[论文解读] DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips

Fan Yao, Adnan Siraj Rakin+1 more|arXiv (Cornell University)|Mar 30, 2020

Adversarial Robustness in Machine Learning被引用 59

一句话总结

本论文展示了一种基于硬件的攻击，利用定向比特翻转（rowhammer）以确定性地降低量化DNN的推理准确性到随机猜测水平，通过快速、内存高效的技术翻转易受攻击的权重位。

ABSTRACT

Security of machine learning is increasingly becoming a major concern due to the ubiquitous deployment of deep learning in many security-sensitive domains. Many prior studies have shown external attacks such as adversarial examples that tamper with the integrity of DNNs using maliciously crafted inputs. However, the security implication of internal threats (i.e., hardware vulnerability) to DNN models has not yet been well understood. In this paper, we demonstrate the first hardware-based attack on quantized deep neural networks-DeepHammer-that deterministically induces bit flips in model weights to compromise DNN inference by exploiting the rowhammer vulnerability. DeepHammer performs aggressive bit search in the DNN model to identify the most vulnerable weight bits that are flippable under system constraints. To trigger deterministic bit flips across multiple pages within reasonable amount of time, we develop novel system-level techniques that enable fast deployment of victim pages, memory-efficient rowhammering and precise flipping of targeted bits. DeepHammer can deliberately degrade the inference accuracy of the victim DNN system to a level that is only as good as random guess, thus completely depleting the intelligence of targeted DNN systems. We systematically demonstrate our attacks on real systems against 12 DNN architectures with 4 different datasets and different application domains. Our evaluation shows that DeepHammer is able to successfully tamper DNN inference behavior at run-time within a few minutes. We further discuss several mitigation techniques from both algorithm and system levels to protect DNNs against such attacks. Our work highlights the need to incorporate security mechanisms in future deep learning system to enhance the robustness of DNN against hardware-based deterministic fault injections.

研究动机与目标

• 在量化的深度神经网络中展示对内部威胁的硬件漏洞。
• 证明定向的比特翻转可以确定性地降低 DNN 的推理准确性。
• 开发用于快速部署受害页面、内存高效的 rowhammering 与精确比特翻转的系统级技术。
• 在多种体系结构和数据集上评估该攻击，以评估其实用性和影响。
• 讨论在算法和系统层面的缓解措施，以提高对这类故障的鲁棒性。

提出的方法

• 进行积极的比特搜索，以在系统约束下识别量化DNN中可翻转且易受攻击的权重位。
• 利用 rowhammer 漏洞在多个内存页上触发确定性比特翻转。
• 开发用于快速部署受害页面和内存高效 rowhammering 的系统级技术。
• 实现对定向权重位的精确翻转，以降低推理准确性。
• 系统性地攻击 12 种 DNN 架构、4 个数据集及多个领域以评估有效性。
• 讨论在算法层面和体系结构层面的缓解策略。

实验结果

研究问题

• RQ1 定向的 DNN 权重比特翻转是否可用于确定性地降低推理准确性？
• RQ2 哪些系统级技术能够实现跨受害模型页面的快速、可靠的基于 rowhammer 的比特翻转？
• RQ3 DeepHammer 能影响多少种架构和数据集，以及在多短的时间内完成？
• RQ4 哪些缓解措施可以降低 DNN 对基于硬件的故障注入的易感性？

主要发现

• DeepHammer 可以在运行时在几分钟内篡改 DNN 推理行为。
• 该攻击可以将目标 DNN 的推理准确性降至与随机猜测相当的水平。
• 评估覆盖 12 种 DNN 架构、4 个数据集，以及多个应用领域。
• 新颖的系统级技术实现了快速受害页面部署、内存高效的 rowhammering，以及对定向比特翻转的精确控制。
• 工作强调了需要安全机制来保护 DNN 免受基于硬件的确定性故障注入。