[Paper Review] SEALing Neural Network Models in Secure Deep Learning Accelerators

Pengfei Zuo, Yu Hua+4 more|arXiv (Cornell University)|Aug 9, 2020

Adversarial Robustness in Machine Learning62 references4 citations

TL;DR

This paper proposes SEAL, a secure and efficient hardware acceleration framework for protecting neural network models in deep learning accelerators on edge devices. By combining criticality-aware smart encryption and colocation-mode encryption, SEAL reduces memory encryption overhead by 5–7% in IPC compared to baseline accelerators, achieving 1.4×–1.6× IPC improvement over traditional encryption methods while maintaining strong security against bus snooping attacks.

ABSTRACT

Deep learning (DL) accelerators are increasingly deployed on edge devices to support fast local inferences. However, they suffer from a new security problem, i.e., being vulnerable to physical access based attacks. An adversary can easily obtain the entire neural network (NN) model by physically snooping the GDDR memory bus that connects the accelerator chip with DRAM memory. Therefore, memory encryption becomes important for DL accelerators on edge devices to improve the security of NN models. Nevertheless, we observe that traditional memory encryption solutions that have been efficiently used in CPU systems cause significant performance degradation when directly used in DL accelerators. The main reason comes from the big bandwidth gap between the GDDR memory bus and the encryption engine. To address this problem, our paper proposes SEAL, a Secure and Efficient Accelerator scheme for deep Learning. SEAL enhances the performance of the encrypted DL accelerator from two aspects, i.e., improving the data access bandwidth and the efficiency of memory encryption. Specifically, to improve the data access bandwidth, SEAL leverages a criticality-aware smart encryption scheme which identifies partial data that have no impact on the security of NN models and allows them to bypass the encryption engine, thus reducing the amount of data to be encrypted. To improve the efficiency of memory encryption, SEAL leverages a colocation mode encryption scheme to eliminate memory accesses from counters used for encryption by co-locating data and their counters. Our experimental results demonstrate that, compared with traditional memory encryption solutions, SEAL achieves 1.4 ~ 1.6 times IPC improvement and reduces the inference latency by 39% ~ 60%. Compared with a baseline accelerator without memory encryption, SEAL compromises only 5% ~ 7% IPC for significant security improvement.

Motivation & Objective

• Address the critical security vulnerability in edge-based deep learning accelerators where neural network models can be extracted via physical bus snooping attacks on the GDDR memory bus.
• Overcome the severe performance degradation caused by traditional memory encryption techniques in high-bandwidth DL accelerators, which suffer from a bandwidth gap between GDDR and encryption engines.
• Design a secure and efficient memory encryption scheme that maintains strong cryptographic security while minimizing performance overhead for latency-sensitive edge inference workloads.
• Enable practical deployment of memory encryption in real-world edge AI accelerators by balancing security, performance, and hardware efficiency.

Proposed method

• Propose a criticality-aware smart encryption (SE) scheme that identifies and excludes non-critical data—such as certain activation values or intermediate outputs—from encryption, reducing the total data volume requiring encryption.
• Implement a colocation-mode encryption (ColoE) scheme that co-locates data with their corresponding encryption counters on-chip, eliminating the need for separate memory accesses to fetch counters during decryption.
• Integrate the SE and ColoE schemes into a unified hardware architecture that operates in parallel with the GDDR memory interface, minimizing latency and maximizing bandwidth utilization.
• Use one-time pad (OTP) generation via counter-based encryption in conjunction with XOR operations to ensure semantic security, similar to counter mode encryption but with reduced memory access overhead.
• Optimize the encryption pipeline to hide decryption latency by overlapping counter generation with memory read operations, improving effective throughput.
• Evaluate the design using real-world DNN workloads (e.g., ResNet, VGG) on a GPU-based accelerator platform to measure IPC, inference latency, and security guarantees.

Experimental results

Research questions

• RQ1 How can memory encryption be made efficient enough to be viable in high-bandwidth deep learning accelerators without incurring prohibitive performance overhead?
• RQ2 Which data in a neural network inference pipeline are cryptographically non-critical and can be safely excluded from encryption without compromising model security?
• RQ3 Can the performance bottleneck caused by counter memory accesses in traditional counter-mode encryption be eliminated through architectural co-location of data and counters?
• RQ4 To what extent can a hybrid encryption scheme combining smart data selection and counter co-location reduce the performance overhead of memory encryption in DL accelerators?

Key findings

• SEAL reduces inference latency by 39%–60% compared to traditional memory encryption solutions, which otherwise cause over 50% IPC degradation.
• Compared to a baseline accelerator without encryption, SEAL incurs only a 5%–7% IPC overhead while providing strong protection against bus snooping attacks.
• The criticality-aware smart encryption (SE) scheme reduces the total data volume requiring encryption, improving effective memory bandwidth and reducing encryption engine load.
• The colocation-mode encryption (ColoE) scheme eliminates separate memory accesses for counters, reducing memory traffic and improving encryption efficiency.
• SEAL achieves 1.4×–1.6× higher IPC than traditional encryption methods, demonstrating significant performance gains in bandwidth-constrained DL accelerators.
• The combination of SE and ColoE enables a practical, high-security solution suitable for deployment in real-time, latency-sensitive edge AI systems.