Time to Leak: Cross-Device Timing Attack On Edge Deep Learning Accelerator

Abstract

Edge deep learning accelerators are optimised hardware to enable efficient inference on the edge. The models deployed on these accelerators are often proprietary and thus sensitive for commercial and privacy reasons. In this paper, we demonstrate practical vulnerability of deployed deep learning models to timing side-channel attacks. By measuring the execution time of the inference, the adversary can determine and reconstruct the model from a known family of well known deep learning model and then use available techniques to recover remaining hyperparameters. The vulnerability is validated on Intel Compute Stick 2 for VGG and ResNet family of models. Moreover, the presented attack is quite devastating as it can be performed in a cross-device setting, where adversary profiles constructed on a legally own device can be used to exploit the victim device with a single query and still can achieve near perfect success rate.

A Buyer-traceable DNN Model IP Protection Method Against Piracy and Misappropriation

“…Machine Learning as a Service (MLaaS) and artificial intelligent (AI) compilers for mapping pretrained DNN models onto efficient edge accelerator platform. The emerging model extraction techniques [1]- [4] make it feasible to reverse engineer a deployed DNN model and rebuild an AI product or solution with similar quality at a lower cost than re-designing a DNN from scratch. The rampant DNN IP infringement is further exacerbated by the lack of buyer traceability to deter fraudsters from misappropriation of distributed models.…”

Identity-Based and Leakage-Resilient Broadcast Encryption Scheme for Cloud Storage Service

“…Unfortunately, side-channel attacks [8][9][10][11][12][13] have been discovered in recent years. Through some characteristic information such as the algorithm execution time and power loss, attackers can reveal some important information of the cryptographic system, even secret information such as private keys.…”

Anonymous Identity Based Broadcast Encryption against Continual Side Channel Attacks in the State Partition Model

“…In the past 10 years, cryptography has made great progress in expanding the adversary model to cover side-channel attacks [1][2][3][4], and researchers have built some provably secure cryptographic schemes that can resist some side-channel attacks. In most theoretical work, it is assumed that the participants have complete confidentiality to their local computation.…”

“…The side-channel attack obtains secret information about the cryptographic system by measuring the surrounding environment of the machine that is executing the related algorithms. For example, an attacker obtains the relevant confidential information of the cryptographic system by measuring and analyzing the time [4] or the electromagnetic radiation [8] of the specific algorithm. Through the "cold start" attack [9], if an adversary can access the corresponding physical device, it can recover part of the key of the cryptographic system even when the power has just been cut off.…”