Deep neural networks are increasingly deployed across heterogeneous and partially untrusted environments, where models are distributed through cloud storage, CI/CD pipelines, containerized services, and edge execution platforms. This broad deployment landscape exposes model parameters to various integrity risks. Unlike input-space adversarial attacks, parameter attacks directly tamper with the model's internal parameters and persist across all subsequent inferences. Existing defenses either require retraining, incur significant accuracy degradation, or are limited to specific attack classes. However, in real-world deployment scenarios, the forms of parameter attacks are often unpredictable. To address this challenge, we present ParDef, a generalized defense for deep neural networks against diverse types of parameter attacks. ParDef integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty. Our evaluation on CIFAR-10, CIFAR-100, and Tiny-ImageNet using ResNet and VGG models demonstrates that ParDef consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead. These results highlight that ParDef is a practical and generalized defense for DNN deployments.

翻译：深度神经网络正日益部署于异构且部分不可信的环境中，模型通过云存储、CI/CD流水线、容器化服务及边缘执行平台进行分发。这种广泛的部署格局使模型参数面临多种完整性风险。与输入空间对抗攻击不同，参数攻击直接篡改模型内部参数，并在后续所有推理过程中持续生效。现有防御方法要么需要重训练，要么导致显著的精度下降，或局限于特定攻击类别。然而，在实际部署场景中，参数攻击的形式往往不可预测。针对这一挑战，我们提出ParDef——一种面向深度神经网络、针对多样参数攻击类型的通用防御方法。ParDef集成了密钥通道重参数化（可隐藏敏感参数方向）、QC-LDPC量化（嵌入冗余并支持纠错），以及自适应鲁棒推理（在不确定性下稳定预测）。我们在CIFAR-10、CIFAR-100和Tiny-ImageNet数据集上，采用ResNet与VGG模型进行的评估表明，ParDef能持续降低不同参数攻击的成功率，同时保持高模型性能并仅引入适度的部署开销。这些结果凸显了ParDef作为深度神经网络部署中实用且通用防御方法的潜力。