Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hints

Abstract

As neural networks continue their reach into nearly every aspect of software operations, the details of those networks become an increasingly sensitive subject. Even those that deploy neural networks embedded in physical devices may wish to keep the inner working of their designs hidden -- either to protect their intellectual property or as a form of protection from adversarial inputs. The specific problem we address is how, through heavy system stack, given noisy and imperfect memory traces, one might reconstruct the neural network architecture including the set of layers employed, their connectivity, and their respective dimension sizes. Considering both the intra-layer architecture features and the inter-layer temporal association information introduced by the DNN design empirical experience, we draw upon ideas from speech recognition to solve this problem. We show that off-chip memory address traces and PCIe events provide ample information to reconstruct such neural network architectures accurately. We are the first to propose such accurate model extraction techniques and demonstrate an end-to-end attack experimentally in the context of an off-the-shelf Nvidia GPU platform with full system stack. Results show that the proposed techniques achieve a high reverse engineering accuracy and improve the one's ability to conduct targeted adversarial attack with success rate from 14.6\%$\sim$25.5\% (without network architecture knowledge) to 75.9\% (with extracted network architecture).

References in corpus (3)

• Binarized Neural Networks
• The Microsoft 2016 Conversational Speech Recognition System
• I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

Cited by in corpus (18)

• I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences
• Side-channel attack analysis on in-memory computing architectures
• NeurObfuscator: A Full-stack Obfuscation Tool to Mitigate Neural Architecture Stealing
• Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA
• ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-based Systems
• Revealing CNN Architectures via Side-Channel Analysis in Dataflow-based Inference Accelerators
• EHAP-ORAM: Efficient Hardware-Assisted Persistent ORAM System for Non-volatile Memory
• SESAME: Software defined Enclaves to Secure Inference Accelerators with Multi-tenant Execution
• Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel
• Careful What You Wish For: on the Extraction of Adversarially Trained Models
• SEALing Neural Network Models in Secure Deep Learning Accelerators
• Stealing Deep Reinforcement Learning Models for Fun and Profit
• Ptolemy: Architecture Support for Robust Deep Learning
• RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy
• Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channels
• First to Possess His Statistics: Data-Free Model Extraction Attack on Tabular Data
• Bandwidth Utilization Side-Channel on ML Inference Accelerators
• Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness