[论文解读] Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel

Henrique Teles Maia, Chang Xiao+3 more|arXiv (Cornell University)|Sep 15, 2021

Advanced Memory and Neural Computing参考文献 39被引用 5

一句话总结

本论文表明，通过使用价值3美元的感应传感器分析GPU电源线的磁信号波动，被动攻击者可仅凭单次推理记录，从GPU的电源线中重建出黑盒神经网络的完整拓扑结构和超参数。该方法采用两阶段策略——首先利用BiLSTM分类器识别层类型，然后通过整数规划联合优化超参数，对VGG模型的迁移攻击成功率达到55.19–77.36%，对ResNet模型则达到84.47–98.56%。

ABSTRACT

Neural network applications have become popular in both enterprise and personal settings. Network solutions are tuned meticulously for each task, and designs that can robustly resolve queries end up in high demand. As the commercial value of accurate and performant machine learning models increases, so too does the demand to protect neural architectures as confidential investments. We explore the vulnerability of neural networks deployed as black boxes across accelerated hardware through electromagnetic side channels. We examine the magnetic flux emanating from a graphics processing unit's power cable, as acquired by a cheap $3 induction sensor, and find that this signal betrays the detailed topology and hyperparameters of a black-box neural network model. The attack acquires the magnetic signal for one query with unknown input values, but known input dimensions. The network reconstruction is possible due to the modular layer sequence in which deep neural networks are evaluated. We find that each layer component's evaluation produces an identifiable magnetic signal signature, from which layer topology, width, function type, and sequence order can be inferred using a suitably trained classifier and a joint consistency optimization based on integer programming. We study the extent to which network specifications can be recovered, and consider metrics for comparing network similarity. We demonstrate the potential accuracy of this side channel attack in recovering the details for a broad range of network architectures, including random designs. We consider applications that may exploit this novel side channel exposure, such as adversarial transfer attacks. In response, we discuss countermeasures to protect against our method and other similar snooping techniques.

研究动机与目标

• 探究GPU电源线的电磁侧信道是否能泄露黑盒神经网络的详细架构信息。
• 开发一种非侵入式、低成本的方法，仅通过一次推理记录提取神经网络的拓扑结构与超参数。
• 通过重建黑盒神经网络的精确代理模型，实现对抗性迁移攻击。
• 评估该侧信道攻击在多种GPU型号和复杂架构上的可行性与准确性。
• 提出针对此类物理侧信道泄露的防御对策。

提出的方法

• 使用价值3美元的低功耗感应传感器，从GPU电源线附近采集磁通量变化。
• 利用基于BiLSTM的分类器，从电磁信号轨迹中识别层类型（如卷积层、全连接层、归一化层等）。
• 通过专用的深度神经网络模型，估计各层的超参数（如卷积核大小、滤波器数量、输入/输出维度等）。
• 将联合超参数优化建模为整数规划问题，以确保层间架构的一致性。
• 利用深度神经网络模块化、顺序执行的特性，将信号特征映射为层序列。
• 通过测量在重建模型上的迁移攻击成功率，验证重建的准确性。

实验结果

研究问题

• RQ1 GPU电源线的磁侧信道信号能否揭示黑盒神经网络的拓扑结构与超参数？
• RQ2 仅通过一次推理记录，被动观察者能在多大程度上重建复杂且先进的深度学习模型？
• RQ3 与现有方法相比，该重建模型在支持对抗性迁移攻击方面的准确性如何？
• RQ4 该方法在处理非线性或图结构架构以及训练阶段操作时存在哪些局限性？
• RQ5 在生产系统中，可有效部署哪些对策以缓解此类侧信道泄露？

主要发现

• 该方法仅通过一次推理记录和一个3美元的磁传感器，成功重建了包括VGG和ResNet变体在内的完整神经网络架构。
• 对VGG模型的迁移攻击成功率达55.19–77.36%，对ResNet模型则达84.47–98.56%，显著优于以往基于电磁的攻击方法。
• 该方法在多种GPU型号上具有泛化能力，支持包括循环层、池化层和归一化层在内的多种层类型。
• 即使在包含数百层的深层网络中，重建精度依然稳健，优于以往仅限于数十层的模型。
• 该攻击无需访问输入输出数据、内存追踪或硬件篡改，具有高度实用性与隐蔽性。
• 该方法无法检测Dropout等仅在训练阶段激活的操作，因其在推理阶段处于非活动状态，凸显了其关键局限性。