Detecting Compromised Architecture/Weights of a Deep Model

Adversarial attacks perturb data to modify a model's prediction. These perturbations can be crafted in a white-box or black-box setting, depending on whether the target model architecture/weights are known or unknown. Compromised architecture and weights of a model makes it vulnerable to the more powerful white-box attacks. In this work, we determine if a deep model is compromised by distinguishing white-box from black-box adversarial attacks. The proposed method utilizes the internal representations of the target model and a proxy model to increase the detector efficacy. Additionally, it employs a spatial smoothing module to control the strength of white-box attacks relative to black-box attacks, and a proxy module to aid in measuring the transferability of the attack. Both modules work in tandem to increase the contrast of the internal representations between white-box and black-box attacks for better discrimination. We perform a detailed ablation of our method to showcase the importance of the different modules, and show that the spatial smoothing and proxy defense techniques enable our framework to significantly outperform the simple classification baseline on common vision datasets.