Abstract:Deep Neural Network (DNN) models are often deployed in resource-sharing clouds as Machine Learning as a Service (MLaaS) to provide inference <a class="link-external link-http" href="http://services.To" rel="external noopener nofollow">this http URL</a> steal model architectures that are of valuable intellectual properties, a class of attacks has been proposed via different side-channel leakage, posing a serious security challenge to MLaaS. Also targeting MLaaS, we propose a new end-to-end attack, DeepTheft, to accurately recover complex DNN model architectures on general processors via the RAPL-based power side channel. However, an attacker can acquire only a low sampling rate (1 KHz) of the time-series energy traces from the RAPL interface, rendering existing techniques ineffective in stealing large and deep DNN models. To this end, we design a novel and generic learning-based framework consisting of a set of meta-models, based on which DeepTheft is demonstrated to have high accuracy in recovering a large number (thousands) of models architectures from different model families including the deepest ResNet152. Particularly, DeepTheft has achieved a Levenshtein Distance Accuracy of 99.75% in recovering network structures, and a weighted average F1 score of 99.60% in recovering diverse layer-wise hyperparameters. Besides, our proposed learning framework is general to other time-series side-channel signals. To validate its generalization, another existing side channel is exploited, i.e., CPU frequency. Different from RAPL, CPU frequency is accessible to unprivileged users in bare-metal OSes. By using our generic learning framework trained against CPU frequency traces, DeepTheft has shown similarly high attack performance in stealing model architectures.

Leaky Nets: Recovering Embedded Neural Network Models and Inputs Through Simple Power and Timing Side-Channels—Attacks and Defenses

Physical Side-Channel Attacks on Embedded Neural Networks: A Survey

A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks

CSI Neural Network: Using Side-channels to Recover Your Artificial Neural Network Information

Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollers

Neural Network (NN)-Based Entropy: A New Metric for Evaluating Side-Channel Attacks

NNLeak: An AI-Oriented DNN Model Extraction Attack through Multi-Stage Side Channel Analysis

Neural Network-Based Entropy: A New Metric for Evaluating Side-Channel Attacks

A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

SparseLeakyNets: Classification Prediction Attack Over Sparsity-Aware Embedded Neural Networks Using Timing Side-Channel Information

DeepEM: Deep Neural Networks Model Recovery through EM Side-Channel Information Leakage

DeepTheft: Stealing DNN Model Architectures through Power Side Channel

A Review of Confidentiality Threats Against Embedded Neural Network Models

Open DNN Box by Power Side-Channel Attack

Adversarial Attacks on Neural-Network-Based Soft Sensors: Directly Attack Output

Neural Network-Based Side Channel Attacks and Countermeasures

InfoNEAT: Information Theory-based NeuroEvolution of Augmenting Topologies for Side-channel Analysis

Back Propagation Neural Network Based Leakage Characterization for Practical Security Analysis of Cryptographic Implementations

Side-Channel Analysis of OpenVINO-based Neural Network Models

Stealing Neural Network Structure Through Remote FPGA Side-Channel Analysis

Power Side-Channel Attacks on BNN Accelerators in Remote FPGAs