[Paper Review] Stealing Neural Networks via Timing Side Channels

Vasisht Duddu, Debasis Samanta+2 more|arXiv (Cornell University)|Dec 31, 2018

Adversarial Robustness in Machine LearningComputer Science47 references89 citations

TL;DR

The paper shows a black-box timing side-channel attack that infers neural network depth from execution time, then uses reinforcement learning to search a substitute architecture with near-target accuracy, demonstrated on CIFAR-10 with VGG-like models.

ABSTRACT

Deep learning is gaining importance in many applications. However, Neural Networks face several security and privacy threats. This is particularly significant in the scenario where Cloud infrastructures deploy a service with Neural Network model at the back end. Here, an adversary can extract the Neural Network parameters, infer the regularization hyperparameter, identify if a data point was part of the training data, and generate effective transferable adversarial examples to evade classifiers. This paper shows how a Neural Network model is susceptible to timing side channel attack. In this paper, a black box Neural Network extraction attack is proposed by exploiting the timing side channels to infer the depth of the network. Although, constructing an equivalent architecture is a complex search problem, it is shown how Reinforcement Learning with knowledge distillation can effectively reduce the search space to infer a target model. The proposed approach has been tested with VGG architectures on CIFAR10 data set. It is observed that it is possible to reconstruct substitute models with test accuracy close to the target models and the proposed approach is scalable and independent of type of Neural Network architectures.

Motivation & Objective

• Motivate why neural networks deployed as a service are at risk of model extraction.
• Demonstrate that execution time correlates with network depth, enabling depth inference in a black-box setting.
• Propose a two-stage attack: infer depth via a regressor, then perform RL-based neural architecture search to reconstruct a close substitute model.
• Show that the substitute can achieve test accuracy within a small margin of the target on CIFAR-10 using VGG-like targets.

Proposed method

• Show that total execution time of neural networks is a function of depth and other hyperparameters across architectures.
• Collect timing data for many networks on fixed hardware to train a regressor mapping time to depth.
• Use a regressor (RF/BDT outperform linear models) to predict target depth from observed time.
• Constrain the architecture search to the inferred depth, and apply RL-based neural architecture search with distillation to maximize substitute accuracy.
• Train substitute models with knowledge distillation from the target to mimic its outputs.
• Demonstrate that the final substitute achieves test accuracy close to the target (within ~5%).

Experimental results

Research questions

• RQ1 Can a black-box attacker reliably infer the depth (number of layers) of a target neural network using timing side channels?
• RQ2 Can reinforcement-learning-based architecture search, restricted by inferred depth, produce substitute models with test accuracy close to the target?
• RQ3 What is the effectiveness of different regression models for depth inference from timing data?
• RQ4 Is the attack scalable across common CNN architectures (e.g., VGG-like, ResNet) and data (CIFAR-10)?

Key findings

• Timing side channels reveal architectural information: network depth correlates with total execution time.
• A regression model trained on timing data can infer target depth; ensemble regressors (Random Forest, Boosted DT) outperform linear models.
• An RL-based architecture search within the depth-constrained space can produce substitute models with test accuracy within 5% of the target on CIFAR-10.
• The attack uses a constant number of queries to infer depth, making it efficient in a black-box MLaaS setting.
• Knowledge distillation is used to train substitutes to mimic target predictions, improving likeness between models.
• Experiments on VGG-like targets show the reconstructed models closely approximate target performance.