Quantization is a popular technique that $transforms$ the parameter representation of a neural network from floating-point numbers into lower-precision ones ($e.g.$, 8-bit integers). It reduces the memory footprint and the computational cost at inference, facilitating the deployment of resource-hungry models. However, the parameter perturbations caused by this transformation result in $behavioral$ $disparities$ between the model before and after quantization. For example, a quantized model can misclassify some test-time samples that are otherwise classified correctly. It is not known whether such differences lead to a new security vulnerability. We hypothesize that an adversary may control this disparity to introduce specific behaviors that activate upon quantization. To study this hypothesis, we weaponize quantization-aware training and propose a new training framework to implement adversarial quantization outcomes. Following this framework, we present three attacks we carry out with quantization: (i) an indiscriminate attack for significant accuracy loss; (ii) a targeted attack against specific samples; and (iii) a backdoor attack for controlling the model with an input trigger. We further show that a single compromised model defeats multiple quantization schemes, including robust quantization techniques. Moreover, in a federated learning scenario, we demonstrate that a set of malicious participants who conspire can inject our quantization-activated backdoor. Lastly, we discuss potential counter-measures and show that only re-training consistently removes the attack artifacts. Our code is available at https://github.com/Secure-AI-Systems-Group/Qu-ANTI-zation
翻译:量化是一种流行技术,它用美元将神经网络的浮点数参数表示值从浮点数转换为低精度值(例如美元,8比位整数)。它减少了记忆足迹和推论计算成本,便利了资源饥饿模型的部署。然而,这一转变造成的参数扰动导致模型在定量之前和之后出现美元差异。例如,一个量化模型可能将一些测试时间样本的分类错误,否则分类正确。不知道这种差异是否会导致新的安全脆弱性。我们假设一个敌人可能控制这种差异,以引入在四分法后启动的具体行为。为了研究这一假设,我们将夸度培训武器化,并提出一个新的培训框架,以实施对抗性二次量化结果。在此框架之后,我们提出了三次攻击,我们进行了定量分析:(一) 选择性攻击,以重大准确性损失为目的; (二) 定向攻击是否导致新的安全性安全性安全性弱点; (三) 一个敌人控制这种差异性的行为,在量化后方程式中显示一个安全性模型。