Collaborative Research: SaTC: CORE: Small: Secure and Robust Machine Learning in Multi-Tenant Cloud FPGA

协作研究：SaTC：CORE：小型：多租户云 FPGA 中安全且稳健的机器学习

• 批准号: 2153690
• 负责人: Xiaolin Xu
• 金额: $ 25万
• 依托单位: Northeastern University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-07-15 至 2025-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2153690&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Small

Alongside the rapid growth of cloud-computing market and critical developments in machine learning (ML) computation, the cloud-FPGA (Field Programmable Gate Arrays) has become a vital hardware resource for public lease, where multiple tenants can co-reside and share an FPGA chip over time or even simultaneously. With many hardware resources being jointly used in the multi-tenant cloud-FPGA environment, a unique attack surface is created, where a malicious tenant can leverage such indirect interaction to manipulate the circuit application of other tenants, e.g., intentionally injecting faults. It has been demonstrated in prior research that small, but carefully designed, perturbation of the ML model parameter transmission between off-chip memory and on-chip buffer could completely malfunction ML intelligence, even under black-box attack scenario, posing an unprecedented threat to future ML cloud-FPGA system. This project (1) targets to understand the vulnerability of multi-tenant ML cloud-FPGA systems and explore defensive approaches, which are crucial and timely for both industry and academia in the cloud-FPGA computing domain; (2) advances the security of ML cloud system against hardware-based model tampering on off-chip data transmission in multi-tenant cloud-FPGA computing infrastructure; and (3) integrates the research outcomes with education in terms of new curriculum development, undergraduate and graduate student training, as well as promoting women and underrepresented minorities in STEM through K-12 outreach programs. This project integrates ML algorithm security and FPGA hardware security to follow a software-hardware co-design mechanism, exploring novel solutions that improve the security of multi-tenant ML cloud-FPGA system. It consists of three research thrusts. Thrust-1 systematically studies, models, and characterizes an adversarial weight duplication hardware fault injection method, which leverages aggressive power-plundering circuits in malicious tenant to inject fault into the victim tenant's ML model. Thrust-2 explores various ML algorithmic methodologies to enhance the intrinsic robustness and resiliency of ML model against adversarial fault injection into model parameters during the transmission from off-chip memory to on-chip buffer. Thrust-3 investigates FPGA system-level tamper-resistant approaches to further provide comprehensive solutions to improve the ML-FPGA system security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

除了云计算市场的快速增长和机器学习（ML）计算中的关键发展之外，云FPGA（现场可编程门阵列）已成为公共租赁的重要硬件资源，多个租户可以在其中共同介绍并随着时间的推移甚至同时共享FPGA芯片。由于许多硬件资源在多租户云FPGA环境中共同使用，因此创建了独特的攻击表面，恶意租户可以利用这种间接交互来操纵其他租户的电路应用，例如故意注入故障。在先前的研究中已经证明，即使在黑盒攻击方案下，也可能完全失去ML智能的ML模型参数传输的扰动，可能会完全出现ML智能，对未来的ML ML Cloud FPGA系统构成前所未有的威胁。该项目（1）目标是了解多租户ML Cloud-FPGA系统的脆弱性并探索防御方法，这对于云FPGA计算域中的行业和学术界至关重要且及时； （2）在多租户云FPGA计算基础架构中，ML Cloud System免受基于硬件的模型的安全性篡改； （3）将研究成果与新课程开发，本科和研究生培训以及通过K-12外展计划促进妇女和人为少数族裔的教育成果相结合。该项目集成了ML算法安全性和FPGA硬件安全性，以遵循软件硬件共同设计机制，探索新的解决方案，以提高多租户ML Cloud FPGA系统的安全性。它由三个研究推力组成。推力-1系统地研究，模型并表征了对抗重复重复硬件故障注入方法，该方法利用恶意租户的积极强化电路电路将故障注入受害者租户的ML模型。 Throust-2探索了各种ML算法方法，以增强ML模型对对抗性断层注射到模型参数的内在鲁棒性和弹性，从而在从芯片内存到片上缓冲液到芯片缓冲液的传输过程中。 Throust-3调查了FPGA系统级防篡改方法，以进一步提供全面的解决方案来改善ML-FPGA系统安全性。该奖项反映了NSF的法定任务，并认为值得通过基金会的知识分子优点和更广泛的影响审查标准通过评估来获得支持。

项目成果

AutoReP: Automatic ReLU Replacement for Fast Private Network Inference

• DOI: 10.1109/iccv51070.2023.00478
• 发表时间: 2023-08
• 期刊: 2023 IEEE/CVF International Conference on Computer Vision (ICCV)
• 作者: Hongwu Peng;Shaoyi Huang;Tong Zhou;Yukui Luo;Chenghong Wang;Zigeng Wang;Jiahui Zhao;Xiaowei Xie;Ang Li;Tony Geng;Kaleel Mahmood;Wujie Wen;Xiaolin Xu;Caiwen Ding

ObfuNAS: A Neural Architecture Search-based DNN Obfuscation Approach

• DOI: 10.1145/3508352.3549429
• 发表时间: 2022-08
• 期刊: 2022 IEEE/ACM International Conference On Computer Aided Design (ICCAD)
• 作者: Tong Zhou;Shaolei Ren;Xiaolin Xu

VertexSerum: Poisoning Graph Neural Networks for Link Inference

• DOI: 10.1109/iccv51070.2023.00418
• 发表时间: 2023-08
• 期刊: 2023 IEEE/CVF International Conference on Computer Vision (ICCV)
• 作者: Ruyi Ding;Shijin Duan;Xiaolin Xu;Yunsi Fei

MirrorNet: A TEE-Friendly Framework for Secure On-Device DNN Inference

• DOI: 10.1109/iccad57390.2023.10323746
• 发表时间: 2023-10
• 期刊: 2023 IEEE/ACM International Conference on Computer Aided Design (ICCAD)
• 作者: Ziyu Liu;Yukui Luo;Shijin Duan;Tong Zhou;Xiaolin Xu

PASNet: Polynomial Architecture Search Framework for Two-party Computation-based Secure Neural Network Deployment

• DOI: 10.1109/dac56929.2023.10247663
• 发表时间: 2023-06
• 期刊: 2023 60th ACM/IEEE Design Automation Conference (DAC)
• 作者: Hongwu Peng;Shangli Zhou;Yukui Luo;Nuo Xu;Shijin Duan;Ran Ran-Ran;Jiahui Zhao;Chenghong Wang;Tong Geng;Wujie Wen;Xiaolin Xu;Caiwen Ding