Arithmetic Masking Countermeasure to Mitigate Side-Channel-Based Model Extraction Attack on DNN Accelerator
摘要
Trained deep neural networks (DNNs) are valuable intellectual property because they require huge costs for data, computation, and expertise to develop. Because the trained DNN models can be exploited for attacks to induce malfunctions and privacy violations, protecting them is crucial from a security perspective. Especially for edge devices, considering physical attacks on hardware, such as side-channel attacks (SCAs) is necessary. For instance, DNN model parameters can be encrypted and stored in the memory of the device, but they are vulnerable to SCAs because they are decrypted during computation. This paper proposes an arithmetic masking countermeasure to mitigate model extraction attacks using correlation power analysis on the wavefront array, one of the matrix multiplication accelerators. This countermeasure adds rows and columns with random numbers on the input and weight matrix; these random numbers make a register transition unpredictable. It can be implemented without any circuit modification and with only two additional clock cycles. We evaluated it using simulation and power traces acquired from FPGA implementation.