On Reverse Engineering Neural Network Implementation on GPU

Chmielewski, Łukasz; Weissbart, Léo

doi:10.1007/978-3-030-81645-2_7

Cited by 21 publications

(5 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Attacks on neural networks not only threaten the recovery of confidential models but also the sensitive input can be recovered with a similar approach [9]. Chmielewski and Weissbart managed to reverse engineer implemented neural network on Nvidia Jetson Nano, a module computer embedding a Tegra X1 SoC combining an ARM Cortex-A57 CPU and a 128-core GPU within a Maxwell architecture by using simple EM analysis [10]. Further, side-channel in a server setting has threatened cloud-based model execution, as demonstrated by Wei et al [11].…”

Section: Perspectives and Long-term Impactmentioning

confidence: 99%

SCA Strikes Back: Reverse-Engineering Neural Network Architectures Using Side Channels

Batina¹,

Bhasin²,

Jap³

et al. 2022

IEEE Des. Test

139

View full text Add to dashboard Cite

Section: Perspectives and Long-term Impactmentioning

confidence: 99%

SCA Strikes Back: Reverse-Engineering Neural Network Architectures Using Side Channels

Batina¹,

Bhasin²,

Jap³

et al. 2022

IEEE Des. Test

139

View full text Add to dashboard Cite

“…Other hyper-parameters are Padding P and Stride S that, respectively, adds extra dimensions (P ) to handle the borders of the input tensor 2 and enables to downsample (by S) the sliding 3 . The output tensor shape is defined as in Eq.…”

Section: Background 21 Neural Network Modelsmentioning

confidence: 99%

A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

Joud

Moëllic

Pontié

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Model extraction is a growing concern for the security of AI systems. For deep neural network models, the architecture is the most important information an adversary aims to recover. Being a sequence of repeated computation blocks, neural network models deployed on edge-devices will generate distinctive side-channel leakages. The latter can be exploited to extract critical information when targeted platforms are physically accessible. By combining theoretical knowledge about deep learning practices and analysis of a widespread implementation library (ARM CMSIS-NN), our purpose is to answer this critical question: how far can we extract architecture information by simply examining an EM side-channel trace? For the first time, we propose an extraction methodology for traditional MLP and CNN models running on a high-end 32-bit microcontroller (Cortex-M7) that relies only on simple pattern recognition analysis. Despite few challenging cases, we claim that, contrary to parameters extraction, the complexity of the attack is relatively low and we highlight the urgent need for practicable protections that could fit the strong memory and latency requirements of such platforms.

show abstract

“…Zhang [64] successfully extracted the structure of a network running on an FPGA via power side-channel. Chmielewski [18] targeted GPU DNN implementations and recovered the model structure with EM side-channel information. All the prior work focuses on reverse engineering partial model information, while our work associates the EM emanation patterns with input sample classes.…”

Section: Electromagnetic and Power Side-channelmentioning

confidence: 99%

EMShepherd: Detecting Adversarial Samples via Side-channel Leakage

Ding¹,

Gongye²,

Wang³

et al. 2023

Preprint

View full text Add to dashboard Cite

Deep Neural Networks (DNN) are vulnerable to adversarial perturbations -small changes crafted deliberately on the input to mislead the model for wrong predictions. Adversarial attacks have disastrous consequences for deep learning empowered critical applications. Existing defense and detection techniques both require extensive knowledge of the model, testing inputs and even execution details. They are not viable for general deep learning implementations where the model internal is unknown, a common 'black-box' scenario for model users. Inspired by the fact that electromagnetic (EM) emanations of a model inference are dependent on both operations and data and may contain footprints of different input classes, we propose a framework, EMShepherd, to capture EM traces of model execution, perform processing on traces and exploit them for adversarial detection. Only benign samples and their EM traces are used to train the adversarial detector: a set of EM classifiers and class-specific unsupervised anomaly detectors. When the victim model system is under attack by an adversarial example, the model execution will be different from executions for the known classes, and the EM trace will be different. We demonstrate that our air-gapped EMShepherd can effectively detect different adversarial attacks on a commonly used FPGA deep learning accelerator for both Fashion MNIST and CIFAR-10 datasets. It achieves a 100% detection rate on most types of adversarial samples, which is comparable to the state-of-the-art 'white-box' software-based detectors. CCS CONCEPTS• Security and privacy → Side-channel analysis and countermeasures; Embedded systems security.

show abstract

On Reverse Engineering Neural Network Implementation on GPU

Cited by 21 publications

References 24 publications

SCA Strikes Back: Reverse-Engineering Neural Network Architectures Using Side Channels

SCA Strikes Back: Reverse-Engineering Neural Network Architectures Using Side Channels

A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

EMShepherd: Detecting Adversarial Samples via Side-channel Leakage

Contact Info

Product

Resources

About