Using side-channel and quantization vulnerability to recover DNN weights

Jinghai LI; Ming TANG; Chengxuan HUANG

doi:10.11959/j.issn.2096-109x.2021038

您当前的位置：

首页 >

文章列表页 >

Using side-channel and quantization vulnerability to recover DNN weights

TopicⅠ: Network Security: Attack and Defense | 更新时间：2024-06-03

- Using side-channel and quantization vulnerability to recover DNN weights
- Chinese Journal of Network and Information Security Vol. 7, Issue 4, Pages: 53-67(2021)
- 作者机构：
  
  1. 武汉大学国家网络安全学院空天信息安全与可信计算教育部重点实验室，湖北武汉 430072
  2. 密码科学技术国家重点实验室，北京 100878
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021038
  CLC： TP309.2
- Online First：2021-08，
  
  Published：15 August 2021
- 稿件说明：
移动端阅览
Jinghai LI, Ming TANG, Chengxuan HUANG. Using side-channel and quantization vulnerability to recover DNN weights[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 53-67.
DOI：

Jinghai LI, Ming TANG, Chengxuan HUANG. Using side-channel and quantization vulnerability to recover DNN weights[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 53-67. DOI： 10.11959/j.issn.2096-109x.2021038.

摘要

模型逆向攻击旨在恢复部署在推理终端的神经网络模型的结构和权重值，是 AI 安全中的基础问题，为对抗样本等高阶攻击提供数据支撑。提出了一种名为 Cluster-based SCA 的新型模型权重逆向方法，该方法不要求攻击者构造泄露模型。Cluster-based SCA方法以量化推理中存在的安全隐患为出发点，深入分析了量化推理过程，发现在量化推理中存在的输出序列分类不等价现象可以判断猜测权重的正确与否。Cluster-based SCA 将采集到的模型运行时产生的侧信道信息按照假设权重产生的中间值进行分类，以分类后的平均离散系数

为评判标准，取

最小时的权重为逆向权重。在仿真实验上验证了 Cluster-based SCA方法的有效性，实验使用汉明重模型来模拟AI芯片的泄露模型，对于目标CNN，Cluster-based SCA方法以52.66%的TOP2恢复率恢复了其第一层卷积层所有卷积核权重，对于取值位于显著区的权重，TOP2的恢复率均达到了100%。

Abstract

Model extraction attack focuses on reverse engineering architecture and weights of DNN model deployed in edge.Model extraction attack is a basic security problem in AI security

it underlies advanced attacks as data prov

ider

such as adversarial sample and data poisoning.A novel method named Cluster-based SCA was proposed

this method did not need leakage model.Cluster-based SCA was based on vulnerability of quantized inference.There exist a phenomenon in multiplication operation in quantized inference

which the output of different weights were not equivalent in respect of classification.It can be used to distinguish different weights.The proposed method computed output activations of each DNN layer with guessing weight.Then acquired side channel signal were classified into different class

the taxonomy was corresponding output activations' value.Average dispersion of all classes

was used to decide whether guess was right.The effectiveness of Cluster-based SCA method was verified by simulation experiment and HW model was used as target leakage model.For all weights from first convolution layer of target CNN model

TOP2 recovery rate was 52.66%.And for large weights in significant interval

TOP2 recover rate was 100%.

关键词

Keywords

references

KURAKIN A , GOODFELLOW I J , BENGIO S , et al . Adversarial examples in the physical world [J ] . CoRR,abs/1607.02533 , 2016 .

GOODFELLOW I J , SHLENS J , SZEGEDY C , et al . Explaining and harnessing adversarial examples [C ] // 3rd International Conference on Learning Representations(ICLR 2015) . 2015 .

BIGGIO B , NELSON B , LASKOV P , et al . Poisoning attacks against support vector machines [C ] // Proceedings of the 29th International Conference on Machine Learning(ICML 2012) . 2012 .

XIAO H , BIGGIO B , BROWN G , et al . Is feature selection secure against training data poisoning? [J ] . CoRR,abs /1804.07933 , 2018 .

SHOKRI R , STRONATI M , SONG C Z , et al . Membership inference attacks against machine learning models [C ] // 2017 IEEE Symposium on Security and Privacy (SP 2017) . 2017 : 3 - 18 .

TRAM_ER F , ZHANG F , JUELS A , et al . Stealing machine learning models via prediction apis [C ] // 25th USENIX Security Symposium . 2016 : 601 - 618 .

OH S J , AUGUSTIN M , FRITZ M , et al . Towards reverse-engineering black-box neural networks [C ] // 6th International Conference on Learning Representations(ICLR 2018) . 2018 .

BATINA L , BHASIN S , JAP D , et al . CSI NN:reverse engineering of neural network architectures through electromagnetic side channel [C ] // 28th USENIX Security Symposium . 2019 : 515 - 532 .

OREKONDY T , SCHIELE B , FRITZ M , et al . Knockoff nets:stealing functionality of black-box models [C ] // IEEE Conference on Computer Vision and Pattern Recognition(CVPR 2019) . 2019 : 4954 - 4963 .

HUA W , ZHANG Z R , SUH G E . Reverse engineering convolutional neural networks through side-channel information leaks [C ] // Proceedings of the 55th Annual Design Automation Conference (DAC 2018) . 2018 : 41 - 46 .

WEI L X , LUO B , LI Y , et al . I know what you see:Power side-channel attack on convolutional neural network accelerators [C ] // Proceedings of the 34th Annual Computer Security Applications Conference . 2018 : 393 - 406 .

HU X , LIANG L , DENG L , et al . Neural network model extraction attacks in edge devices by hearing architectural hints [J ] . CoRR,abs/1903.03916 , 2019 .

HAN S , MAO H Z , DALLY W J . Deep compression:compressing deep neural networks with pruning,trained quantization and human coding [C ] // ICLR 2016 . 2016 .

JACOB B , KLIGYS S , CHEN B , et al . Quantization and training of neural networks for efficient integer- arithmetic-only inference [C ] // 2018 IEEE Conference on Computer Vision and Pattern Recognition(CVPR 2018) . 2008 : 2704 - 2713 .

RASTEGARI M , ORDONEZ V , REDMON J , et al . Xnor-net:Imagenet classification using binary convolutional neural networks [J ] . CoRR,abs/1603.05279 , 2016 .

PATIL N , JOUPPI N P , YOUNG C , et al . In-datacenter performance analysis of a tensor processing unit [C ] // Proceedings of the 44th Annual International Symposium on Computer Architecture(ISCA 2017) . 2017 : 1 - 12 .

KOCHER P C , . Timing attacks on implementations of Diffie-Hellman,RSA,DSS,and other systems [C ] // Advances in Cryptology | CRYPTO '96 . 1996 : 104 - 113 .

MANGARD S , . A simple power-analysis (spa) attack on implementations of the AES key expansion [C ] // International Conference on Information Security and Cryptology(ICISC 2002) . 2002 : 343 - 358 .

KOCHER P , JAFFE J , JUN B . Differential power analysis [C ] // Advances in Cryptology(CRYPTO' 99) . 1999 : 388 - 397 .

BRIER E , CLAVIER C , OLIVIER F . Correlation power analysis with a leakage model [C ] // Cryptographic Hardware and Embedded Systems(CHES 2004) . 2004 : 16 - 29 .

KRIZHEVSKY A . One weird trick for parallelizing convolutional neural networks [J ] . CoRR,abs/1404.5997 , 2014 .

HE K , ZHANG X Y , REN S Q , et al . Deep residual learning for image recognition [C ] // 2016 IEEE Conference on Computer Vision and Pattern Recognition(CVPR 2016) . 2016 : 770 - 778 .

KRISHNAMOORTHI R . Quantizing deep convolutional networks for efficient inference:a whitepaper [M ] . CoRR,abs/1806.08342 , 2018 .

LIN D D , SACHIN S , TALATHI V , et al . Fixed point quantization of deep convolutional networks [C ] // Proceedings of the 33nd International Conference on Machine Learning(ICML 2016) . 2016 : 2849 - 258 .

Views

287

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on electromagnetic radiation based side-channel analysis method for hardware Trojan detection

Research on hardware Trojan defense

Related Author

Yongkang TANG

Xing HU

Ting SU

Shaoqing LI

Kan WANG

Hao CHEN

Xu-guang GUAN

Yong GU

Related Institution

No data

⁰