DeepPeep: Exploiting Design Ramifications to Decipher the Architecture of Compact DNNs

Autor: Govardhan Mattela, Binod Kumar, Sparsh Mittal, Nandan Kumar Jha
Rok vydání: 2020
Předmět:
FOS: Computer and information sciences
K.4.1
K.4.4
Computer Science - Machine Learning
Service (systems architecture)
Computer Science - Cryptography and Security
Exploit
Computer science
Distributed computing
Computer Vision and Pattern Recognition (cs.CV)
Computer Science - Computer Vision and Pattern Recognition
Cloud computing
Machine Learning (stat.ML)
02 engineering and technology
Commercialization
Outsourcing
Machine Learning (cs.LG)
Statistics - Machine Learning
020204 information systems
0202 electrical engineering
electronic engineering
information engineering
Side channel attack
Electrical and Electronic Engineering
Architecture
business.industry
Hardware and Architecture
DECIPHER
020201 artificial intelligence & image processing
business
Cryptography and Security (cs.CR)
Software
DOI: 10.48550/arxiv.2007.15248
Popis: The remarkable predictive performance of deep neural networks (DNNs) has led to their adoption in service domains of unprecedented scale and scope. However, the widespread adoption and growing commercialization of DNNs have underscored the importance of intellectual property (IP) protection. Devising techniques to ensure IP protection has become necessary due to the increasing trend of outsourcing the DNN computations on the untrusted accelerators in cloud-based services. The design methodologies and hyper-parameters of DNNs are crucial information, and leaking them may cause massive economic loss to the organization. Furthermore, the knowledge of DNN's architecture can increase the success probability of an adversarial attack where an adversary perturbs the inputs and alter the prediction. In this work, we devise a two-stage attack methodology "DeepPeep" which exploits the distinctive characteristics of design methodologies to reverse-engineer the architecture of building blocks in compact DNNs. We show the efficacy of "DeepPeep" on P100 and P4000 GPUs. Additionally, we propose intelligent design maneuvering strategies for thwarting IP theft through the DeepPeep attack and proposed "Secure MobileNet-V1". Interestingly, compared to vanilla MobileNet-V1, secure MobileNet-V1 provides a significant reduction in inference latency ($\approx$60%) and improvement in predictive performance ($\approx$2%) with very-low memory and computation overheads.
Comment: Accepted at The ACM Journal on Emerging Technologies in Computing Systems (JETC), 2020. 25 pages, 11 tables, and 11 figures
Databáze: OpenAIRE
Externí odkaz: