Detecting model weight tampering in GPU memory (Rome attacks)

Researchers at Stealthium have proposed a method to detect model weight tampering in GPU memory, a type of attack known as a 'Rome attack'. This method involves using a 'guard' model to monitor the behavior of the target model during inference, and a 'detector' model to analyze the guard model's output. The guard model is trained to recognize patterns in the target model's behavior that are not seen during training, and the detector model is trained to identify when the guard model is producing an abnormal output. The method was tested on a variety of models and datasets, including the ResNet-50 and ImageNet datasets, and was found to be effective in detecting tampered models. The researchers propose that this method could be used to secure machine learning systems against Rome attacks.