AI 프라이버시 보안 및 위협 방어 완전 가이드: 적대적 공격, 데이터 유출, 모델 보안 실전

AI 프라이버시 보안 및 위협 방어 완전 가이드: 적대적 공격 (Adversarial Attacks), 데이터 유출, 모델 보안 실전

서문
AI 시스템은 점점 더 많은 보안 위협에 직면하고 있습니다. 적대적 샘플 (Adversarial Examples)은 모델을 속일 수 있고, 데이터 유출은 훈련 프라이버시를 노출할 수 있으며, 모델 도난은 지식 재산권 손실을 초래할 수 있습니다. 2026년, AI 보안은 "선택"이 아닌 "필수"가 되었습니다. 본문에서는 AI 시스템의 보안 위협과 방어 메커니즘에 대해 심도 있게 설명합니다.

AI 보안 위협 개요

• 적대적 공격 (Adversarial Attacks)
  • 원리: 인간의 눈에는 보이지 않는 섭동 (Perturbation) 추가
  • 영향: 분류기 (Classifier) 기만, 탐지 우회
  • 방어: 적대적 훈련 (Adversarial Training), 입력 정화 (Input Purification)
• 데이터 유출 (Data Leakage)
  • 원리: 모델이 훈련 데이터를 기억함
  • 영향: 프라이버시 노출, 지식 재산권 손실
  • 방어: 차분 프라이버시 (Differential Privacy), 보안 집계 (Secure Aggregation)
• 모델 추출 (Model Extraction)
  • 원리: 반복적인 쿼리를 통해 모델 파라미터 추론
  • 영향: 지식 재산권 도난
  • 방어: 접근 제어 (Access Control), 출력 섭동 (Output Perturbation)
• 프롬프트 인젝션 (Prompt Injection)
  • 원리: 악의적인 명령어로 시스템 프롬프트 덮어쓰기
  • 영향: 탈옥 (Jailbreaking), 데이터 유출
  • 방어: 입력 검증 (Input Validation), 명령 분리 (Instruction Separation)
• 데이터 독성 (Data Poisoning)
  • 원리: 훈련 시 트리거 (Trigger) 삽입
  • 영향: 특정 입력이 악의적인 동작을 유발
  • 방어: 데이터 감사 (Data Auditing), 모델 탐지 (Model Detection)

적대적 공격 (Adversarial Attacks)
적대적 샘플 생성

import torch
import torch.nn as nn
import torch.nn.functional as F
import numpy as np
from typing import Tuple, Optional

class FastGradientMethod:
    """ FGM 적대적 공격 """
    def __init__(self, epsilon: float = 0.3):
        self.epsilon = epsilon

    def attack(self, model: nn.Module, images: torch.Tensor, labels: torch.Tensor, targeted: bool = False) -> torch.Tensor:
        model: 대상 모델
        images: 깨끗한 이미지 (B, C, H, W)
        labels: 실제 라벨
        targeted: 타겟 공격 여부
        images.requires_grad = True
        outputs = model(images)
        if targeted:
            loss = -F.cross_entropy(outputs, labels)
        else:
            loss = F.cross_entropy(outputs, labels)
        model.zero_grad()
        loss.backward()
        grad = images.grad.data
        adversarial = images + self.epsilon * grad.sign()
        adversarial = torch.clamp(adversarial, 0, 1)
        return adversarial

class ProjectedGradientDescent:
    """ PGD 적대적 공격 """
    def __init__(self, epsilon: float = 0.3, alpha: float = 0.01, num_iter: int = 40, random_start: bool = True):
        self.epsilon = epsilon
        self.alpha = alpha
        self.num_iter = num_iter
        self.random_start = random_start

    def attack(self, model: nn.Module, images: torch.Tensor, labels: torch.Tensor, targeted: bool = False) -> torch.Tensor:
        """ PGD 공격 """
        B = images.shape[0]
        if self.random_start:
            delta = torch.rand_like(images) * 2 * self.epsilon - self.epsilon
        else:
            delta = torch.zeros_like(images)
        delta = torch.clamp(delta, -self.epsilon, self.epsilon)
        adversarial = (images + delta).detach()
        for i in range(self.num_iter):
            adversarial

requires_grad = True
outputs = model(adversarial) if targeted:
loss = -F.cross_entropy(outputs, labels)
else:
loss = F.cross_entropy(outputs, labels)
model.zero_grad()
loss.backward()
with torch.no_grad():
grad = adversarial.grad.sign()
adversarial = adversarial + self.alpha * grad
delta = adversarial - images
delta = torch.clamp(delta, -self.epsilon, self.epsilon)
adversarial = images + delta
return adversarial
class CarliniWagnerAttack:
""" C&W 적대적 공격 (Adversarial Attack) """
def init(self, epsilon: float = 0.3, lr: float = 0.01, iterations: int = 1000, initial_const: float = 0.01):
self.epsilon = epsilon
self.lr = lr
self.iterations = iterations
self.initial_const = initial_const
def attack(self, model: nn.Module, images: torch.Tensor, labels: torch.Tensor, targeted: bool = False) -> torch.Tensor:
""" C&W L2 적대적 공격 (Adversarial Attack) """
model.eval()
B = images.shape[0]
const = torch.ones(B) * self.initial_const
w = torch.zeros_like(images)
w.data = torch.atanh(images * (1 - 1e-6))
optimizer = torch.optim.Adam([w], lr=self.lr)
for iteration in range(self.iterations):
optimizer.zero_grad()
adversarial = torch.tanh(w) * 0.5 + 0.5
delta = adversarial - images
delta = torch.clamp(delta, -self.epsilon, self.epsilon)
outputs = model(images + delta)
if targeted:
target_loss = F.cross_entropy(outputs, labels)
else:
target_loss = -F.cross_entropy(outputs, labels)
l2_loss = torch.sum((adversarial - images)**2)
loss = target_loss + const * l2_loss
loss.backward()
optimizer.step()
adversarial = images + torch.clamp(torch.tanh(w) * 0.5 + 0.5 - images, -self.epsilon, self.epsilon)
return adversarial
class DeepFoolAttack:
""" DeepFool 적대적 공격 (Adversarial Attack) """
def init(self, epsilon: float = 0.02, max_iter: int = 50):
self.epsilon = epsilon
self.max_iter = max_iter
def attack(self, model: nn.Module, images: torch.Tensor, labels: torch.Tensor) -> torch.Tensor:

Tensor : "DeepFool 공격"
model.eval()
adversarial = images.clone().detach()
adversarial.requires_grad = True
B = images.shape[0]
for i in range(self.max_iter):
outputs = model(adversarial)
, predicted = outputs.max(1) # 이미 분류 오류가 발생했는지 확인
if (predicted != labels).sum().item() == B:
for j in range(B):
if predicted[j] == labels[j]:
model.zero_grad()
output_j = outputs[j, labels[j]]
output_j.backward(retain_graph=True)
grad_true = adversarial.grad[j].clone()
other_labels = [k for k in range(outputs.shape[1]) if k != labels[j]]
min_norm = float('inf')
min_grad = None
for k in other_labels:
model.zero_grad()
output_k = outputs[j, k]
output_k.backward(retain_graph=True)
grad_k = adversarial.grad[j].clone()
diff = outputs[j, k] - outputs[j, labels[j]]
norm = torch.abs(diff) / (torch.norm(grad_k - grad_true) + 1e-10)
if norm.item() < min_norm:
min_norm = norm.item()
min_grad = grad_k - grad_true
if min_grad is not None:
perturb = min_norm * min_grad / (torch.norm(min_grad) + 1e-10)
adversarial[j] = adversarial[j] + perturb
adversarial.grad.zero()
return adversarial

공격 방어 (Adversarial Defense)

공격 훈련 및 탐지 (Adversarial Training and Detection)

import torch
import torch.nn as nn
import torch.nn.functional as F
from typing import Tuple

class AdversarialTrainer:
""" 적대적 훈련기 (Adversarial Trainer) """
def init(self, model: nn.Module, epsilon: float = 0.3, alpha: float = 0.01, num_iter: int = 7):
self.model = model
self.epsilon = epsilon
self.alpha = alpha
self.num_iter = num_iter
self.pgd = ProjectedGradientDescent(epsilon=epsilon, alpha=alpha, num_iter=num_iter)

def train_epoch(self, train_loader, device: str =

zero_grad () outputs_clean = self . model ( images ) loss_clean = F . cross_entropy ( outputs_clean , labels ) outputs_adv = self . model ( adversarial ) loss_adv = F . cross_entropy ( outputs_adv , labels ) loss = loss_clean + loss_adv loss . backward () optimizer . step () total_loss += loss . item () return total_loss / len ( train_loader ) class InputPurification : def init ( self ): self . denoiser = None def purify ( images : torch . Tensor , model : nn . Module ) -> torch . Tensor : # 실제 사용 시 전용 디노이저(denoiser) 사용 blurred = self . _gaussian_blur ( images ) # 2. JPEG 압축 근사 compressed = self . _jpeg_compress ( blurred ) cropped = self . _random_crop ( compressed ) return cropped def _gaussian_blur ( images : torch . Tensor , kernel_size : int = 5 , sigma : float = 1.0 ) -> torch . Tensor : import torch.nn as nn if self . denoiser is None : self . denoiser = nn . Sequential ( nn . Conv2d ( 3 , 64 , 3 , padding = 1 ), nn . Conv2d ( 64 , 64 , 3 , padding = 1 ), nn . Conv2d ( 64 , 3 , 3 , padding = 1 ) return self . denoiser ( images ) def _jpeg_compress ( images : torch . Tensor , quality : int = 75 ) -> torch . Tensor : """ 간소화된 JPEG 압축 """ # 실제 적용 시에는 진정한(real) JPEG 압축 필요 # 여기서는 양자화(quantization) 연산으로 단순화 return ( images * 255 ). round () / 255 def _random_crop ( images : torch . Tensor , crop_ratio : float = 0.9 ) -> torch . Tensor : B , C , H , W = images . shape crop_h = int ( H * crop_ratio ) crop_w = int ( W * crop_ratio ) start_h = ( H - crop_h ) // 2 start_w = ( W - crop_w ) // 2 cropped = images [:, :, start_h : start_h + crop_h , start_w : start_w + crop_w ] return F . interpolate ( size = ( H , W ), mode = ' bilinear ' , align_corners = False class MagNetDetector : """ MagNet 적대적 샘플(Adversarial Sample) 탐지기 """ def init ( self ): self . regressor = None self . detector = None def compute_distance ( original : torch . Tensor , reconstructed : torch . Tensor ) -> torch . Tensor : """ 재구성 거리 계산 """ distance = torch . mean (( original - reconstructed ) ** 2 , dim = ( 1 , 2 , 3 )) return distance def detect ( images : torch .

Tensor, threshold: float = 0.001) -> Tuple[torch.Tensor, torch.Tensor]: (is_adversarial, scores)
reconstructed = self.reconstructor(images)
distances = self.compute_distance(images, reconstructed)
is_adversarial = distances > threshold
return is_adversarial, distances
class FeatureDistillationDefense: """ 특징 증류 방어 (Feature Distillation Defense) """
def init(self, teacher_model: nn.Module, student_model: nn.Module):
self.teacher = teacher_model
self.student = student_model
def distill(images: torch.Tensor, temperature: float = 2.0) -> Tuple[torch.Tensor, torch.Tensor]: (teacher_outputs, student_outputs)
self.teacher.eval()
self.student.eval()
with torch.no_grad():
teacher_outputs = self.teacher(images)
teacher_soft = F.softmax(teacher_outputs / temperature, dim=1)
student_outputs = self.student(images)
return teacher_soft, student_outputs
def compute_loss(teacher_soft: torch.Tensor, student_outputs: torch.Tensor, hard_labels: torch.Tensor, alpha: float = 0.7, temperature: float = 2.0) -> torch.Tensor:
# alpha: 하드 레이블 가중치 (Hard label weight)
soft_loss = F.kl_div(F.log_softmax(student_outputs / temperature, dim=1), teacher_soft, reduction='batchmean') * (temperature ** 2)
hard_loss = F.cross_entropy(student_outputs, hard_labels)
loss = alpha * hard_loss + (1 - alpha) * soft_loss
return loss
데이터 프라이버시 보호: 차분 프라이버시 구현 (Data Privacy Protection: Differential Privacy Implementation)
import torch
import torch.nn as nn
import numpy as np
from typing import Callable, Optional
class DPSGD: """ 차분 프라이버시 확률적 경사 하강법 (Differential Privacy SGD) """
def init(self, model: nn.Module, optimizer: torch.optim.Optimizer, noise_multiplier: float = 1.0, max_grad_norm: float = 1.0, secure_rng: bool = False):
self.model = model
self.optimizer = optimizer
self.noise_multiplier = noise_multiplier
self.max_grad_norm = max_grad_norm
self.secure_rng = secure_rng
self.iteration = 0
self.sample_size = 0
loss: torch.Tensor, sample_size: int
sample_size: 샘플 수
self.

sample_size = sample_size loss.backward() self._clip_gradients() self._add_noise() self.optimizer.step() self.optimizer.zero_grad() self.iteration += 1
def clip_gradients(self):
total_norm = 0.0
for param in self.model.parameters():
if param.grad is not None:
param_norm = param.grad.data.norm(2)
total_norm += param_norm.item()2
total_norm = total_norm0.5
clip_coef = self.max_grad_norm / (total_norm + 1e-6)
if clip_coef < 1:
for param in self.model.parameters():
if param.grad is not None:
param.grad.data.mul(clip_coef)
def add_noise(self):
""" 가우시안 노이즈 추가 """
noise_std = self.noise_multiplier * self.max_grad_norm
for param in self.model.parameters():
if param.grad is not None:
noise = torch.randn_like(param.grad) * noise_std
param.grad.data.add(noise)
def get_privacy_spent(self) -> tuple:
# RDP (Rényi Differential Privacy) 사용
q = self.sample_size / 10000 # 총 데이터셋 크기 가정
sigma = self.noise_multiplier
rdp = q * (alpha / (2 * sigma**2))
epsilon = rdp * self.iteration
delta = 1e-5
return epsilon, delta
class PATEAnalysis:
""" PATE 프라이버시 분석 (교사 집합 프라이버시) """
def init(self, num_teachers: int):
self.num_teachers = num_teachers
self.teacher_preds = {}
def add_teacher_prediction(teacher_id: int, inputs: torch.Tensor, prediction: int):
""" 교사 예측 추가 """
if teacher_id not in self.teacher_preds:
self.teacher_preds[teacher_id] = []
self.teacher_preds[teacher_id].append({"inputs": inputs, "prediction": prediction})
def aggregate_predictions(input_ids: torch.Tensor, mechanism: str =

equal(pred["inputs"], input_ids): label = pred["prediction"] if label not in votes : votes[label] = 0
votes[label] += 1
if mechanism == "noisy_max" :
noise_scale = 1.0
noisy_votes = {label: count + np.random.laplace(0, noise_scale) for label, count in votes.items()}
aggregated = max(noisy_votes, key=noisy_votes.get)
elif mechanism == "threshold" :
threshold = self.num_teachers // 2
for label, count in votes.items():
if count >= threshold:
aggregated = label
aggregated = max(votes, key=votes.get)
aggregated = max(votes, key=votes.get)
privacy_cost = 1.0 / (self.num_teachers - max(votes.values()) + 1)
return aggregated, privacy_cost
class SecretS