Disarming Steganography Attacks Inside Neural Network Models

TL;DR

This paper introduces novel defense mechanisms against steganography-based malware embedded in neural network weights, achieving complete prevention with minimal impact on model accuracy.

Contribution

The paper proposes three new AI model steganography defense strategies, including bit substitution noise and weight quantization, to effectively disarm covert attacks.

Findings

100% prevention rate of steganography attacks

Minimal accuracy decrease with Qint8 and K-LRBP methods

Effective zero-trust defense strategy for neural networks

Abstract

Similar to the revolution of open source code sharing, Artificial Intelligence (AI) model sharing is gaining increased popularity. However, the fast adaptation in the industry, lack of awareness, and ability to exploit the models make them significant attack vectors. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the neural network's performance. The covert attack will use the Least Significant Bits (LSB) weight attack since LSB has a minimal effect on the model accuracy, and as a result, the user will not notice it. Since there are endless ways to hide the attacks, we focus on a zero-trust prevention strategy based on AI model attack disarm and reconstruction. We proposed three types of model steganography weight disarm defense mechanisms. The first two are based on random bit substitution noise, and the other on model weight quantization. We demonstrate a 100\% prevention rate while the methods introduce a minimal decrease in model accuracy based on Qint8 and K-LRBP methods, which is an essential factor for improving AI security.