EMShepherd: Detecting Adversarial Samples via Side-channel Leakage
EMShepherd: Detecting Adversarial Samples via Side-channel Leakage
复制标题
DOI：
10.1145/3579856.3582827
复制
发表时间：
2023-03
期刊：
影响因子：
--
通讯作者：
Ruyi Ding;Gongye Cheng;Siyue Wang;A. A. Ding-A.;Yunsi Fei
中科院分区：
文献类型：
--
作者：
Ruyi Ding;Gongye Cheng;Siyue Wang;A. A. Ding-A.;Yunsi Fei
深度神经网络（DNN）很容易受到对抗性扰动的影响-故意对输入进行微小的更改，以误导模型进行错误的预测。对抗性攻击对深度学习支持的关键应用程序造成了灾难性的后果。现有的防御和检测技术都需要对模型、测试输入甚至执行细节有广泛的了解。它们对于模型内部未知的一般深度学习实现是不可行的，这是模型用户常见的“黑盒”场景。受模型推理的电磁（EM）发射依赖于操作和数据，并且可能包含不同输入类的足迹这一事实的启发，我们提出了一个框架EMShepherd，用于捕获模型执行的EM痕迹，对痕迹进行处理，并利用它们进行对抗性检测。只有良性样本及其EM轨迹用于训练对抗检测器：一组EM分类器和类特定的无监督异常检测器。当受害者模型系统受到敌对示例的攻击时，模型执行将不同于已知类的执行，并且EM跟踪将不同。我们证明了我们的气隙EMShepherd可以有效地检测Fashion MNIST和CIFAR-10数据集的常用FPGA深度学习加速器上的不同对抗性攻击。它在大多数类型的对抗样本上实现了检测率，这与最先进的基于软件的“白盒”检测器相当。
Deep Neural Networks (DNN) are vulnerable to adversarial perturbations — small changes crafted deliberately on the input to mislead the model for wrong predictions. Adversarial attacks have disastrous consequences for deep learning empowered critical applications. Existing defense and detection techniques both require extensive knowledge of the model, testing inputs and even execution details. They are not viable for general deep learning implementations where the model internal is unknown, a common ‘black-box’ scenario for model users. Inspired by the fact that electromagnetic (EM) emanations of a model inference are dependent on both operations and data and may contain footprints of different input classes, we propose a framework, EMShepherd, to capture EM traces of model execution, perform processing on traces and exploit them for adversarial detection. Only benign samples and their EM traces are used to train the adversarial detector: a set of EM classifiers and class-specific unsupervised anomaly detectors. When the victim model system is under attack by an adversarial example, the model execution will be different from executions for the known classes, and the EM trace will be different. We demonstrate that our air-gapped EMShepherd can effectively detect different adversarial attacks on a commonly used FPGA deep learning accelerator for both Fashion MNIST and CIFAR-10 datasets. It achieves a detection rate on most types of adversarial samples, which is comparable to the state-of-the-art ‘white-box’ software-based detectors.