Hermes Attack: Steal DNN Models with Lossless Inference Accuracy

1 Introduction

• Prior search-based attacks could not recover customized models, prediction-based attacks reduced inference accuracy, and none reconstructed the whole model.Model extraction matters as privatized deployments expose valuable DNNs to leakage risk.Source: §1 · p. 1
• The attack exploits unencrypted host–GPU PCIe traffic to recover the victim model’s architecture, hyper-parameters, and parameters.The authors identify PCIe as an attack surface even when host and GPU systems are individually protected.Source: §1 · p. 2
• Only 1% to 2% of captured PCIe packets are useful, while closed-source CUDA and GPU internals and lost layer semantics complicate reconstruction.Millions of packets may include noise and chaotic ordering.Source: §1 · p. 2
• Hermes uses offline reverse engineering and kernel-to-layer mapping, then filters noise and corrects packet order during online reconstruction.The offline phase builds a knowledge database; the online phase collects PCIe packets while the victim model runs.Source: §1 · p. 2
• Within 5–17 minutes from one image, Hermes reconstructed the tested models’ hyper-parameters, parameters, and semantically identical architectures, with accuracy matching the originals.Experiments covered MNIST, VGG, and ResNet on three NVIDIA GPU platforms; accuracy tests used 10,000 images.Source: §1 · p. 2
• The paper identifies PCIe as an attack surface in privatized deployments and reports reverse-engineering details intended to benefit the research community.DNNs are valuable because their accuracy depends on costly-to-train architectures and parameters.Source: §1 · pp. 1–2

2.1 DNN Background

• DNN architecture comprises layer types, dimensions, and connection topology, while model parameters are trained weights and biases.The paper distinguishes sequential connections from non-sequential connections such as shortcuts, branches, or shared layers.Source: §2.1 · pp. 2–3

2.2 GPU Working Mechanism

• Framework APIs pass through CUDA runtime components and the driver, which submits GPU commands to hardware over PCIe.CUDA programs typically copy input to GPU memory, launch computation, and transfer results back to main memory.Source: Figure 1 · p. 3, §2.2 · p. 3

2.3 PCIe Protocol

• PCIe read operations pair a request TLP with a completion TLP, matched by their shared Tag; the completion carries the read data.The request address identifies the targeted read location.Source: Figure 2 · p. 3, Figure 3 · p. 3, §2.3 · p. 4

3.1 Overview

• The threat model assumes physical access to the PCIe interface while the host and GPU are individually protected and the victim model is a black box.The attacker can place a PCIe bus snooping device between host and GPU.Source: §3.1 · p. 4
• Reconstruction must overcome closed-source GPU internals, lost layer semantics, and millions of noisy, out-of-order packets.Only 1% to 2% of packets may be useful, and asynchronous operations can reorder completions.Source: §3.1 · p. 4
• Offline profiling builds command-header and kernel-mapping knowledge; online processing sorts and extracts victim traffic for reconstruction.The online phase uses the victim model for inference on a single image, then reconstructs architecture, hyper-parameters, and parameters.Source: §3.1 · pp. 4–5

3.2 Traffic Processing

• The processing pipeline combines request addresses with corresponding completion data into data packets by matching tags.Adjacent packets with the same tag are merged by concatenating their data fields.Source: §3.2 · p. 6
• PCIe does not enforce completion order across consecutive requests, and a single read result may span multiple completion packets.The method merges completion data associated with the same tag, then sorts data packets using request packet IDs as keys.Source: §3.2 · p. 6

3.3 Extraction

• Only a small fraction of inference traffic is useful, so extraction focuses on D commands for data movement and K commands for kernel launches.One MNIST inference generated 1,077,756 data packets after filtering on a GT 730, of which around 20,000 (2%) were useful.Source: §3.3 · p. 6

3.3.1 Header Extraction

• Repeated transfers of crafted data and launches of prepared kernels reveal D-command and K-command header structures during offline profiling.The identified K-command header has nine DWs; its third, fifth, and ninth DWs encode GPU address, data size in bytes, and command type.Source: §3.3.1 · p. 6, Figure 7 · p. 6

3.3.2 Command Extraction

• Command extraction must filter external packets and internal DW-level noise, including packets interleaved within a split command header.Internal noise follows observed patterns that can be filtered during payload extraction.Source: §3.3.2 · pp. 6–7, Figure 8 · p. 7
• Address gaps alone cannot identify noise because virtually contiguous CUDA memory may occupy separate physical chunks.The method scans ahead within MAX_SCAN_DISTANCE for a consecutive address; otherwise it includes the gap packet, continuing until extracted bytes match the header size.Source: §3.3.2 · p. 7

3.4.1 Semantic Reconstruction

• Kernel binaries are located by tracing each K command’s referenced GPU address back to the D command that loaded the binary, then aligned with CUDA traces to map binaries to layer types.Profiling known models with nvprof also identifies kernel argument layouts and hyper-parameter offsets.Source: §3.4.1 · pp. 7–8, Figure 10 · p. 8

3.4.2 Model Reconstruction

• Architecture reconstruction builds a data-flow graph from kernel inputs and outputs, then replaces kernel vertices with their mapped DNN layer types.Address relationships may require tracing D commands because a kernel’s output and its successor’s input need not use the same address.Source: §3.4.2 · p. 8
• The attack recovers inference hyper-parameters by reading profiled offsets in K-command data fields or inferring settings from the presence of relevant kernels.Training-only settings such as learning rate and batch size are not captured by this inference-time attack.Source: §3.4.2 · p. 8
• Parameters are recovered by tracing from a K command’s destination address through a KD2D copy to the source address and its originating D command.Parameters may be duplicated before computation, so the copy used by a kernel—not necessarily the original GPU address—must be traced.Source: §3.4.2 · p. 9
• For asynchronous Dasyn transfers, the attack filters regular commands and noise, then assembles the remaining packets by contiguous address to recover each command’s data.Dasyn headers omit data size, and header and data packets may be separated and interleaved with packets from other commands.Source: §3.4.2 · p. 9
• Because GPU addresses can be reused and overwritten, the attack tracks each data item’s valid lifetime and traces backward from each kernel launch to recover the corresponding parameters.Parameter-block sizes can be calculated from recovered layer hyper-parameters for convolution and dense layers; normalization parameters are read directly from kernel arguments.Source: §3.4.2 · p. 9

4.1 Experiment Setup

• Experiments use three NVIDIA GPUs and the sequential MNIST and VGG16 models plus the non-sequential ResNet20 model, treated as black boxes during attack.The models run with Keras and TensorFlow; their public availability is used only for ground truth.Source: §4.1 · pp. 9–10

4.2 Model Architecture Evaluation

• The reconstructed architectures differ mainly by omitting training-only dropout layers and representing activation functions as single layers.The paper reports that these differences do not affect inference results.Source: Figure 12 · p. 10, §4.2 · p. 11

4.3 Hyper-Parameters Evaluation

• Extracted hyper-parameters match those in the original models, while offsets vary across platforms and some layer implementations.The listed offsets cover the most frequently used implementations.Source: §4.3 · pp. 11–12, Table 3 · p. 11

4.4 Identity Evaluation

• All reconstructed models match their originals’ accuracy across the evaluated platforms and have similar inference time.Accuracy is measured over 10,000 test images; Table 4 reports identity evaluation.Source: §4.4 · p. 12, Table 4 · p. 12

4.5 Reconstruction Efficiency

• One inference image is enough to reconstruct a whole model, and generation time depends mainly on completion-packet count, which varies by platform and victim model.Table 5 records command and packet counts together with model-generation time.Source: §4.5 · p. 12

5 Discussions

• The attack’s stated goal is to leak models through PCIe traffic while preserving the victim’s inference accuracy, regardless of model accuracy or activation and layer counts.The claim is scoped to the attack’s stated accuracy objective.Source: §5 · p. 12

5.1 Super Large DNN Models

• An 8GB snooper buffer may fail to capture all traffic for a very large model such as ImageNet-trained VGG16, though larger-buffer hardware or repeated partial captures are proposed alternatives.The repeated-capture approach requires accurate interception and recovery of layers despite skipped-layer data being absent.Source: §5.1 · p. 12

5.2 Attack Generalization

• Platform changes may require updating command-header and kernel-binary mappings, while framework changes require remapping layer-to-kernel relationships if layers execute on the GPU.Concurrent-task traffic can be filtered using GPU-context information.Source: §5.2 · pp. 12–13

5.3 Mitigation Countermeasures

• Proposed mitigations include PCIe encryption, data obfuscation, dynamic command headers, and CPU offloading, each with compatibility, completeness, or performance trade-offs.Obfuscation raises the bar but does not completely prevent the attack; CPU offloading can cause significant performance loss.Source: §5.3 · p. 13

Adversarial Examples

• Adversarial-example research includes white-box attacks with prior knowledge of model internals and black-box attacks.The passage identifies perturbation-based misclassification as the adversarial-example aim.Source: §6 · pp. 13–14

Extraction Attack

• Prior side-channel attacks infer architecture or parameters from memory, PCIe hints, cache behavior, power traces, timing, or accelerator inputs and outputs.The passage distinguishes partial architecture recovery and parameter estimation from other extraction goals.Source: §6 · p. 14
• Other cited approaches use prediction-query pairs or prediction APIs to build clone models, while some infer hyper-parameters or classification results under specific assumptions.One described approach assumes known architecture and accessible softmax output before replicating parameters from noise input.Source: §6 · p. 14

• The prototype handled customized DNN models, and the stolen models had the same inference accuracy as the originals.Source: §7 · p. 14
• Hermes Attack is presented as the first model-extraction attack to fully steal whole DNN models.The attack uses the PCIe bus as a new attack surface.Source: §7 · p. 14
• The evaluation covered three real-world NVIDIA GPU platforms and addressed reconstruction challenges through reverse engineering, semantic reconstruction, packet selection, and order correction.Source: §7 · p. 14