PaperlayerView exact revision on arXiv

Source-linked AI summary

Stealing Neural Networks via Timing Side Channels

Vasisht Duddu, Debasis Samanta, D Vijay Rao, Valentina E. Balas

arXiv:1812.11720v4cs.CRcs.LG

TL;DR

The paper asks whether a weak black-box adversary can infer neural-network attributes efficiently despite the large search space of model extraction. It uses timing side channels to infer depth, then reinforcement-learning architecture search with knowledge distillation to reconstruct a substitute, achieving accuracy within 5% of the target on VGG-like networks.

  • Problem

    Black-box model extraction is difficult because the architecture search space is large, while the target reveals only output predictions and the adversary seeks similar functionality with few queries.

  • Method

    The attack infers network depth from execution time, constrains the architecture search accordingly, and uses reinforcement learning with knowledge distillation to train a substitute.

  • Results

    The reconstructed model achieved test accuracy within 5% of the target model on VGG-like convolutional networks, while ensemble regressors estimated depth better than linear alternatives.

  • Takeaways & Limitations

    Timing behavior exposes neural-network depth and can support efficient black-box reconstruction of a functionally close substitute.

Abstract

from arXiv · show

Deep learning is gaining importance in many applications. However, Neural Networks face several security and privacy threats. This is particularly significant in the scenario where Cloud infrastructures deploy a service with Neural Network model at the back end. Here, an adversary can extract the Neural Network parameters, infer the regularization hyperparameter, identify if a data point was part of the training data, and generate effective transferable adversarial examples to evade classifiers. This paper shows how a Neural Network model is susceptible to timing side channel attack. In this paper, a black box Neural Network extraction attack is proposed by exploiting the timing side channels to infer the depth of the network. Although, constructing an equivalent architecture is a complex search problem, it is shown how Reinforcement Learning with knowledge distillation can effectively reduce the search space to infer a target model. The proposed approach has been tested with VGG architectures on CIFAR10 data set. It is observed that it is possible to reconstruct substitute models with test accuracy close to the target models and the proposed approach is scalable and independent of type of Neural Network architectures.

I. INTRODUCTION

The paper frames black-box neural-network extraction as a costly search problem and proposes timing side channels plus reinforcement-learning architecture search to reconstruct a close substitute with few queries.

  • Key Challenges in Model Extraction Attacks: The extraction problem is difficult because neural networks have many hyperparameters, making brute-force search computationally expensive and poorly suited to complex topologies.Prior approaches may require 40 GPU days for a simple seven-layer architecture and many queries.
  • Proposed Approach: Timing measurements are regressed to predict depth, after which reinforcement learning searches the constrained architecture space for a high-accuracy substitute.The figure describes the pipeline from querying and timing through depth prediction and architecture search.
  • Evaluation: On VGG-like convolutional networks, the reconstructed model achieved test accuracy within 5% of the target model.The evaluation compares reconstructed-model accuracy with target-model accuracy after assessing regressors using R2 and mean squared error.
  • Evaluation: Ensemble regressors, including random forests and boosted decision trees, outperformed linear regressors for estimating network depth.The comparison uses R2 score and mean squared error as evaluation criteria.
  • Main Contributions: The paper identifies timing-side-channel vulnerability, constant-query depth inference, and reinforcement-learning reconstruction as its main contributions.These contributions connect timing measurements to a reduced search space and a functionally similar substitute architecture.
  • Proposed Approach: A weak black-box adversary can exploit execution timing to infer target-network depth and reduce the architecture-search space.The approach is designed to use a constant number of queries independently of architecture size.

II. BACKGROUND

Deep learning models learn mappings from inputs to outputs using parameterized neural-network functions and associated loss functions.

  • II. BACKGROUND: Machine-learning algorithms learn a mapping from input features X to output labels Y through a function f.The loss function measures prediction error for input-label pairs.

B. Security and Privacy in Machine Learning

The section introduces machine-learning security threats and formulates model extraction as finding a black-box substitute with similar test accuracy using minimal queries, aided by timing information and constrained search.

  • Security and Privacy in Machine Learning: Adversarial examples can fool neural-network classifiers through poisoned training data or inference-time evasion.The section places model extraction within broader machine-learning security and privacy concerns.
  • Model Extraction: Model extraction seeks a substitute network whose functionality approximates a black-box target while minimizing the number of queries.Functionality is measured through the difference in test accuracy between target and substitute models.
  • Exploiting Timing Side Channels: Timing side channels can reveal network depth because sequential layer computation determines total execution time.The attack builds timing-depth data and estimates target depth from observed execution time.
  • Model Search: The estimated depth restricts architecture search from the full model space S to the smaller depth-specific space S_k.Reinforcement learning then searches remaining choices such as kernel size, stride, and filter count using accuracy-based rewards.

IV. THREAT MODEL

The threat model assumes a weak black-box adversary who queries a deployed neural network and uses execution-time dependencies to infer architectural details. The attack relies on timing relationships across layer parameters and network depth, with hardware effects treated as consistent across models.

  • Threat assumptions: The adversary can query only the trained model’s output predictions and lacks access to its internals.The attack operates in a black-box setting against an inference service.
  • Threat assumptions: The attack requires the same processor as the target model because timing data are hardware-specific.The evaluation uses CPUs, and the target hardware is assumed obtainable for one-time setup measurements.
  • Timing channels: Convolution execution time is proportional to output dimensions, channel counts, and filter dimensions through the total multiplication count.The cited multiplication expression includes ow, oh, co, fw, fh, and ci.
  • Timing channels: Maxpool execution time rises with kernel and filter size but falls as stride increases because fewer multiplications are performed.The inverse stride relationship is attributed to a smaller output size.
  • Timing channels: Fully connected execution time varies linearly with the number of multiplications between input and output nodes.For m input and n output nodes, the relevant multiplication count is m × n.
  • Timing channels: Execution time increases linearly with network depth for both simple and skip-connected topologies.Sequential layer computation makes total execution time the sum of individual layer times.

VI. ATTACK METHODOLOGY

The attack has setup, attack, and reconstruction phases that use timing measurements to infer target depth and then search for a functionally similar substitute. Reconstruction is constrained by the inferred depth and optimized for accuracy close to the target.

  • VI. ATTACK METHODOLOGY: The three-phase pipeline measures model timings, infers target depth, and searches for a substitute within the reduced depth-constrained space.Setup is performed once before the attack.
  • Setup Phase: Setup aggregates timing data from models with varied hyperparameters and reconstructs training data using membership inference or dataset reconstruction.Both setup activities are one-time operations.
  • Attack Phase: During the attack, averaged target execution time is input to a regressor that estimates neural-network depth.The regressor is trained on the attacker’s timing dataset.
  • Reconstruction Phase: During reconstruction, the adversary searches for a neural network with test accuracy close to the target while holding depth fixed at the inferred value.The fixed depth reduces the original architecture search space.

A. Setup Phase

The setup phase reconstructs usable training data from target predictions and builds a hardware-specific timing dataset linking inference time with architecture depth. These resources support later distillation and depth regression.

  • Setup Phase: The adversary labels sampled inputs with target predictions rather than true labels so the substitute can mimic target functionality.The aggregated data contain soft target predictions instead of hard labels.
  • Setup Phase: The attacker dataset records inference time, architecture depth, and model parameters for varied neural-network architectures.The dataset is represented as DA = {(T1, K1), · · ·, (TN, KN)}.
  • Setup Phase: The timing dataset is specific to one hardware configuration and can be reused to attack models running on that same hardware.Hardware matching is therefore part of the setup requirement.

B. Attack Phase

The attack phase averages target execution times and regresses depth, after which reinforcement learning searches the reduced architecture space. Knowledge distillation trains each candidate to mimic target predictions, and reward updates guide the controller toward higher accuracy.

  • B. Attack Phase: The regressor estimates target depth k from average execution time t using R(k) = E{K|T = t}.The attacker regressor is trained on 100 neural networks with different depths and parameters.
  • C. Reconstruction Phase: The inferred depth constrains the substitute search from the full space S to the subset S_k of models with depth k.Kernel size, stride, and filter count remain search parameters within S_k.
  • C. Reconstruction Phase: An RNN controller proposes architectures by selecting hyperparameter values from the constrained search space.Controller parameters are optimized with a policy-gradient method based on architecture performance.
  • C. Reconstruction Phase: REINFORCE updates the controller policy through stochastic gradient ascent because the reward is non-differentiable.The objective is to increase expected accuracy of sampled architectures while reducing the target–substitute accuracy difference.
  • C. Reconstruction Phase: Knowledge distillation trains each substitute using target predictions, and the prediction loss supplies the reward for improving later proposals.The substitute learns to mimic target behavior instead of training directly from true labels.

VII. EVALUATION

The evaluation uses CIFAR10 and reports inference timing measured on a 40-core Intel Xeon server, averaging results over 20 runs.

  • CIFAR10 provides 60,000 mutually exclusive 32x32 color images across 10 classes, split into 50,000 training and 10,000 testing images.
  • Inference timing is evaluated on an Intel Xeon Gold 5115 processor with 2.4GHz clock speed, 196GB memory, and 40 cores.
  • Reported measurements average 20 inference runs and use Python's time() function to measure inference intervals with a 10^-7-second clock resolution.

A. Regression

The regression stage uses execution time to estimate network depth, with ensemble regressors outperforming linear models and correctly estimating the evaluated networks' depths.

  • Regression: The regression evaluation compares models using R2 to measure explained variance and MSE to measure depth-estimation error.
  • Regression: Random Forest averages predictions from independently fitted decision trees, while boosting combines sequential trees to improve errors.
  • Regression: Ensemble regressors achieve higher R2 and lower MSE than linear models for estimating neural-network depth from timing data.
  • Regression: The regression predictions are rounded upward to the nearest integer when estimating network depth.
  • Regression: For all three evaluated neural networks, the regressors estimate the correct depth from total execution time.

B. Reconstruction using Reinforcement Learning

After inferring depth, the attack constrains architecture search with reinforcement learning and obtains substitute models whose test accuracy is within 5% of the targets.

  • B. Reconstruction using Reinforcement Learning: Inferred network depth reduces the substitute-model search space before searching for an architecture with accuracy close to the target.
  • B. Reconstruction using Reinforcement Learning: The reinforcement-learning architecture search produces substitute models within 5% test accuracy of the target architectures across all three models.
  • B. Reconstruction using Reinforcement Learning: The search explores 50 models while restricting kernel sizes to 3 or 5 and filter counts to 32, 64, or 128.
  • B. Reconstruction using Reinforcement Learning: Replacing max-pooling with higher-stride convolutional layers yields a fully convolutional substitute architecture during the search.
  • B. Reconstruction using Reinforcement Learning: Adding latency through dummy computations or layers can obscure depth-dependent timing, but creates a security–utility tradeoff for real-time applications.

IX. DISCUSSION

The attack’s timing distribution depends on the dataset and must be adapted for remote network noise. Existing defenses target prediction-score or memory-access leakage, leaving timing side channels unaddressed.

  • Variation Across Datasets: The same architecture produces different timing distributions across datasets, so the regressor is dataset-specific and requires retraining for each distribution.MNIST and CIFAR10 differ in image dimensions and channels, changing intermediate feature-map computations.
  • Extending to Remote Setting: Remote attacks must estimate and filter network propagation time and jitter from total round-trip time to recover neural-network processing time.The round-trip model represents response time as a function of scaled processing time, network time, and jitter.
  • Model Extraction Defences: Existing defenses suppressing logits, monitoring queries, using alerts, trusted hardware, or Oblivious RAM do not mitigate timing side-channel attacks.These defenses address output-prediction leakage or memory-access patterns rather than execution-time leakage.

X. RELATED WORK

Prior extraction methods infer model attributes from input-output behavior but can require substantial computation and queries. The proposed approach instead uses timing leakage against a weak black-box adversary and combines it with reinforcement learning for efficient architecture reconstruction.

  • Input-Output-Based Extraction: Input-output pairs can train substitute models or infer model attributes, but large attack-model collections impose high computational costs.A simple digit-classification task required 10k attack models trained over 40 GPU days.
  • Side-Channel Extraction: Earlier side-channel attacks often assume physical hardware access or shared process resources, unlike this approach’s weak remote black-box adversary.The proposed setting requires only access to the target model through remote black-box queries.
  • Proposed Approach: The paper combines timing-based depth inference with reinforcement learning to address the architecture search problem and reconstruct a substitute within 5% of the target test accuracy.The reported evaluation uses VGG-like architectures, and the conclusion also describes compatibility with cache attacks and memory-access monitoring.
Loading 1812.11720v4…