Masking Feedforward Neural Networks Against Power Analysis Attacks
Masking Feedforward Neural Networks Against Power Analysis Attacks
复制标题
DOI：
10.2478/popets-2022-0025
复制
发表时间：
2021-11
影响因子：
--
通讯作者：
Konstantinos Athanasiou;T. Wahl;A. Ding;Yunsi Fei
中科院分区：
文献类型：
--
作者：
Konstantinos Athanasiou;T. Wahl;A. Ding;Yunsi Fei
机器学习的最新进展使神经网络（NN）能够直接在受限的嵌入式设备上进行推理。这种本地方法增强了用户数据的隐私性，因为神经网络推理的输入不会通过通信网络与第三方云提供商共享。然而，与此同时，在嵌入式设备上执行局部神经网络推理打开了功率分析攻击的可能性，这最近被证明在恢复神经网络参数以及它们的激活和结构方面是有效的。这些神经网络特征的知识构成了隐私威胁，因为它可以实现高效的成员推理和模型反转攻击，这些攻击可以恢复有关神经网络模型所训练的敏感数据的信息。在本文中，我们解决了保护敏感神经网络推理参数免受功率分析攻击的问题。我们的方法采用掩蔽，这是一种在密码学算法中得到充分研究的对策。我们设计了一套小工具，即掩码操作，为神经网络推理量身定制。我们证明了我们提出的小工具可以免受功率攻击，并在正式和实验上证明它们是可组合的，从而实现了安全的神经网络推理。我们进一步提出了利用神经网络推理的内在特征来减少屏蔽的运行时间和随机性要求的优化方法。我们根据经验评估了我们的结构的性能，显示它们会导致大约2-5倍的减速。
Abstract Recent advances in machine learning have enabled Neural Network (NN) inference directly on constrained embedded devices. This local approach enhances the privacy of user data, as the inputs to the NN inference are not shared with third-party cloud providers over a communication network. At the same time, however, performing local NN inference on embedded devices opens up the possibility of Power Analysis attacks, which have recently been shown to be effective in recovering NN parameters, as well as their activations and structure. Knowledge of these NN characteristics constitutes a privacy threat, as it enables highly effective Membership Inference and Model Inversion attacks, which can recover information about the sensitive data that the NN model was trained on. In this paper we address the problem of securing sensitive NN inference parameters against Power Analysis attacks. Our approach employs masking, a countermeasure well-studied in the context of cryptographic algorithms. We design a set of gadgets, i.e., masked operations, tailored to NN inference. We prove our proposed gadgets secure against power attacks and show, both formally and experimentally, that they are composable, resulting in secure NN inference. We further propose optimizations that exploit intrinsic characteristics of NN inference to reduce the masking’s runtime and randomness requirements. We empirically evaluate the performance of our constructions, showing them to incur a slowdown by a factor of about 2–5.