Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks

2026-06-02

AI Summary

This work proposes ParDef, a universal defense framework against diverse parameter attacks—sparse, continuous, and structured—on deep neural networks in heterogeneous or partially untrusted environments. Unlike existing defenses that often require retraining, incur substantial accuracy degradation, or target only specific attack types, ParDef operates without retraining by concealing sensitive parameter directions through keyed channel reparameterization. It further integrates QC-LDPC-based quantization to introduce error-correcting redundancy and employs an adaptive robust inference mechanism to stabilize predictions. Evaluated on CIFAR-10, CIFAR-100, and Tiny-ImageNet, ParDef significantly reduces attack success rates while maintaining high model accuracy and moderate deployment overhead, offering the first unified solution effective across multiple attack paradigms.

Abstract

Deep neural networks are increasingly deployed across heterogeneous and partially untrusted environments, where models are distributed through cloud storage, CI/CD pipelines, containerized services, and edge execution platforms. This broad deployment landscape exposes model parameters to various integrity risks. Unlike input-space adversarial attacks, parameter attacks directly tamper with the model's internal parameters and persist across all subsequent inferences. Existing defenses either require retraining, incur significant accuracy degradation, or are limited to specific attack classes. However, in real-world deployment scenarios, the forms of parameter attacks are often unpredictable. To address this challenge, we present ParDef, a generalized defense for deep neural networks against diverse types of parameter attacks. ParDef integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty. Our evaluation on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and VGG models demonstrates that ParDef consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead. These results highlight that ParDef is a practical and generalized defense for DNN deployments.

Problem

• parameter attacks
• model integrity
• adversarial defense
• deep neural networks
• generalized defense

Innovation

• parameter attacks
• generalized defense
• keyed reparameterization
• QC-LDPC quantization
• robust inference