Abstract:Deep Neural Network (DNN) models are often deployed in resource-sharing clouds as Machine Learning as a Service (MLaaS) to provide inference <a class="link-external link-http" href="http://services.To" rel="external noopener nofollow">this http URL</a> steal model architectures that are of valuable intellectual properties, a class of attacks has been proposed via different side-channel leakage, posing a serious security challenge to MLaaS. Also targeting MLaaS, we propose a new end-to-end attack, DeepTheft, to accurately recover complex DNN model architectures on general processors via the RAPL-based power side channel. However, an attacker can acquire only a low sampling rate (1 KHz) of the time-series energy traces from the RAPL interface, rendering existing techniques ineffective in stealing large and deep DNN models. To this end, we design a novel and generic learning-based framework consisting of a set of meta-models, based on which DeepTheft is demonstrated to have high accuracy in recovering a large number (thousands) of models architectures from different model families including the deepest ResNet152. Particularly, DeepTheft has achieved a Levenshtein Distance Accuracy of 99.75% in recovering network structures, and a weighted average F1 score of 99.60% in recovering diverse layer-wise hyperparameters. Besides, our proposed learning framework is general to other time-series side-channel signals. To validate its generalization, another existing side channel is exploited, i.e., CPU frequency. Different from RAPL, CPU frequency is accessible to unprivileged users in bare-metal OSes. By using our generic learning framework trained against CPU frequency traces, DeepTheft has shown similarly high attack performance in stealing model architectures.

Preventing Neural Network Model Exfiltration in Machine Learning Hardware Accelerators

Guarding Machine Learning Hardware Against Physical Side-channel Attacks

Locking Machine Learning Models into Hardware

Stealing Machine Learning Models via Prediction APIs

Hardware-Assisted Intellectual Property Protection of Deep Learning Models

DeepTheft: Stealing DNN Model Architectures through Power Side Channel

Defense against ML-based Power Side-channel Attacks on DNN Accelerators with Adversarial Attacks

Mercury: An Automated Remote Side-channel Attack to Nvidia Deep Learning Accelerator

A Review of Confidentiality Threats Against Embedded Neural Network Models

Edge Deep Learning Model Protection via Neuron Authorization

Stealing Neural Network Structure Through Remote FPGA Side-Channel Analysis

Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollers

SparseLock: Securing Neural Network Models in Deep Learning Accelerators

Precise Extraction of Deep Learning Models via Side-Channel Attacks on Edge/Endpoint Devices

EdgePro: Edge Deep Learning Model Protection Via Neuron Authorization

On Reverse Engineering Neural Network Implementation on GPU

Bandwidth Utilization Side-Channel on ML Inference Accelerators

ModelObfuscator: Obfuscating Model Information to Protect Deployed ML-based Systems

Leaky Nets: Recovering Embedded Neural Network Models and Inputs Through Simple Power and Timing Side-Channels—Attacks and Defenses

HWGN2: Side-channel Protected Neural Networks through Secure and Private Function Evaluation

Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching Side-Channel