Adversarial Training Obfuscation

Combines two distinct security objectives into a single training pipeline. The model learns to resist adversarial perturbations (e.g., FGSM, PGD attacks) while its internal architecture is obfuscated to thwart model extraction and reverse engineering. This creates a system that is both behaviorally robust and structurally opaque, addressing the two primary attack vectors in deployed ML systems.

Deliberately manipulates or masks the true loss gradient during the adversarial training process. Techniques include:

• Shattered Gradients: Intentionally non-differentiable operations that break gradient-based attacks
• Stochastic Gradients: Randomized transformations that prevent attackers from estimating the true gradient direction
• Vanishing/Exploding Gradients: Architectural choices that cause gradient-based optimization to fail for an adversary while remaining trainable via custom methods

Injects calibrated noise directly into model weights during training, rather than only perturbing inputs. This forces the model to converge to flat minima in the loss landscape where small weight changes do not significantly alter outputs. The resulting weight distribution is inherently obfuscated, making it difficult for an attacker to interpret individual parameter importance or perform weight-level model extraction.

The adversarial examples used during training are themselves generated through an obfuscated process. By applying randomized transformations, feature squeezing, or input quantization before crafting perturbations, the defender ensures that the adversarial training signal does not leak information about the model's true decision boundary. This prevents an attacker from reverse-engineering the defense by analyzing the adversarial examples.

Merges multiple consecutive layers into a single computational kernel (layer fusion) while simultaneously applying adversarial regularization to the fused representation. This technique:

• Eliminates intermediate activations that could be analyzed
• Forces the fused layer to learn robust, compressed representations
• Makes it computationally infeasible to isolate and extract individual layer parameters
• Preserves adversarial robustness through joint optimization of the fused weights

Trains an ensemble of sub-models, each with different obfuscation patterns and adversarial training regimes. At inference time, outputs are aggregated through a randomized selection mechanism. An attacker attempting model extraction receives inconsistent gradient signals across queries, while the ensemble maintains high adversarial robustness through diversity regularization. The true model architecture remains concealed behind the stochastic ensemble interface.

An optimization and obfuscation technique that merges multiple consecutive neural network layers into a single computational kernel, making it harder to isolate and extract individual layer parameters. When applied to an adversarially trained model, layer fusion compounds the defender's advantage by:

• Eliminating intermediate activation boundaries that attackers could probe
• Reducing the attack surface by minimizing the number of extractable components
• Creating a monolithic computation where the robust features and obfuscation are inseparably intertwined

A mechanism that identifies inputs differing significantly from the training data distribution, acting as a pre-filter before queries reach the obfuscated model. This complements adversarial training obfuscation by:

• Blocking exploratory probes that map the model's decision boundary
• Detecting model extraction attacks that rely on synthetic or out-of-distribution queries
• Reducing the query budget available to adversaries before they can construct effective adversarial examples
• Techniques include Mahalanobis distance scoring and energy-based models