A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

Abstract

Model extraction is a growing concern for the security of AI systems. For deep neural network models, the architecture is the most important information an adversary aims to recover. Being a sequence of repeated computation blocks, neural network models deployed on edge-devices will generate distinctive side-channel leakages. The latter can be exploited to extract critical information when targeted platforms are physically accessible. By combining theoretical knowledge about deep learning practices and analysis of a widespread implementation library (ARM CMSIS-NN), our purpose is to answer this critical question: how far can we extract architecture information by simply examining an EM side-channel trace? For the first time, we propose an extraction methodology for traditional MLP and CNN models running on a high-end 32-bit microcontroller (Cortex-M7) that relies only on simple pattern recognition analysis. Despite few challenging cases, we claim that, contrary to parameters extraction, the complexity of the attack is relatively low and we highlight the urgent need for practicable protections that could fit the strong memory and latency requirements of such platforms.

Power Analysis of Floating-Point Operations for Leakage Resistance Evaluation of Neural Network Model Parameters

“…Assuming the Hamming weight (HW) model as the leakage model as in previous works [8], [15], [16], we compute CPA-guesses G based on H (Y ), where H (x) denotes the HW of the IEEE 754 representation of the variable x.…”

“…In particular, precise extraction of target models, so-called model reverse-engineering, attempts to recover the model architecture and/or model parameters of deep neural networks (DNNs). Model reverse-engineering attacks based on sidechannel analysis (SCA), such as timing analysis (TA) [3] and power analysis (PA) [4] -typically correlation power analysis (CPA) [5], correlation electromagnetic analysis (CEMA) [6], and simple power analysis (SPA) [4] -, are now being proposed [7]- [16].…”

“…Joud et al [16] proposed a CEMA-based attack to recover weights with high precision, as fidelity-oriented extraction [17], using both electromagnetic (EM) traces acquired on an ARM Cortex-M7 with FPU and simulated traces. Bias recovery has been mentioned as a remaining challenge for the full extraction of DNN models.…”

When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence

“…To validate the methodology introduced in Section 3.1, the NNOM softmax function is targeted. We choose this implementation as it is a common solution in the literature [20,35,51,58]. Whereas traditional softmax function is defined by a normalization which maps the logits (or the confidence scores) to a probability distribution following…”

“…In [6], Batina et al proposed a hardware attack scenario based on side-channel attacks, in order to steal the IP and the inputs of a targeted embedded model. The practicability of the latter scenario has nevertheless been questioned when an attacker has to deal with real-world and complex DNN implementations [34]. A second key consideration for the IP comes from the privacy of the input data during training and inference time.…”