2018

Stealing Neural Networks via Timing Side Channels

Duddu, Vasisht, Samanta, Debasis, Rao, D Vijay et al.

Understand

Deep learning is gaining importance in many applications.

However, Neural Networks face several security and privacy threats.
This is particularly significant in the scenario where Cloud infrastructures deploy a service with Neural Network model at the back end.
Here, an adversary can extract the Neural Network parameters, infer the regularization hyperparameter, identify if a data point was part of the training data, and generate effective transferable adversarial examples to evade classifiers.

Built on

X. Hu, L. Liang, L. Deng, S. Li, X. Xie, Y. Ji, Y. Ding, C. Liu, T. Sherwood, and Y. Xie, “Neural network model extraction attacks in edge devices by hearing architectural hints,”
Original
1903
Earlier work this paper cites.
A. Salem, A. Bhattacharyya, M. Backes, M. Fritz, and Y. Zhang, “Updates-leak: Data set inference and reconstruction attacks in online learning,”
Original
1904
Earlier work this paper cites.
R. J. Williams, “Simple statistical gradient-following algorithms for connectionist reinforcement learning,”
1992
Earlier work this paper cites.
P. C. Kocher, “Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems,” in
1996
Earlier work this paper cites.
P. C. Kocher, J. Jaffe, and B. Jun, “Differential power analysis,” in
1999
Earlier work this paper cites.
C. M. Bishop,
2006
Earlier work this paper cites.
S. A. Crosby, D. S. Wallach, and R. H. Riedi, “Opportunities and limits of remote timing attacks,”
2009
Earlier work this paper cites.
S. Gambs, A. Gmati, and M. Hurfin, “Reconstruction attack through classifier analysis,” in
2012
Earlier work this paper cites.
A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” in
2012
Earlier work this paper cites.
E. Stefanov, M. van Dijk, E. Shi, C. Fletcher, L. Ren, X. Yu, and S. Devadas, “Path oram: An extremely simple oblivious ram protocol,” in
2013
Earlier work this paper cites.
J. Ba and R. Caruana, “Do deep nets really need to be deep?” in
2014
Earlier work this paper cites.
K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,”
Original
2014
Earlier work this paper cites.
M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in
2015
Earlier work this paper cites.
G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” in
Original
2015
Earlier work this paper cites.
J. Springenberg, A. Dosovitskiy, T. Brox, and M. Riedmiller, “Striving for simplicity: The all convolutional net,” in
2015
Earlier work this paper cites.

Similar

F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction apis,” in
2016
Cited alongside, same era.
W. Xu, Y. Qi, and D. Evans, “Automatically evading classifiers: A case study on pdf malware classifiers,” in
2016
Cited alongside, same era.
B. Zoph and Q. V. Le, “Neural architecture search with reinforcement learning,”
Original
2016
Cited alongside, same era.
B. Hitaj, G. Ateniese, and F. Pérez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” in
2017
Cited alongside, same era.
G. Huang, Z. Liu, L. v. d. Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in
2017
Cited alongside, same era.
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in
2017
Cited alongside, same era.
R. Shokri, M. Stronati, C. Song, and V. Shmatikov, “Membership inference attacks against machine learning models,” in
2017
Cited alongside, same era.
V. Sze, Y. Chen, T. Yang, and J. S. Emer, “Efficient processing of deep neural networks: A tutorial and survey,”
2017
Cited alongside, same era.
“Amazon ec2 instance types,”
2018
Cited alongside, same era.
“Amazon sagemaker instance types,”
2018
Cited alongside, same era.
M. Alam and D. Mukhopadhyay, “How secure are deep learning algorithms from side-channel based reverse engineering?” in
2018
Cited alongside, same era.
V. Duddu, “A survey of adversarial machine learning in cyber warfare,”
2018
Cited alongside, same era.

Then

S. Hong, M. Davinroy, Y. Kaya, S. N. Locke, I. Rackow, K. Kulda, D. Dachman-Soled, and T. Dumitraş, “Security analysis of deep neural networks operating in the presence of cache side-channel attacks,”
Original
2018
Closest in time.
W. Hua, Z. Zhang, and G. E. Suh, “Reverse engineering convolutional neural networks through side-channel information leaks,” in
2018
Closest in time.
M. Juuti, S. Szyller, A. Dmitrenko, S. Marchal, and N. Asokan, “PRADA: protecting against DNN model stealing attacks,”
Original
2018
Closest in time.
M. Kesarwani, B. Mukhoty, V. Arya, and S. Mehta, “Model extraction warning in mlaas paradigm,” in
2018
Closest in time.
H. Naghibijouybari, A. Neupane, Z. Qian, and N. Abu-Ghazaleh, “Rendered insecure: Gpu side channel attacks are practical,” in
2018
Closest in time.
S. J. Oh, M. Augustin, M. Fritz, and B. Schiele, “Towards reverse-engineering black-box neural networks,” 2018
2018
Closest in time.
J. Silva, R. Berriel, C. Badue, A. De Souza, and T. Oliveira-Santos, “Copycat cnn: Stealing knowledge by persuading confession with random non-labeled data,” 05 2018
2018
Closest in time.
B. Wang and N. Z. Gong, “Stealing hyperparameters in machine learning,” in
2018
Closest in time.
L. Wei, B. Luo, Y. Li, Y. Liu, and Q. Xu, “I know what you see: Power side-channel attack on convolutional neural network accelerators,” in
2018
Closest in time.
M. Yan, C. Fletcher, and J. Torrellas, “Cache telepathy: Leveraging shared resource attacks to learn dnn architectures,”
Original
2018
Closest in time.
“CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel,” in
2019
Closest in time.
S. Milli, L. Schmidt, A. D. Dragan, and M. Hardt, “Model reconstruction from model explanations,” in
2019
Closest in time.
T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in
2019
Closest in time.
A. Salem, Y. Zhang, M. Humbert, P. Berrang, M. Fritz, and M. Backes, “Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models,” in
2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…