functionally-equivalle "deploy model" with a disguising architecture in hardware-agnoste and post- post-training way, which retraining fine-
can be applied matter what hardware platform is used and incorporates tuning of the trained model. Experimental results show that DeepGuiser can effectively impede the effectiveness of adversarial transfer attacks following the architecture extraction attack.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. Csi neural network: Using side- channels to recover your artificial neural network information. arXiv preprint arXiv: 1810.0000000000 09076, 2018.
Han Cai, Ligeng Zhu, and Song Han. Proxylessnas: Direct neural architecture search on target task and hardware. arXiv preprint arXiv:1812.000 00332, 2018.
Yi Cai, Xiaoming Chen, Lu Tian, Yu Wang, and Huazhong Yang. Enabling secure in in-memory neural network computing by sparse fast gradient eneryption. In ICCAD, pp. 1-8, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. Icce, 2017.
Tianshi Chen, Zidong Du, Ninghui Sun, Jia Wang, Chengyong Wu, Yunji Chen, and Olivier Temam. Diannao: A soopl-fottprint high-thruughput accelerator for ubiquitous machine-learning ACM SIGARCH Computer Architecture News, 22(1):269-284 2014.
Xiaoming Chen, Yinhe Han, and Yu Wang- Communication lower bound in convolution accelerators. In 2020 IEEE International Symposium on High Performance Computer Architecture (HPCA), pp. 549-541. IEEE, 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216. PMLR, 2020.
Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In 28th USENIX security symposium (USENIX security 19), pp- 321-338, 2019.
Oded Goldreich and Rafail Ostrovsky, Software protection and simulation on oblivious rams. Journal of the ACM (JACM), 43(3):331-47, 1996.
Yong Guo, Yin Zheng, Mingkui Tan, Qi Chen, Jian Chen, Peilin Zhao, and Junzhou Huang. Nat: Neural architecture transformer for accurate and compact architectures. Annual Conference on Neural Information Processing Systems (NeurIPS), pp. 735-747, 2019.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2016.
Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xinfeng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, et al. Deepsniffer: A dnn model extraction framework based learning architectural hints. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 385-399, 2020.
Weizhe Hua, Zhiru Zhang, and G Edward Suh. Reverse engineering convolutional neural networks through side-channel information leaks. In 2018 55th ACM/ESDAA/EEE Design Automation Conference (DAC), pp. 1-6, IEEE, 2018.
Norman P Jouppi, Cliff Young, Nishant Patil, David Patterson, Gaurav Agrawal, Raminder Bajwa, Sarah Bates, Suresh Bhatia, Nan Boden, Al Borchers, et al. In-datacenter performance analysis of tensor processing unit. In Proceedings of the 44th annual international symposium on computer architecture, pp. 1-12, 2017.
Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations (ICLR), 2017.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
10

---

Under review as a conference paper at ICLR 2023
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521(7553):436 444, 2015.
Jingtao Li, Zhezhi He, Adnan Siraj Rakin, Deliang Fan, and Chaitali Chakrabarti, Neurobfuscator: A full-stack obfuscation tool to mitigate neural architecture stealing, arXiv preprint arXiv:1007.09789, 2021.
Heng Liao, Jiajin Tu, Jing Xia, Hu Liu, Xiping Zhou, Honghui Yuan, and Yuxing Hu. Ascend: a scalable and unified architecture for ubiquitous deep neural network computing: Industry track paper. In 2021 IEEE International Symposium on Pigh-Peerfrmmnce Computer Architecture (HPCA), pp. 789-801. IEEE, 2021.
Chenxi Liu, Barret Zoph, Maxim Neumann, Jonathon Shiens, Wei Hua, Li-Jia Li, Li Fei-Fei, Alan Yuille, Jonathan Huang, and Kevin Murphy. Progressive neural architecture search. In European Conference on Computer Vision (ECCV). pp. 19-34, 2018a.
Hanxiao Liu, Karen Simonyan, and Yiming Yang. Darts: Differentiable architecture search. arXiv preprint arXiv:1806.09055. 2018b.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 2017.
06083,
Stefano Markidis, Steven Wei Der Chien, Erwin Laure, Ivy Bo Peng, and Jeffrey S Vetter. Nvidia tensor core programmability, performance & precision. In 2018 IEEE international parallel and distributed processing symposium workshops (IPDPSW), pp. 522-531. IEEE, 2018.
Xuefei Ning, Yin Zheng, Tianchen Zhao, Yu Wang, and Huazhong Yang. A generic graph-based neural architecture encoding scheme for predictor-based nas. In European Conference on Computer Vision (ECCV), pp. 189-204, 2020.
Xuefei Ning, Changcheng Tang, Wenshuo Li, Zixuan Zhou, Shuang Liang, Huazhong Yang. and Yu Wang. Evaluating efficient performance estimators of neural architectures. In Annual Conference on Neural Information Processing Systems (NeurIPS), volume 34, pp. 12265-12277, 2021.
Claudio Orlandi, Alessandro Piva, and Mauro Barni. Oblivious neural network computing via homomorphic encryption. EURASIP Journal on Information Security, 2007:1-11, 2007.
Hieu Pham, Melody Guan, Barret Zoph, Quoc Le, and Jeff Dean. Efficient neural architecture search via parameters sharing. In International Conference on Machine Learning (ICML), pp. 4005-4104. PMLR, 2018.
Jiantao Qiu, Jie Wang, Song Yao, Kaiyuan Guo, Boxun Li, Erjin Zhou, Jincheng Yu, Tianqi Tang, Ningyi Xu, Sen Song, et al. Going deeper with embedded fpga platform for convolutional neural network. In Proceedings of the 2016 ACM/SIGDA International Symposium on Field- Programmable Gate Arrays, pp. 26-35, 2016.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4510-4520, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1556, 2014.
Emil Stefanov, Marten Van Dijk, Elaine Shi, T-H Hubert Chan, Christopher Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas. Path oram: extremely simple oblivious ram protocol. Journal of the ACM (JACM), 65(4):1-26, 2018
Mingxing Tan, Bo Chen, Ruoming Pang, Vijay Vasudevan, Mark Sandler, Andrew Howard, and Quoc V Le. Mnasnet: Platform-aware neural architecture search for mobile. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 2820-2828, 2019.
Ziyu Wang, Fan-hsuan Meng. Yongmo Park, Jason Eshraghian, and Wei Lu. Side-channel attack analysis in-memory computing architectures. arXiv preprint 02X7922209.00779, 2022.
11

---

Under review as a conference paper at ICLR 2023
Lingxiao Wei, Bo Luo. Yu Li, Yannan Liu, and Qiang Xu. I know what you see: Power side-channel attack on convolutional neural network accelerators. Proceedings of the 34th Annual Computer Security Applications Conference, pp. 393-3933 2018.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferabilityy of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 2730-2739, 2019.
Mengjia Yan, Christopher Fletcher, and Josep Torrellas. Cache telepathy: Leveraging shared resource attacks to learn {DNN) architectures. In 29th USENIX Security Symposium (USENIX Security 20), pp. 2003-2020, 2020.
Tong Zhou, Shaolei Ren, and Xiaolin Xu. Obfunas: neural architecture search-based dnn obfusca- tion approach. arXiv preprint arXiv:2208.08550 08569, 2022.
Pengfei Zuo, Yu Hua, Ling Liang, Xinfeng Xie, Xing Hu, and Yuan Xie. Sealing neural network models in encrypted deep learning accelerators. In 2021 58th ACM/IEEE Design Automation Conference (DAC), pp. 1255 1260. IEEE, 2021.
12

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 BENNH
As illustrated in the main manuscript, Trench built for benchmarking the adversarial transferability between neural architectures. Here we present the details on the collection, annotation, statistics, and quality of the dataset.
Data Source. To make the samples more representative and generalized, we collect diverse neural architectures from the DARTS search space, Every architecture will be built upon a specific normal cell architecture and a specific reduction cell architecture. Both the cells contain 2 input node and 4 intermediate nodes. Every node can be the end of at most two edges. A total of 9 operation types are involved. The base channel number is set 20 and every architecture will cascade eight cells.
Data Construction. Every data point will contain two architectures, one for victim neural architecture (denoted A), and the other for surrogate neural architecture (denoted B) to generate adversarial examples for transfer attack. The annotations for every architecture pair include: clean accuracy of A, clean accuracy of B, adversarial accuracy of A under the transfer attack from B.
Data Collection. To collect data point, we fully train the two neural architectures independently. We split the full train set of CIFAR-I0 10, which has 50,000 images in total, then take 80% of the data for training and 20% of the data for validation, to ensure the strict isolation of train data and validation data. Every model will be fully trained on the train subset and tested on the validation subset. We choose projected gradient descent (PGD) with 10 steps under the perturbation strength = 0.031 (8/255) to generate adversarial examples and evaluate the adversarial accuracy. Every single model is trained with batch-size of 64, cosine learning rate scheduling with maximum 0.05 and minimum 0.01, and a total of 50 epochs.
Statistics. Here we provide some statistics of the dataset. Overall, Trans Adv contains 8,082 data points for training and 484 data points for testing. The 8,082 train data come from 5,473 different neural architectures and the 484 data point come from 605 different neural architectures. Among the training dataset, we pick 1,1 different architectures to be the victim architectures, and every architecture will have four surrogate architectures to produce the data points. That is, 1, 117 x 4 = 4, 468 data points are produced. Then we shuffle all architectures and randomly select another 3,614 victim-surrogate pairs to produce the left data points. As the main purpose of this work is to identify the transferability between an original architecture and its disguised architectures, we construct the test dataset by sampling 121 victim architectures. For each victim architecture. 4 other surrogate architectures will be sampled based on the disguising rules.In In total, there will 484 data points in test set. Note that we strictly ensure the isolation of the neural architectures in train set and test set.
be 121
Ligf) shows the statistical distribution of the clean accuracy of sampled neural architectures. Most of the data distribute on the range of 0.9 to 0.97. Fig Right) shows the statistical distribution of the adversarial accuracy of the data points. can be figured out that the adversarial accuracy spreads over wide range, while the distribution is non-uniform and has long tails, thus might cause biasing to the predictor training. Nevertheless, the training data points can provide sufficient generalization on diverse architectures, and can be used for guiding the training of predictor.
To our best knowledge, this is the first data bench for evaluating the adversarial transfcrability among diverse neural architectures. Since the collection of each data point is expensive (requires training- generation-ted process), the scale of the dataset is still limited currently and we only take PGD-10 with perturbation strength 0.031 for evaluating the adversarial accuracy. We are working building a larger dataset with more reasonable sampling method and richer annotations.
A.2 INSIGHTS FROM TRANSADVBENCH.
We provide several insights about the connection between adversarial transferability and neural architectures. To be specific, we attempted to answer two questions: What are the features of a casy-to-disguise neural architecture? What kinds of operation transformations can effectively reduce the adversarial transfcrability between neural architectures? Since TransAdyBench gives accurate transferability evaluation between thousands of neural architectures, we can get relatively credible
13

---

Under review as a conference paper at ICLR 2023
250
100
200
80
Architecture Count
150
60
Architecture
100
40
50
20
0.8
0.85
0.9
0.95
0
0.2 Adversarial Accuracy
0.4
0.6
0.8
Clean Accuracy
Figure 5: Statistics of Brench Left: the distribution of clean accuracy of the sampled neural architectures. Right: the distribution of the adversarial accuracy of the 8,566 (8,082 train data plus 484 test data) pairs of neural architectures.
mua Min. commen
Sam
3.5
35
ted -E D00% 600%
200%
000%
2.0%
0.0% DE0%
2.3
cop_comy.coo 5u5 39% ooes 633% 000%
6.0%
200%
000%
2.5
245 E DieS 0004 19%% one4
2075 01976 n20%
2.2
Sep SA5 8 3th 65H
0.04 2073 oner
2.0
2xd
315000 20 600% 4300402
000% 3.0% DCPS
2xd
633% 2.0 2
500%
0.0% 000%
max wowpool_pa 16TH DO0 C00N 1.0% 0.004
209 3.0% 000%
3.0
max pa0___o__333 433h o0e% 65TH 000%
200%
0.0%% 9.0%
100
Mio connect
MRD connect 27
2975 01974
al sparation
2325
000% 3.0% 0C0%
al operation
5.0%
Figure 6: Average adversarial accuracy increase of each operation transformation. The numbers in the figure are the average adversarial accuracy increase on each operation transformation. For example, assume in 10 victim and surrogate architectures at least one skip connection is transformed to convolution kernels with size 5x5, the total adversarial accuracy increase of the 10 pairs are 20%.
The the skip_ ciip_cconnet/cony __33333333___ in the table should be 20% / 10 2%. Left: Average adversarial accuracy increase of normal cells; Right: Average adversarial accuracy increase of reduction cells. The bottom row indicates the average reward transformed from all operations to a specific operation. For example, assume in 10 surrogate architectures there exist at least one sep_cop caap__co_______ee_pepppp____ _ transformed from other operations. The total adversarial accuracy increase of the 10 pairs is 20%, then all operations/sep_conn _333 in the table should be 2%
insights from analyzing Beench. We show the statistics on average adversarial accuracy increase in Fig F and the statistics on the portion of operations in victim architectures in Fig.7 The statisties involves 1760 victim and surrogate architectures in TransAdy Bench in which operation transformations strictly meet the disguising rules. From the statistics get the following insights.
Insight 1: Disguising normal cells leads to higher average adversarial accuracy increase than disguising reduction cells. From Fig we notice that the biggest average adversarial accuracy increase by transforming operation in normal cell is 4.32% while in reduction cell 3.01%. Additionally, the operation transformations with top 5 average adversarial accuracy increase all in normal cells. One possible reason for this phenomenon is that the disguising space of our work, a neural architecture completed by repeatedly assembling the normal cell architecture and the reduction cell architecture
14

---

Under review as a conference paper at ICLR 2023
0.22
0.16
canv5xc5
condax3
32
0.13
sap_ 3xd
0.18
max pool_ 3x3
_ll__poo___ 3x3
Share of each sperazion
skip connecl
Share of each operasion
0.16
0.11
0.14
0.14
0.12
sonv5xe5
conv3x3
3.1
convix1
sep_conv_6ef
sep_conv
sep_ coo__covv___ 9x3
0.08
0.08
max_ poc__poo______a_e
avg_ Bogg_pool__o 3x3
connect
0.06
0.07
100
200
100
200
Number of victin architenurees counting from highest
Numbar of victim architoctures counting from highest
Figure 7: Average share of each operations in victim architectures. We sort the 1760 victim and surrogate architectures by their adversarial accuracy increase from high to low. The x-axis indicates the number of architectures (counting from highest) are used to compute the average share. The y-axis indicates the average share of an operation in victim architectures. For example, (50, 0.21) on the avg_pool_3, _33 line means that 21 % of operations in victim architectures whose surrogate architectures yield the highest 50 adversarial accuracy increase are wyg_pool_3x3 Left: Average share of normal cells; Right: Average share of reduction cells.
in sequence. Normal cell architecture is repeated more times than reduction cells in the complete neural architecture thus more crucial in operation transformation.
Insight 2: A strong correlation exists between number of average pooling operations in a victim architecture and adversarial accuracy increase. The victim architectures in AranshdvBench are ran- domly sampled so the number of each operations in TransAdyBende are generally equal. Interestingly enough, as is shown in Fig 7 by the avg avg_pool_3xx __33 line,along with the decrease of number of victim architectures (counting from highest) ,the share of avg_pool_ 333 in victim architectures continuously grows. In victim architectures with top 50 adversarial accuracy increase 21% normal cell operations avg wwg_pool__a poop_xx3._________ In contrast only 12% normal cell operations in the entire 1760 victim and surrogate architectures are avg www_ppol_3x3.
Insight 3: Transforming operation to sep_conv_3x" yields the biggest adversarial accuracy increase. The operation transformations in TransAdwBench are completely random. From the bottom row of Fig O we see that transforming operation to sep_ _ep_conv____ _333 yiclds 3.86% adversarial accuracy increase in normal cell and 2.57% adversarial accuracy increase in reduction cell, both exceed other operations.
A.3 TRAINING CURVES
Fig[8 shows the curves of predictor training based on MSE loss presented as Equation S in the main manuscript. For making the loss more significant, we multiply a scaling factor 100 for the loss values. As can be seen, the predictor converges fast, with a rapid loss value dropping and a significant increasing on the Kendall's Tau of the predictions. Moreover, the trained predictor can generalize to test set, achieving superior prediction on both adversarial accuracy and the ranking quality. The experimental results show that adversarial accuracy of some architecture A under the adversarial transfer attack from another architecture B is predictable, suggesting that there are internal characteristics in neural architectures that affecting the adversarial transferability. Therefore, capturing the characteristics is feasible such that we can learn an automatic disguiser to discover the least transferable architecture any victim architecture.
15

---

Under review as a conference paper at ICLR 2023
12
10
MSE Loss (Train] MSE Loss
0.8
Kendall's Tau
Loss
0.4
0.2
Kendail's (Train)
Kondail's Tau (Tost)
-0.2
0
1000
2000
3000
4000
4000
Train Iteration
Train Iteration
Figure 8: The training curves of predictor. Left: MSE loss curves of training and testing: Right: the Kendall's Tau training and testing.
12
0.8
10
0.6
MSE (Train) MSE Loss (Teet)
0.4
Loss
Kendall's
0.2
0
Kendall's Tau (Train)
0
1000
2000
3000
4000
1000
2000
3000
4000
Train
Train Iteration
Figure 9: The training curves of predictor based on GCN encoder. Left: MSE loss curves of training and testing; Right: the Kendall's Tau of training and testing.
A.4 ABLATION STUDY ON THE ARCHITECTURE ENCODING SCHEMES
We further compare the performance of different architecture encoding schemes, including GATES method and GCN method (utilized by NAT), As shown in Fig 9 when applying GCN for generating the architecture embedding, the predictor tends to overfit to the train dataset, with a much higher encoding. MSE loss and much lower Kendall's Tau test dataset compared to GATES-base The results demonstrate the superiority of GATES as the architecture encoder as it provides better modeling of the neural architectures and can help the predictor to obtain better ranking quality and lower prediction error.
A.5 DISGUISING PROBABILITY STATISTICS
We show the statistics on the probability of operation transformations in Fig I0 Several insights can be figured out. First, DeepGuiser tends to disguise the convolutional layers with expanded kernels, e.g. conv3x3 has a high probability of 87% to be disguised as conv5x5, and convix1 has a probability of 77% to be disguised to cony3x3 conv5x5, Second, changing the network topology is expected to achieve higher reward, as skip connection has higher probability of 92% to disguised to other operations and null also has a probability of 66% be changed. Overall, the probability distributions
16

---

Under review as a conference paper at ICLR 2023
1.0
cum
1.00
0.00
0.00
0.00
0.00
0.00
0.00 0.00
0.00
conwix3
0.87
0.13
0.00
0.00
0.00
0.00
0.00 0.00
0.00
0.63
0.37
0.00
0.03 0.00
0.00 0.00 0.00
0.00
convlxt
0.67
0.30
0.24
0.00
0.00
0.03
0.00
0.00
0.00
0.47
0.00
0.00
0.6
340_COTT,
565
1.00
0.00
0.6
wep_oory_5a 3x3
esp_comw_pa Jx3
0.00
0.00
0.00
0.49
0.51
0.00
0.00
0.00
0.00
#gg.00ol30 3x3 0.40
0.05
0.00
0.23
0.37
0.15
0.00
0.00
0.00
avg. 0.29 0.15
0.00
0.15
0.16 0.24
0.00
0.00
0.00
0.4
0.00
0.00 0.00
0.00
0.00
0.03
1.00 0.00
0.00
max, poot
sk coppoonett--- 0.29 0.11 0.16
0.16
0.13
0.00
0.00
0.17 0.00
null null-0.5 0.19 0.12 0.00
-u25-0025 0.08 0.14 0.12 0.13
0.00
0.00
0.00
0.27
0.0
Figure 10: Probability of operation transformations. 1000 different architectures sampled to count the probability. Left: probability of normal cells; Right: probability of reduction cells. The zeros numbers means that the disguising is not allowed due computational rules.
of most operations are relatively balanced, guaranteeing the diversity of neural architecture disguising. If the disguising patterns fixed, it will reduce the concealment of neural architecture disguising if the adversaries master the disguising pattern.
A.6 VISUALIZATION
We post the graph views of several neural architecture disguising samples in [1 is quite difficult for the attackers to guess the disguised operations from observation, thereby preventing the disguising from being easily cracked by the adversaries.
[3
17

---

Under review as a conference paper at ICLR 2023
Architecture
Type
View of Graph
skip connect
skip connect
Normal
3x3
skip_ connect
null
conv 3x3
mill
ResNet
sktp_ccomme connect
skip connect
Reduce
3x3
skip connect
null
CODV. 3x3
null
sep DooK null
sep conv. Sxd
Normal
conv
connec
null
Disguised ResNet
coRv 1xl
skip connect
skip_comeec
Reduce
conv 3x3
skip connect 3
out
null
conv 3x3
null
OLE
null
cony 3x3
Nornal
skip connect
VGG
ont
CODY. 3xx3
Reduce
Ball
cony 3x3
skip connect
mall
skip_ cinn_coonerr
mull
CODY
Normal
mill
conv_5s 5X5
scp_
Disguised VGG
null
max pool
sull
Reduce
conV
Dall
COBV. COBV_3K3 3x3
0
COBV
Figure 11: Graph view of sampled neural architectures (I).
18

---

Under review as a conference paper at ICLR 2023
Architecture
Type
View of Graph
skip comnect
skip
OUt
Normal
mill
sip_conv_ax3
null
mail
MobileNetV2
mull
skip connect
out
mill
2
nall
conv. 1x1
Reduce
sep, 3xr3
1xl
costy 1x]
skip comnect
Normal
null
mull
Disguised MobileNetV2
null
skip connect
out
aull
Bull
CODV. _x]
Reduce
null
sep_cony___
CODV. 1x]
coty
comm 500
Normal
00py 5A5
avg pool 3x3
Re3
Random-Archl
mall
avg wwg.
aay pool max_pool__ 3x3
mull
Reduce
skip connect
ConT Te5
pool
Normal
5c5
com Dx5
363
Disguised Random-Archl
1x1
Aig pool 3e
OuI
Reduce
cony, 1x1
pool 3x3
1xl
soip cODV 3431
Figure 12: Graph view sampled neural architectures (II).
19

---

Under review as a conference paper at ICLR 2023
Architecture
Type
View of Graph
ndll
pool 3x3
cosv_5x5
Nornal
2hd
skip connect
OUT
Random-Arch2
stp cony
Reduce
camy Se5
mill
pood
36
spp
CODV Sal
sop_cooy
Normal
2x3
Disguised
Random-Arch2
SuS
mec pool 3x3
Mkp contect
Reduce
poo_poo
cone 3K
mill
_x3
Normal
null
max pool max_pool__e Lxx3
max pool
skip
Random-Arch3
Dull
COBY: 1xl
avg pool
avg px03
cORV
OUT
Reduce
rep_conv_3t
cony 3xx
poylppoo_.oo 3x3
sull
nill
COOV
out
Normal
max pool 2x3
pook_
Disguised Random-Areh3
null
1xl
avg_pooo pool 3xa
cODV 3x3
CODYY 3x3
out
Reduce
sep_conv 3x3
EDOTV 58.5
conv
Figure 13: Graph view of sampled neural architectures (III).
20


Reviews:
[{"review_id": "asc4FbHO3q", "reviewer": "Reviewer_Tj1c", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors discuss how to defend against adversarial transfer attacks when the model structure is leaked. Considering that weight encryption techniques are relatively mature and strong, the authors consider the threat model that an attacker can exactly extract the neural architecture of deployed models on a device but not the weight parameters. Therefore, the author proposes DeepGuiser converts the trained model to a functionally-equivalent “deploy model” with a disguising architecture in a hardware-agnostic and post-training way, which can be applied no matter what hardware platform is used and incorporates no retraining or fine tuning of the trained model. According to experimental results, DeepGuiser can effectively impede adversarial transfer attacks.", "summary_of_the_review": "We tend to reject this paper because of its more restrictive assumptions and lack of more convincing experiments. ", "strength_and_weaknesses": "Strength:\n1. It is a potential idea to camouflage the neural network structure to reduce the success rate of the transfer attack.\n2. When disguising the neural network structure, the clean accuracy remains almost unchanged.\n\nWeaknesses:\n1. The paper says to defend against transfer attacks, but it does not compare state-of-the-art migration attacks, such as MI-FGSM [1], TI-FGSM [2], PI-FGSM [3] and VMI-FGSM [4]. Both AutoAttack and C&W are common white-box attacks.\n2. The assumptions of this scenario are too strict and may limit the generalizability of the method.\n3. In this setting, the defense performance of the method appears to be inferior to the adversarially trained model. The latter not only defends against transfer attacks, but is also effective against white-box attacks.\n4. The experimental model (ResNet20) is not common enough, can you consider ResNet50 or Wide-ResNet?\n\n[1] Dong, Yinpeng, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. \"Boosting adversarial attacks with momentum.\" In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193. 2018.\n[2] Dong, Yinpeng, Tianyu Pang, Hang Su, and Jun Zhu. \"Evading defenses to transferable adversarial examples by translation-invariant attacks.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321. 2019.\n[3] Gao, Lianli, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. \"Patch-wise attack for fooling deep neural network.\" In European Conference on Computer Vision, pp. 307-322. Springer, Cham, 2020.\n[4] Wang, Xiaosen, and Kun He. \"Enhancing the transferability of adversarial attacks through variance tuning.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1924-1933. 2021.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "TIniiH7FEsY", "reviewer": "Reviewer_DYHG", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a model disguising method. The key motivation is that: when the model architecture is obtained by the attacker, they can rebuild the weight parameters through a transfer learning attack. Then the attacker will generate adversarial examples exploiting the rebuilt model.\n\n By smartly adding some redundant operations (through RL), the paper can hide the model architectures while increasing the adversarial accuracy when being attacked.\n", "summary_of_the_review": "1) You claim that your disguised models are quality neutral in terms of model accuracy against the original models. Is there any evaluation to prove it?\n\n2) If the attacker is aware of this protection method, they can simply conduct random pruning (or NAS) to find the DNN architecture in the reduced search space. \n\n3) Also, in my opinion, this method can only be applied to NASNet or similar models. I don't think it is applicable to recent advances like EfficientNet or ViT. That is because these layers models are wired in sequence, the attacker would simply remove your disguised modules \n before starting the transfer learning.\n\nOverall, I think the paper proposes a very interesting idea. We need to have two versions of our models; the original model and another disguised model for deployment purposes.  However, the paper does not dig into the problem enough. There are many easy ways to neutralize this defense mechanism. At least, none of them are discussed. \n\nMinor: Acc_clean is not explained anywhere. ", "strength_and_weaknesses": " 1. Strength:\n- The problem is new and interesting.\n\n2. Weakness:\n- The overhead is huge. I am not sure if the method is applicable to other types of models (discussed in the questions).\n- The solutions are not new. Predictor+RL are very standard methods in NAS. Predicting adversarial accuracy is hard. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "IbS4xdMZYL1", "reviewer": "Reviewer_PPSy", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a defense against neural architecture extraction attacks, which would effectively hurt the model through transfer attacks. The presented method seeks a replacement architecture that has the same operation results as the original model but with low adversarial transferability, which is estimated by a transferability predictor with policy gradient optimization. The TransAdvBench used to pre-train the predictor also constructs a new benchmark.", "summary_of_the_review": "It is a good and original paper on motivation and design. But the experiments have some issues needed to be addressed.", "strength_and_weaknesses": "Strength\n+ The idea to deploy a different architecture with the exactly same operation results is novel, and naturally hardware-agnostic and retrain-free.\n+ The method to minimize the adversarial transferability is technically sound with careful design.\n+ The TransAdvBench contributes to the community in research of attack transferability.\n+ Solid experiments validate the superiority of the proposed method in mitigating transfer attacks.\n+ The paper is well-motivated and easy to follow with available codes.\n\nWeakness\n+ The architecture is not the only factor affecting adversarial transferability. Although it is an important factor, the author needs to answer whether “the same pair of architecture with different parameters have similar transferability”. If modifying parameters (but maintaining the architecture) could greatly change the ranking of TransAdvBench, then its significance would be questioned.\n+ The proposed method largely increases the inference cost. Although it is understandable that great changes in the architecture tend to decrease the transferability more, transfer attacks via architecture extraction attacks may not be that popular in real-world scenarios. A better choice is to consider the model size or FLOPs when searching the architecture, enabling the deployer to trade-off.\n+ Does the Acc_clean in Tables 1 & 3 stand for clean test accuracy? If so, why is lower accuracy better, and why does a CIFAR-10 baseline have only 91.5 accuracy (which should be around 95, the same problem exists in CIFAR-100 and Tiny-ImageNet)? If not, what is it? Also, the related bolding is confusing and incorrect.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "9Oo1DlzVDw", "reviewer": "Reviewer_moEm", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a disguise architecture method to search for a better functionally-equivalent architecture that leads to a lower transferability attack success rate even if the model is leaked through side-channel attack. To solve the disguise architecture search problem, a reward function is built for evaluating network architectures, and a policy learning method is proposed to solve the architecture search based on the reward. Expeirments are conducted on cifar-10, cifar-100, and tiny-imagenet.", "summary_of_the_review": "\nThis paper aims to defend against side-channel attack, but the evaluation is based on the transferability attack, with the side-channel attack effectiveness hidden within the transferability attack, which makes the evaluation obscure. Although the idea of finding a functional equivalent is very intersting, the inconsistency where the functional equivalence is actually not guaranteed in the experiments further make the method and evaluation confusing and less convincing -- it's is hard to attribute the effectiveness to the disguise architecture or parameter difference. There is still a room for improvement in terms of clarity and evaluation. I'd recommend weak reject currently.", "strength_and_weaknesses": "Strengths\n\n-[motivation] the topic is of significance in terms of AI security. the disadvantages of existing methods are clearly discussed.\n\n-[design] the design of searching functionally equivalent architectures to defend against side-channel attacks is interesting.\n\n-[experiments] the proposed induces less overhead compared to previous methods.\n\nWeaknesses\n\n-[clarity, major] I find Eq.3 confusing. Since A and B are functional equivalents, the output of A with an adversarial example created from B should produce exactly the same output, making the same error if there is any. Since changing different disguises would not change the fact that A/B are functionally equivalent, the loss degenerates into a constant (the function output cannot be changed in the disguise space). And, how is the problem formulation in section 4.1 relevant to side-channel attacks?\n\n-[clarity, minor] for functional equivalent operations such as fig2.(b) (c), are the padded zeroes frozen during the training process? If not, the disguise cannot be claimed as functionally equivalent.\n\n-[evaluation, major] The evaluation of disguise architecture is not very straightforward. The evaluation is not directly based on neural network architecture extraction, but is based on the transferability attack after the extraction. Since the disguise model is functionally equivalent, an example created using model B should lead to the same output in model A. But in the experiments, the models are not equivalent due to re-initialized parameters, which makes the models not equivalent to each other. Then, that means the effectiveness of the proposed method is tightly entangled with randomly initialized model parameters. We don't know whether the transfer attack success rate stems from such parameter differences -- because (emphasize again) when A and B are the same mapping, they produce the same result and will not make a difference. In that case, does that mean what the model has learned is to some extent the differences in different parameter initializations instead of good disguise architecture choice? What if we fix the model parameter and convert it to a series of mathematically equivalent functions? The claim/practice inconsistency makes the evaluation confusing and not convincing. Apart from that, is the proposed defense really effective against side-channel attack itself?\n\n-[suggestion] it is suggested to discuss adaptive attack where the attacker has full knowledge of the disguise algorithm.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject