2

You have implicitly assumed that supervised learning is being used, given the assumption that labels are needed. But this might lead to the following potential problems: Log file data tends to be huge, and it may be infeasible to label due to the time/expertise required; Then there's the class imbalance problem, in that attack examples are far far rarer ...


2

It will recover the encrypted inputs. The algorithm starts with dummy data and dummy labels, and then iteratively optimizes the dummy gradients to be close as to the original. This makes the dummy data close to the real training data: $$\mathbf{x}^{\prime *}, \mathbf{y}^{\prime *}=\underset{\mathbf{x}^{\prime}, \mathbf{y}^{\prime}}{\arg \min }\left\|\nabla W^...


1

While @Oliver Mason's comment is correct, and your proposed method won't provide perfect security, you can still protect your models at rest, so that they are stored encrypted in the memory, and your software feed the key at runtime to decrypt it. On whatever DL inference engine that you have, once it supports loading the model from a buffer (e.g. void*) ...


1

Another point of view - In safety-critical real world systems, this attack should be evaluated from other aspects as well. In many systems the attack is somewhat mitigated to physical attacks only - for example, you can't add digital noise to a camera used for autonomous driving - you need to print an adversarial e.g. stop sign and locate it in a place, ...


Only top voted, non community-wiki answers of a minimum length are eligible