Game of Threads: Enabling Asynchronous Poisoning Attacks
Game of Threads: Enabling Asynchronous Poisoning Attacks
复制标题
DOI：
10.1145/3373376.3378462
复制
发表时间：
2020-03
期刊：
影响因子：
--
通讯作者：
Jose Rodrigo Sanchez Vicarte;Benjamin Schreiber;Riccardo Paccagnella;Christopher W. Fletcher
中科院分区：
文献类型：
--
作者：
Jose Rodrigo Sanchez Vicarte;Benjamin Schreiber;Riccardo Paccagnella;Christopher W. Fletcher
随着数据尺寸继续以前所未有的速度增长，机器学习培训被迫采用异步算法以保持性能和可伸缩性。在异步培训中，许多线程以较高的方式共享和更新模型，以避免昂贵的线程间同步。本文通过引入异步中毒攻击来研究这些代码的安全含义。我们的攻击会影响训练结果 - 例如，降低模型的准确性或将模型偏向于对手指定的标签 - 纯粹是通过以恶意方式安排异步训练线的纯粹。由于线程调度不超出现代可信执行环境（TEE）的保护范围，例如英特尔SGX，因此即使训练集可以正确验证，我们的攻击也绕开了这些保护措施。据我们所知，这代表了第一个示例，尽管受到SGX之类的基于飞地的TEE的保护，但一类应用程序会失去完整性保证。我们展示了对CIFAR-10图像识别任务的准确性降解和模型偏置攻击，该攻击使用Pytorch发表的异步训练代码对重新连接式DNN进行了训练。我们还执行概念验证实验，以验证我们在支持SGX的机器上的假设。我们的准确性降解攻击能够将收敛模型返回到预训练的准确性或之间的精度。我们的模型偏置攻击可以迫使模型预测CIFAR-10验证集的对手指定的标签，高达约40％（而未攻击的模型对任何标签的预测率为约10％）。
As data sizes continue to grow at an unprecedented rate, machine learning training is being forced to adopt asynchronous algorithms to maintain performance and scalability. In asynchronous training, many threads share and update the model in a racy fashion to avoid costly inter-thread synchronization. This paper studies the security implications of these codes by introducing asynchronous poisoning attacks. Our attack influences training outcome---e.g., degrades model accuracy or biases the model towards an adversary-specified label---purely by scheduling asynchronous training threads in a malicious fashion. Since thread scheduling is outside the protections of modern trusted execution environments (TEEs), e.g., Intel SGX, our attack bypasses these protections even when the training set can be verified as correct. To the best of our knowledge, this represents the first example where a class of applications loses integrity guarantees, despite being protected by enclave-based TEEs such as SGX. We demonstrate both accuracy degradation and model biasing attacks on the CIFAR-10 image recognition task, trained on Resnet-style DNNs using an asynchronous training code published by Pytorch. We also perform proof-of-concept experiments to validate our assumptions on an SGX-enabled machine. Our accuracy degradation attacks are capable of returning a converged model to pre-trained accuracy or to some accuracy in between. Our model biasing attack can force the model to predict an adversary-specified label up to ~40% of the time on the CIFAR-10 validation set (whereas the un-attacked model's prediction rate towards any label is ~10%).