[Paper Review] Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks

Sanghyun Hong, Michael Davinroy+6 more|arXiv (Cornell University)|Oct 8, 2018

Adversarial Robustness in Machine LearningComputer Science31 references54 citations

TL;DR

The paper introduces DeepRecon, a cache side-channel attack that co-locates on the same host as a victim DNN to reconstruct the victim’s architecture and fingerprint model families, demonstrates accurate recovery of VGG19 and ResNet50 from a single forward pass, and proposes framework-level defenses using decoy TinyNets.

ABSTRACT

Recent work has introduced attacks that extract the architecture information of deep neural networks (DNN), as this knowledge enhances an adversary's capability to conduct black-box attacks against the model. This paper presents the first in-depth security analysis of DNN fingerprinting attacks that exploit cache side-channels. First, we define the threat model for these attacks: our adversary does not need the ability to query the victim model; instead, she runs a co-located process on the host machine victim's deep learning (DL) system is running and passively monitors the accesses of the target functions in the shared framework. Second, we introduce DeepRecon, an attack that reconstructs the architecture of the victim network by using the internal information extracted via Flush+Reload, a cache side-channel technique. Once the attacker observes function invocations that map directly to architecture attributes of the victim network, the attacker can reconstruct the victim's entire network architecture. In our evaluation, we demonstrate that an attacker can accurately reconstruct two complex networks (VGG19 and ResNet50) having observed only one forward propagation. Based on the extracted architecture attributes, we also demonstrate that an attacker can build a meta-model that accurately fingerprints the architecture and family of the pre-trained model in a transfer learning setting. From this meta-model, we evaluate the importance of the observed attributes in the fingerprinting process. Third, we propose and evaluate new framework-level defense techniques that obfuscate our attacker's observations. Our empirical security analysis represents a step toward understanding the DNNs' vulnerability to cache side-channel attacks.

Motivation & Objective

• Define a threat model where an attacker co-located on the same host monitors shared DNN framework code via cache side-channels.
• Develop DeepRecon to reconstruct the victim’s DNN architecture from Flush+Reload observations.
• Demonstrate the attacker’s ability to fingerprint architecture families and pre-trained teacher models in transfer learning.
• Evaluate defenses that obfuscate observations without requiring hardware or OS changes.

Proposed method

• Use Flush+Reload to monitor specific framework functions mapped to architecture attributes in a shared DL framework (TensorFlow, PyTorch/Caffe2).
• Observe function invocation sequences and counts to infer architecture attributes (convs, fcs, relus, pools, merges, biases).
• Map observed attributes to reconstruct whole network architectures (e.g., VGG19, ResNet50) from a single forward pass and multiple passes.
• Train meta-models (decision trees) on extracted attributes to fingerprint architecture families and teacher/student model relationships in transfer learning.
• Propose and evaluate framework-level defenses by running decoy TinyNets to obfuscate observed attributes and increase reconstruction error.

Experimental results

Research questions

• RQ1 Can a co-located attacker using cache side-channels reconstruct a victim DNN’s architecture without querying the model?
• RQ2 Which architecture attributes are most informative for fingerprinting DNNs from hardware-level observations?
• RQ3 To what extent can an attacker fingerprint architecture families or transfer-learning teacher models from observed attributes?
• RQ4 Do framework-level defenses (without hardware changes) effectively degrade the attacker’s ability to reconstruct architectures?

Key findings

• DeepRecon can accurately reconstruct the architectures of VGG19 and ResNet50 from observations of a single forward propagation.
• An attacker can extract 8 architecture attributes across 13 CNN architectures with high accuracy, enabling complete architecture reconstruction.
• A meta-model trained on extracted attributes can fingerprint architecture families and teacher models in transfer learning with high accuracy (reported as 100% in classification tasks).
• Important attributes for fingerprinting include #relus, #merges, #convs, and #apools across tasks and architectures.
• Framework-level defenses using decoy TinyNets significantly degrade attribute extraction, inducing thousands of errors (1283–2211) compared to baseline DeepRecon errors (≈2.9).
• Defenses do not require hardware or OS changes and can be integrated into common DL frameworks.