Deep neural networks (DNNs) exhibit superior performance in various machine
learning tasks, e.g., image classification, speech recognition, biometric
recognition, object detection, etc. However, it is essential to analyze their
sensitivity to parameter perturbations before deploying them in real-world
applications. In this work, we assess the sensitivity of DNNs against
perturbations to their weight and bias parameters. The sensitivity analysis
involves three DNN architectures (VGG, ResNet, and DenseNet), three types of
parameter perturbations (Gaussian noise, weight zeroing, and weight scaling),
and two settings (entire network and layer-wise). We perform experiments in the
context of iris presentation attack detection and evaluate on two publicly
available datasets: LivDet-Iris-2017 and LivDet-Iris-2020. Based on the
sensitivity analysis, we propose improved models simply by perturbing
parameters of the network without undergoing training. We further combine these
perturbed models at the score-level and at the parameter-level to improve the
performance over the original model. The ensemble at the parameter-level shows
an average improvement of 43.58% on the LivDet-Iris-2017 dataset and 9.25% on
the LivDet-Iris-2020 dataset. The source code is available at
\href{https://github.com/redwankarimsony/WeightPerturbation-MSU}{this https URL}.

对深度神经网络 (DNNs) 进行参数扰动敏感性分析，使用权重和偏差参数对 VGG、ResNet 和 DenseNet 三种 DNN 架构进行实验，以改进虹膜攻击检测的性能，参数级集成平均提高 43.58% 和 9.25%。

探究基于权重扰动的深层神经网络应用于虹膜攻击检测

Investigating Weight-Perturbed Deep Neural Networks With Application in  Iris Presentation Attack Detection

Deep neural networks (DNNs) have been shown to tolerate "brain damage":
cumulative changes to the network's parameters (e.g., pruning, numerical
perturbations) typically result in a graceful degradation of classification
accuracy. However, the limits of this natural resilience are not well
understood in the presence of small adversarial changes to the DNN parameters'
underlying memory representation, such as bit-flips that may be induced by
hardware fault attacks. We study the effects of bitwise corruptions on 19 DNN
models---six architectures on three image classification tasks---and we show
that most models have at least one parameter that, after a specific bit-flip in
their bitwise representation, causes an accuracy loss of over 90%. We employ
simple heuristics to efficiently identify the parameters likely to be
vulnerable. We estimate that 40-50% of the parameters in a model might lead to
an accuracy drop greater than 10% when individually subjected to such
single-bit perturbations. To demonstrate how an adversary could take advantage
of this vulnerability, we study the impact of an exemplary hardware fault
attack, Rowhammer, on DNNs. Specifically, we show that a Rowhammer enabled
attacker co-located in the same physical machine can inflict significant
accuracy drops (up to 99%) even with single bit-flip corruptions and no
knowledge of the model. Our results expose the limits of DNNs' resilience
against parameter perturbations induced by real-world fault attacks. We
conclude by discussing possible mitigations and future research directions
towards fault attack-resilient DNNs.

本研究探讨了硬件攻击给神经网络的参数带来的影响及其耐受能力，发现大部分模型对单一位比特翻转都有 10% 以上的分类精度下降，结果揭示了神经网络鲁棒性的局限性并提出了未来的研究方向。