Reverse Engineering Convolutional Neural Networks Through Side-channel Information Leaks

By Weizhe Hua, Zhiru Zhang, G. Suh. Design Automation Conference, 2018

298 citations recorded by the source corpus.

A convolutional neural network (CNN) model represents a crucial piece of intellectual property in many applications. Revealing its structure or weights would leak confidential information. In this paper we present novel reverse-engineering attacks on CNNs running on a hardware accelerator, where an adversary can feed inputs to the accelerator and observe the resulting off-chip memory accesses. Our study shows that even with data encryption, the adversary can infer the underlying network structure by exploiting the memory and timing side-channels. We further identify the information leakage on the values of weights when a CNN accelerator performs dynamic zero pruning for off-chip memory accesses. Overall, this work reveals the importance of hiding off-chip memory access pattern to truly protect confidential CNN models.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/6c0aef543a15edc1a52fe3490281e3fe36dac486

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Christopher W. Fletcher
2. Josep Torrellas
3. Mengjia Yan
4. Ruby B. Lee
5. Ming Ding
6. Farhad Farokhi
7. Bo Liu
8. Michel A. Kinsy

In Electrical and Electronic Engineering

1. Ming Ding
2. Josep Torrellas
3. Christopher W. Fletcher
4. Qiang Xu
5. N. Asokan
6. Mika Juuti
7. Mengjia Yan

In Hardware and Architecture

1. Ruby B. Lee
2. Ming Ding
3. Josep Torrellas
4. Michel A. Kinsy
5. Lejla Batina
6. Christopher W. Fletcher
7. Qiang Xu
8. Mihailo Isakov

Citations in the corpus

• Model inversion attacks against collaborative inference (2019, background): “The adversary attempts to steal the model parameters [44], hyperparameters [46] or structures [23, 33], via prediction APIs, memory access side channels, etc.”
• PRADA: Protecting Against DNN Model Stealing Attacks (2018, background): “[20] target a model locally isolated with hardware security mechanisms (Intel SGX) and introduce a hardware side channel attack to infer similar model information.”
• CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel (2019, background): “were first to reverse engineer two convolutional neural networks, namely AlexNet and SqueezeNet through memory and timing side-channel leaks [17].”
• When Machine Learning Meets Privacy (2020, background): “[56] “investigated reverse-engineering attacks on CNN models exploiting information leaks through memory and timing side-channels”.”
• Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures (2018, background): “[53] designed the first attack to steal CNN architectures running on a hardware accelerator.”
• I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators (2018, background): “Despite the aacks exploiting the privacy leakage in the training sets, Hua et al [11] presented a novel aack to reverse engineer the underlying network information.”
• Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “In [47], authors attempt to steal a model and model architecture running on a secure enclave such as Intel SGX [48], by”