Recent work has introduced attacks that extract the architecture information of deep neural networks (DNN), as this knowledge enhances an adversary’s capability to conduct attacks on black-box networks. This paper presents the first in-depth security analysis of DNN fingerprinting attacks that exploit cache side-channels.   First, we define the threat model for these attacks:  our adversary does not need the ability to query the victim model; instead, she runs a co-located process on the host machine victim ’s deep learning  (DL) system is running and passively monitors the accesses of the target functions in the shared framework.   Second, we introduce DeepRecon, an attack that reconstructs the architecture of the victim network by using the internal information extracted via Flush+Reload, a cache side-channel technique. Once the attacker observes function invocations that map directly to architecture attributes of the victim network, the attacker can reconstruct the victim’s entire network architecture.   In our evaluation, we demonstrate that an attacker can accurately reconstruct two complex networks (VGG19 and ResNet50) having only observed one forward propagation. Based on the extracted architecture attributes, we also demonstrate that an attacker can build a meta-model that accurately fingerprints the architecture and family of the pre-trained model in a transfer learning setting. From this meta-model,  we evaluate the importance of the observed attributes in the fingerprinting process. Third, we propose and evaluate new framework-level defense techniques that obfuscate our attacker’s observations. Our empirical security analysis represents a step toward understanding the DNNs’ vulnerability to cache side-channel attacks. Deep neural networks (DNNs) have become an essential tool in various applications, such as face recognition, speech recognition, malware detection, and autonomous driving or aviation BID18 BID1 BID2 BID3 BID21 . A DNN's performance depends widely on the network architecture-the number and types of layers, how the layers are connected, and the activation functions-and, unfortunately, there is no universal architecture that performs well on all tasks. Consequently, researchers and practitioners have devoted substantial efforts to design various DNN architectures to provide high performance for different learning tasks.Owing to their critical role, DNN architectures represent attractive targets for adversaries who aim to mount DNN fingerprinting attacks. In such an attack, the adversary probes a DNN model, considered confidential, until she infers enough attributes of the network to distinguish it among other candidate architectures. In addition to revealing valuable and secret information to the adversary, DNN fingerprinting can enable further attacks on black-box models. While the prior work on adversarial machine learning often assumes a white-box setting, where the adversary knows the DNN model under attack, these attacks are usually unrealistic in practice BID22 . In consequence, researchers have started focusing on a black-box setting, where model architecture is unknown to the adversary. However, in this setting, the adversary often makes some assumptions about the victim model in order to craft successful adversarial examples . Instead of approxi-mating, the adversary can start by conducting a DNN fingerprinting attack to infer the information required about the model, then use this information to craft adversarial examples that can evade the model. This can also enable model extraction attacks BID25 BID12 BID27 and membership inference or model inversion attacks BID19 BID15 .Because of the large number and types of architectural attributes, and the subtle effect that each attribute has on the model's inferences, DNN fingerprinting is challenging when using the typical methods employed in the adversarial machine learning literature. For example , BID27 propose a hyperparameter stealing attack that requires knowledge of the training dataset, the ML algorithm, and the learned model parameters, yet is unable to extract the model architecture. demonstrate a fingerprinting attack against transfer learning; however, they rely on the assumption that the teacher model and learning parameters are known to the attacker. To overcome these challenges, recent work has started to investigate attacks that utilize information leaked by architectural side-channels on the hardware where the DNN model runs. BID8 extract the network architecture of a model running on a hardware accelerator by monitoring off-chip memory addresses. BID30 reduce the search space from 10 35 to 16 candidates within a given network architecture by exploiting cache side-channels.In this paper, we ask the question: how vulnerable are DNNs to side-channel attacks, and what information do adversaries need for architecture fingerprinting? We perform, to the best of our knowledge, the first security analysis of DNNs operating in the presence of cache side-channel attacks. Specifically , we define the threat model for these attacks, including the adversary's capabilities and limitations. We then introduce DeepRecon, an efficient attack that reconstructs a black-box DNN architecture by exploiting the Flush+Reload BID32 technique, and we further evaluate the importance of specific architectural attributes in the success of fingerprinting. Finally, we propose and evaluate new framework-level defenses against these attacks.Our attack works by targeting lines of code corresponding to the execution of specific network architecture attributes of a deep learning (DL) framework. Specifically, these lines of code correspond to instructions to execute functions that are mapped into the instruction cache when the functions are invoked. Once these lines of code are identified, our attack flushes them from the instruction cache shared by the attacker and the victim. The attacker waits for the victim's process to run and then measures the time it takes to re-access those same lines of code. If the victim's DNN model has accessed any of these particular functions, the corresponding lines of code will be present in the instruction cache when the attacker tries to re-access them. Therefore, the access time to call these functions will be measurably faster than if the victim had not loaded them back into the shared instruction cache. On the other hand, if the victim DNN model did not access these particular functions, the corresponding lines will not be present in the cache when accessed by the attacker, and thus the access time will be measurably slower. We show that from this seemingly small amount of information that is leaked to the attacker, much of the victim's DNN architecture can be extracted with no query access required. To launch this attack, we only assume that: 1) an attacker and a victim are co-located in the same machine, and 2) they use the same shared DL framework.In evaluations, we demonstrate that, by learning whether or not specific functions were invoked during inference, we can extract 8 architecture attributes across 13 neural network architectures with high accuracy. Based on the extracted attributes , we demonstrate how an attacker can reconstruct the architectures of two common networks, VGG16 BID20 and ResNet50 BID6 as proof of concept. We also demonstrate a useful example of DeepRecon through model fingerprinting in a transfer learning attack. Finally, we propose countermeasures to obfuscate an attacker from extracting the correct attributes and sequences using observation attacks like DeepRecon and show that these defenses significantly increase the errors in the extracted attributes and can be implemented in various DL frameworks without hardware or operating system support. This paper conducts the first in-depth security analysis of DNN fingerprinting attacks that exploit cache side-channels. We first define the realistic threat model for these attacks: our attacker does not require the ability to query the victim model; she runs a co-located process on the machine where the victims DL system is running and passively monitors the accesses of target functions in a shared framework. We also present DeepRecon, an attack that reconstructs the architecture of a victim network using the architecture attributes extracted via the Flush+Reload technique. Based on the extracted attributes, we further demonstrate that an attacker can build a meta-model that precisely fingerprints the architecture and family of the pre-trained model in a transfer learning setting. With the meta-model, we identified the essential attributes for these attacks. DISPLAYFORM0 Recon.Steps Details VGG16 Recon.(1 ) Block 1 . Block 2. Block 3. Block 4. Block 5. DISPLAYFORM1 (Note that C,P ,F indicate the Convolutional, P ooling, F ully connected layers, and the subscripts mean the activation functions (R: ReLU, and So: Softmax). ) Table 7 : Reconstruction Process of VGG16 Architecture. We list the computation sequences captured by our attack above and the reconstruction process at the bottom.We describe the reconstruction process of VGG16 in Table 7 . The upper table indicates the sequences that our attacker captured, and the bottom shows the actual reconstruction steps. Our attacker identifies the basic building blocks by splitting the sequence with pooling layers. Then, the attacker counts the number of convolutional layers in each block. In VGG16, we found the first two ConvNet blocks have two convolutional layers, and the next three ConvNet blocks have three convolutional layers in each. Additionally, the attacker estimates the number of fully connected layers attached at the end. Once the attacker recovers all the blocks, our attacker can identify the victim architecture as being VGG16 with the ConvNet configuration 'C' or 'D'.B OBFUSCATED RE SNE T50 ARCHITECTURE In Sec. 5.2, we construct the obfuscated ResNet50 architecture by using the unraveled view of the first three blocks in ResNet50 as shown in FIG3 . The upper architecture depicts the block connections in the original ResNet50. In this network, the blocks are computed sequentially, e.g., Residual Block → Identity Block → Identity Block. However , in our unraveled architecture at the bottom, there are individual 8 paths that can be computed independently. We use this architecture to compute the blocks as follows: Residual Block 1, 2 → Identity Block 1 → Residual Block 3, 4 → Identity Block 2 → Identity Block 3. This makes our attacker have difficulty in estimating the architecture attributes and computation sequences of ResNet50.
We conduct the first in-depth security analysis of DNN fingerprinting attacks that exploit cache side-channels, which represents a step toward understanding the DNN’s vulnerability to side-channel attacks. This paper considers the problem of fingerprinting neural network architectures using cache side channels, and discusses security-through-obscurity defenses. This paper performs cache side-channel attacks to extract attributes of a victim model and infer its architecture, as well as show they can achieve a nearly perfect classification accuracy.