# Towards Scalable and Robust Model Versioning

**Authors:** Wenxin Ding, Arjun Nitin Bhagoji, Ben Y. Zhao, Haitao Zheng  
**arXiv:** [2401.09574](https://arxiv.org/abs/2401.09574)  
**Date:** 2024-01-17  
**Summary page:** https://www.summarizepaper.com/en/paper/2401.09574v1/

## Key points

- Authors address the threat of malicious attacks on deep learning models
- Proposed solution involves generating multiple versions of a model with different attack properties
- Incorporating parameterized hidden distributions into model training data can resist adversarial attacks
- Optimal choices of hidden distributions can produce model versions resistant to compound transferability attacks over time
- Practical method for DNN classifiers based on analytical insights shows significant improvements in robustness
- Generalization of analysis to construct robust model versions for complex classification tasks using linear SVMs
- Introduction of three key guidelines for addressing challenges in this critical research area

## Summary

In their paper "Towards Scalable and Robust Model Versioning," authors Wenxin Ding, Arjun Nitin Bhagoji, Ben Y. Zhao, and Haitao Zheng address the increasing threat of malicious attacks on deployed deep learning models. These attacks can manipulate model outcomes and pose significant risks to organizations relying on these models for critical tasks. To protect against such threats without acquiring new training data or changing the model architecture, the authors propose generating multiple versions of a model with different attack properties. By incorporating parameterized hidden distributions into the model training data, they show theoretically that these versions can resist adversarial attacks generated through white-box access to previously leaked models. Optimal choices of hidden distributions can produce a sequence of model versions capable of resisting compound transferability attacks over time. The authors design and implement a practical method for DNN classifiers based on their analytical insights. This approach leads to significant improvements in robustness compared to existing methods and presents a promising direction for safeguarding DNN services beyond their initial deployment. Furthermore, the authors generalize their analysis to apply insights from two-dimensional binary classification settings utilizing linear SVMs to construct robust model versions for more complex classification tasks. They also introduce three key guidelines for addressing challenges in this critical yet underexplored area of research.