论文标题
嗅探：具有故障攻击的神经网络的逆向工程
SNIFF: Reverse Engineering of Neural Networks with Fault Attacks
论文作者
论文摘要
神经网络已被证明对断层注射攻击很容易受到伤害。这些攻击改变了计算过程中设备的物理行为，从而导致当前正在计算的值的变化。它们可以通过各种故障注入技术实现，从时钟/电压故障到激光器到Rowhammer的应用。在本文中，我们探讨了通过使用故障攻击来反向工程神经网络的可能性。 Sniff代表标志位Flip故障，这可以通过更改中间值的符号来实现反向工程。我们在深层特征提取器网络上开发了第一个精确的提取方法，该方法可证明可以恢复模型参数。我们对KERAS库的实验表明，使用64位浮子的使用情况下，测试网络的参数恢复的精确误差小于$ 10^{-13} $，这将最终的最新水平提高了6个数量级。此外，我们讨论了可用于增强断层电阻的断层注射攻击的保护技术。
Neural networks have been shown to be vulnerable against fault injection attacks. These attacks change the physical behavior of the device during the computation, resulting in a change of value that is currently being computed. They can be realized by various fault injection techniques, ranging from clock/voltage glitching to application of lasers to rowhammer. In this paper we explore the possibility to reverse engineer neural networks with the usage of fault attacks. SNIFF stands for sign bit flip fault, which enables the reverse engineering by changing the sign of intermediate values. We develop the first exact extraction method on deep-layer feature extractor networks that provably allows the recovery of the model parameters. Our experiments with Keras library show that the precision error for the parameter recovery for the tested networks is less than $10^{-13}$ with the usage of 64-bit floats, which improves the current state of the art by 6 orders of magnitude. Additionally, we discuss the protection techniques against fault injection attacks that can be applied to enhance the fault resistance.
