The increasing complexity of machine learning models drives the emergence of Machine-Learning-as-a-Service (MLaaS) solutions provided by cloud service providers. With MLaaS, customers can leverage existing data center infrastructures for model training and inference. To improve training efficiency, modern machine learning platforms introduce communication optimization mechanisms, which can lead to information leakage. In this work, we present a network side channel based attack to steal model sensitive information. Specifically, we leverage the unique communication patterns during training to learn the model architectures. To further improve accuracy, we also collect information from software based power side channels and correlate it with the information extracted from network. Such temporal and spatial correlation helps reduce the search space of the target model architecture significantly. Through evaluations, we show that we can achieve more than 90% accuracy for model hyper-parameters reconstruction. We also demonstrate that our proposed attack is robust against background noise by evaluating with memory and traffic intensive co-located applications.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DNN Architecture Attacks via Network and Power Side Channels

  • Yuanjun Dai,
  • Qingzhe Guo,
  • An Wang

摘要

The increasing complexity of machine learning models drives the emergence of Machine-Learning-as-a-Service (MLaaS) solutions provided by cloud service providers. With MLaaS, customers can leverage existing data center infrastructures for model training and inference. To improve training efficiency, modern machine learning platforms introduce communication optimization mechanisms, which can lead to information leakage. In this work, we present a network side channel based attack to steal model sensitive information. Specifically, we leverage the unique communication patterns during training to learn the model architectures. To further improve accuracy, we also collect information from software based power side channels and correlate it with the information extracted from network. Such temporal and spatial correlation helps reduce the search space of the target model architecture significantly. Through evaluations, we show that we can achieve more than 90% accuracy for model hyper-parameters reconstruction. We also demonstrate that our proposed attack is robust against background noise by evaluating with memory and traffic intensive co-located applications.