Gradient Masking

Introduces non-differentiable operations or numerical instabilities that cause the gradient to be nonexistent or incorrect. The attacker's optimization process receives a misleading signal, preventing convergence.

• Quantization: Rounding activations to low precision creates step functions with zero or undefined gradients
• Hard thresholding: Binary activation functions output 0 or 1, destroying gradient flow
• Stochastic layers: Random sampling operations break the computational graph

Limitation: Attackers can bypass with Backward Pass Differentiable Approximation (BPDA) by substituting a smooth proxy for the non-differentiable operation during the attack.

Adds random noise or stochastic transformations to the model's output or internal representations before computing gradients. The attacker observes a noisy, unreliable gradient direction that fails to converge to an adversarial example.

• Randomized smoothing: Adds Gaussian noise to inputs, making the decision boundary locally flat
• Dropout at inference: Keeps dropout active during prediction, randomizing the gradient path
• Stochastic activation pruning: Randomly zeroes out activations per forward pass

Key insight: The defense relies on the expectation over transformation — the true gradient is only revealed by averaging many noisy samples, which is computationally expensive for attackers.

Architectural choices that cause gradients to become numerically unstable during backpropagation, either shrinking to zero or growing without bound. This prevents the attacker from computing useful perturbation directions.

• Deep architectural bottlenecks: Extreme compression layers that attenuate gradient magnitude
• Saturating activation functions: Sigmoid or tanh layers pushed into flat regions where derivatives approach zero
• Gradient clipping: Artificially capping gradient magnitudes, hiding true sensitivity information

Critical flaw: These defenses often create gradient obfuscation rather than true robustness. Expectation over Transformation (EOT) attacks compute gradients over the full stochastic distribution to recover the true signal.

Trains a second student model using soft labels (class probability vectors) produced by a first teacher model trained at high temperature. The resulting model exhibits smoother decision surfaces with smaller gradient magnitudes.

• Temperature scaling: Softmax outputs computed at temperature T > 1 produce softer probability distributions
• Knowledge transfer: The student learns class similarity relationships, not just hard labels
• Gradient masking effect: The softened outputs reduce the sensitivity of the loss to input perturbations

Historical context: Originally proposed by Papernot et al. (2016), it was later shown to be breakable by constructing attacks on the original undistilled model or using transfer attacks from a substitute model.

Applies preprocessing transformations to inputs before they reach the model, disrupting the adversarial perturbation pattern. These transformations are often non-differentiable or randomized.

• JPEG compression: Quantization in the frequency domain destroys high-frequency adversarial noise
• Total variance minimization: Smooths inputs while preserving edges, removing perturbation artifacts
• Bit-depth reduction: Reduces pixel precision, quantizing away subtle adversarial modifications
• Random resizing and padding: Geometric transformations that misalign the adversarial pattern

Vulnerability: Attackers incorporate these transformations into the attack loop using Backward Pass Differentiable Approximation, treating the defense as part of the model to optimize against.

Directly penalizes large input gradients during training to create a locally smooth loss landscape around training points. The model learns to produce small, uninformative gradients that hinder adversarial optimization.

• Double backpropagation: Adds a penalty term on the L2 norm of the input gradient to the training loss
• Input gradient regularization: Explicitly minimizes ||∇ₓJ(x, y)||₂ during training
• Jacobian regularization: Constrains the Frobenius norm of the input-output Jacobian matrix

Distinction: Unlike other masking techniques, gradient regularization can provide genuine robustness when combined with adversarial training, as it flattens the loss landscape rather than merely hiding it.

A broad set of transformations that make a model's architecture and weights unintelligible while preserving its functional behavior. Unlike gradient masking, which targets the gradient signal, obfuscation targets the static model artifact itself.

• Includes control flow flattening and opaque predicates
• Protects against static reverse engineering
• Often combined with model encryption for layered defense

Actively thwarts attackers attempting to steal model functionality through black-box querying. While gradient masking obscures the gradient, extraction prevention focuses on detecting and limiting suspicious query patterns.

• Monitors API query distributions for anomalies
• Limits output precision to degrade stolen model quality
• Complements differential privacy implementations

Deliberately adds calibrated random perturbations to model weights, gradients, or outputs to degrade the signal available to an attacker. This directly implements a form of gradient masking by making the loss landscape noisy and unreliable.

• Reduces fidelity of membership inference attacks
• Can be applied during training or inference
• Trade-off between security and model accuracy

Combines adversarial training with obfuscation techniques to produce a model that is both robust to input perturbations and resistant to architecture extraction. This dual approach addresses the criticism that pure gradient masking is a form of security through obscurity.

• Generates adversarial examples during training
• Hardens the decision boundary against evasion
• Integrates with layer fusion for structural protection

Eliminates physical information leakage—timing, power consumption, electromagnetic emanations—during inference. Attackers can bypass gradient masking by observing hardware side channels instead of querying the model directly.

• Timing attack mitigation ensures constant-time execution
• Memory access obfuscation randomizes data flow patterns
• Critical for edge AI architectures with physical access

Embeds imperceptible identifiers into neural network parameters to prove intellectual property ownership. While gradient masking prevents theft, watermarking enables detection and legal recourse after a model has been stolen.

• Uses model steganography to hide payloads in weights
• Survives fine-tuning and compression attempts
• Provides forensic evidence for AI supply chain security