Trained deep neural networks (DNNs) are valuable intellectual property because they require huge costs for data, computation, and expertise to develop. Because the trained DNN models can be exploited for attacks to induce malfunctions and privacy violations, protecting them is crucial from a security perspective. Especially for edge devices, considering physical attacks on hardware, such as side-channel attacks (SCAs) is necessary. For instance, DNN model parameters can be encrypted and stored in the memory of the device, but they are vulnerable to SCAs because they are decrypted during computation. This paper proposes an arithmetic masking countermeasure to mitigate model extraction attacks using correlation power analysis on the wavefront array, one of the matrix multiplication accelerators. This countermeasure adds rows and columns with random numbers on the input and weight matrix; these random numbers make a register transition unpredictable. It can be implemented without any circuit modification and with only two additional clock cycles. We evaluated it using simulation and power traces acquired from FPGA implementation.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Arithmetic Masking Countermeasure to Mitigate Side-Channel-Based Model Extraction Attack on DNN Accelerator

  • Hirokatsu Yamasaki,
  • Kota Yoshida,
  • Yuta Fukuda,
  • Takeshi Fujino

摘要

Trained deep neural networks (DNNs) are valuable intellectual property because they require huge costs for data, computation, and expertise to develop. Because the trained DNN models can be exploited for attacks to induce malfunctions and privacy violations, protecting them is crucial from a security perspective. Especially for edge devices, considering physical attacks on hardware, such as side-channel attacks (SCAs) is necessary. For instance, DNN model parameters can be encrypted and stored in the memory of the device, but they are vulnerable to SCAs because they are decrypted during computation. This paper proposes an arithmetic masking countermeasure to mitigate model extraction attacks using correlation power analysis on the wavefront array, one of the matrix multiplication accelerators. This countermeasure adds rows and columns with random numbers on the input and weight matrix; these random numbers make a register transition unpredictable. It can be implemented without any circuit modification and with only two additional clock cycles. We evaluated it using simulation and power traces acquired from FPGA implementation.