Deep Neural Exposure: You Can Run, but Not Hide Your Neural Network Architecture!

Sayed Erfan Arefin, Abdul Serwadda

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Deep Neural Networks (DNNs) are at the heart of many of today's most innovative technologies. With companies investing lots of resources to design, build and optimize these networks for their custom products, DNNs are now integral to many companies' tightly guarded Intellectual Property. As is the case for every high-value product, one can expect bad actors to increasingly design techniques aimed to uncover the architectural designs of proprietary DNNs. This paper investigates if the power draw patterns of a GPU on which a DNN runs could be leveraged to glean key details of its design architecture. Based on ten of the most well-known Convolutional Neural Network (CNN) architectures, we study this line of attack under varying assumptions about the kind of data available to the attacker. We show the attack to be highly effective, attaining an accuracy in the 80 percentage range for the best performing attack scenario.

Original languageEnglish
Title of host publicationIH and MMSec 2021 - Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security
PublisherAssociation for Computing Machinery, Inc
Pages75-80
Number of pages6
ISBN (Electronic)9781450382953
DOIs
StatePublished - Jun 17 2021
Event2021 ACM Workshop on Information Hiding and Multimedia Security, IH and MMSec 2021 - Virtual, Online, Belgium
Duration: Jun 22 2021Jun 25 2021

Publication series

NameIH and MMSec 2021 - Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security

Conference

Conference2021 ACM Workshop on Information Hiding and Multimedia Security, IH and MMSec 2021
Country/TerritoryBelgium
CityVirtual, Online
Period06/22/2106/25/21

Keywords

  • GPU
  • deep neural networks
  • power attack
  • side channel

Fingerprint

Dive into the research topics of 'Deep Neural Exposure: You Can Run, but Not Hide Your Neural Network Architecture!'. Together they form a unique fingerprint.

Cite this