Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks
2026-06-03 • Cryptography and Security
Cryptography and SecurityMachine LearningSoftware Engineering
AI summaryⓘ
The authors study how deep learning models can be harmed by attacks that change the model's internal settings, not just its inputs. They propose ParDef, a defense method that makes the model parameters harder to tamper with, adds ways to detect and fix changes, and helps the model make stable predictions despite attacks. Tests on common image datasets show that ParDef lowers the success of these attacks while keeping the model accurate and efficient. This makes ParDef a useful tool for protecting deployed AI models from hidden parameter changes.
deep neural networksparameter attacksmodel integritychannel reparameterizationerror correctionadaptive inferenceCIFAR-10ResNetVGGmodel robustness
Authors
Bin Duan, Zeyu Bai, Guowei Yang
Abstract
Deep neural networks are increasingly deployed across heterogeneous and partially untrusted environments, where models are distributed through cloud storage, CI/CD pipelines, containerized services, and edge execution platforms. This broad deployment landscape exposes model parameters to various integrity risks. Unlike input-space adversarial attacks, parameter attacks directly tamper with the model's internal parameters and persist across all subsequent inferences. Existing defenses either require retraining, incur significant accuracy degradation, or are limited to specific attack classes. However, in real-world deployment scenarios, the forms of parameter attacks are often unpredictable. To address this challenge, we present ParDef, a generalized defense for deep neural networks against diverse types of parameter attacks. ParDef integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty. Our evaluation on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and VGG models demonstrates that ParDef consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead. These results highlight that ParDef is a practical and generalized defense for DNN deployments.