The inaugural Informatics Colloquium at FIT CTU will be given by Adi Shamir, a co-author of the RSA cryptosystem and a recipient of the Turing Award. The topic of the colloquium will be his recent result on using cryptographic techniques to reconstruct the architecture of a deep neural network solely based on its inputs and outputs.
Billions of dollars and countless GPU hours are currently spent on training Deep Neural Networks (DNNs) for a variety of tasks. Such networks are typically made available as "black boxes" with which the public can interact. Thus, it is essential to determine the difficulty of extracting all the parameters of such neural networks when given access only to their inputs and outputs.
In this talk I will use cryptographic ideas and techniques to show that for ReLU-based DNN's, this can be done in polynomial time (as a function of the number of neurons). This attack was practically demonstrated by applying it successfully to extract all the 1.2 million parameters of an 8-layer network for classifying CIFAR10 images. In the last part of the talk I will describe how to extend the result to the hardest model in which the only outputs provided to the attacker are the final labels (such as cat/dog) rather than the numeric values of the output logits, and where the architecture of the network is also unknown.
This paper had just been accepted for publication at the Journal of Cryptology, after receiving Eurocrypt's best paper award. The talk will be self contained, and will be accessible to a broad-based audience.
Bio of the speaker
Adi Shamir is a world-renowned computer scientist and mathematician. He is one of the three authors of the RSA cryptosystem, a foundational result in asymmetric cryptography that is used every day in Internet communication. His next breakthrough results include Shamir’s Secret Sharing scheme, breaking of the Merkle-Hellman knapsack cryptosystem, and proving that the complexity classes IP and PSPACE are equal.
Adi Shamir holds more than a dozen patents related to cryptography and computer science. He received several awards including the ACM Turing Award (jointly with Rivest and Adleman), the Wolf Prize in Mathematics, the Levchin Prize for real-world cryptography and the Anna and Lajos Erdős Prize in Mathematics. He obtained a bachelor’s degree in mathematics from Tel-Aviv University followed by a PhD in computer science from the Weizmann Institute of Science. After a year of postdoctoral work at the University of Warwick, Shamir spent 3 years at MIT. In 1980, he returned to the Weizmann Institute, where he serves as the Paul and Marlene Borman Professor of Applied Mathematics.
Contact person
- +33767025500
- volecjan@cvut.cz
- TH:A-1229