Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 5: Marginally below acceptance threshold
review_content: Summary: 
- This paper studies the effectiveness of inferring a neural network’s layers and hyperparameters using the magnetic fields emitted from a GPU’s power cable. The results show that (under certain assumptions) one can reconstruct a neural network’s layers and hyperparameters accurately, and use the inferred model to launch adversarial transfer attacks.

Strong points: 
- The idea of using magnetic side channels to infer network structure is interesting.
- The paper is well-written with ideas and limitations explained clearly.
- The experiment results are thorough and explained clearly

Weak points: 
- The threat model seems impractical. Attacker assumptions include:
  - have physical access to the GPU
  - know the exact input feature dimensions and batch size.
  - know the deep learning framework, GPU brand and hardware/software versions.
- The main innovation is demonstrating magnetic side channels from GPU cables reveal information about network structures. However, I’m not sure if ICLR is the best venue for this type of contribution. This paper could be a much stronger submission to other security and system conferences.

Recommendation: 
- I’m inclined to recommend a reject. The main reason is that the results are based on multiple impractical assumptions, limiting the impact of this paper in reality. 

Comments & questions:
- How do the authors imagine launching this attack in reality? Specifically, how would one know the input dimensions and batch size of a black-box model? A clear explanation of this will help readers understand the value of this work.
- Using consistency constraints to optimize for hyperparameter estimation is interesting. How effective is this additional optimization compared with only using the initial estimation?

Minor comments
- “But there is ‘not’ evidence proving” -> ‘no’

==== Updates after the response ====

I thank the authors for answering the questions in detail. Providing an example application does help readers understand scenarios where the threat model could apply. However, I still think such scenarios are not common but agree that the findings in this paper could be helpful for future security research. I adjusted my rating based on this better understanding. 
review_title: Interesting but assumptions are not practical

final_score: rating: 7: Good paper, accept
review_content: # Summary:
The paper presents a method for capturing the shape (type of layers) and their respective parameters of a neural network through the magnetic field induced as the GPU drains power. In particular, the GPU is snooped using an off-the-shelf magnetic induction sensor which is placed along the power cable of the GPU. It turns out that under some assumptions (knowledge of GPU model and deep learning framework, knowledge of input size and ability to launch query of specific batch size), based on the correlation of the power consumption pattern of the GPU with the operations being performed it is possible to recognize the type of operation being performed as well as the respective hyper-parameters with very few errors.


# Strengths:
The paper presents a very interesting and novel method for "spying" on the Neural Network being executed on a GPU by capturing the magnetic signal induced by the GPU's power consumption. A BiLSTM is employed to classify captured samplers of the magnetic signal to segments corresponding to specific steps/operations of the neural network. Then DNNs specific for each type of step are employed for estimating the hyper-parameters of each step. Consistency between the hyper-parameters is enforced by solving an integer-programming problem.

The proposed method is able to recover the entire structure of various types of neural networks (including randomly generated ones) and the parameters of each step with very few errors. The similarity of the reconstructed networks is evaluated under various metrics, including the performance of target and reconstructed networks on a classification task. An interesting application is the use of the method to build surrogate models for performing black-box adversarial attacks with very high success rates. Possible counter-measures are proposed and the limitations of the method are also discussed.

The paper is very well-written and easy to read. The evaluation is quite comprehensive showing the ability of the method to fully recover the architecture of various networks while further results and clarifications are provided in the supplemental material.


# Weaknesses and Questions:
Some interesting aspects are not completely covered. For example, although transferability to different hardware is discussed, still the sensitivity of the method with respect to some factors is not discussed. In particular, are there any calibration issues that should be taken into account? How does the method perform if a sensor of different make is used with possible different sampling rate? In what range of sampling rates/placement distances the method works? Regarding GPU transferability, are the GPU pairs of the same make, frequency settings, etc.?

Additionally, regarding the segmentation of the samples in steps, one would expect that some over-segmentation issues would be present. Are there any measures for enforcing temporal consistency and for avoiding over-segmentation, or it is not an issue because the samples are so unambiguous?

Regarding the applicability of the proposed method, in real-world conditions it may not always be possible to define the input of the batch size. On this topic, more details can be provided on the strategy to be used to find a suitable batch size for the method to work. Additionally, the paper considers only networks acting as encoders. Would the method naturally extend to decoders or are there any difficulties/ambiguities introduced? Also the paper focuses on the inference task, can the method be applied also for training tasks and with what adaptations?

Regarding the defenses, what happens if inference optimizers (e.g. Tensor RT) are used? Is the performance of the method affected? Also, does multi-GPU setups introduce interference?

## Minor comments:
* Figure 1 right: the abbreviations (BN, MP), although common, should be explained in the text/caption.
* Joint optimization paragraph: "will generally not fully"
* page 5 before Section 4: "Were it that DNN"
 
# Rating Justification:
Overall, I think that the paper is highly novel and introduces an interesting way to recover the architecture of a NN by using a cheap sensor. There are many questions that rise by this work mainly though due to its novel and intriguing nature. I am not 100% sure that ICLR is the most suitable venue for this work, I am not considering though this aspect in my rating.

# Rating and comments after the rebuttal
I share the concerns of fellow reviewers regarding the practicality of the assumptions needed for launching the attack presented in the paper, however, based also on the discussion with the authors, I think that the paper is interesting regardless as it can lead to better insights regarding the development of suitable defence mechanisms for securing the architecture and the information carried by a Deep Learning model.

I share also the concerns raised in the other reviews that the paper might be better appreciated by an audience focusing on cyber-security. However, I think that the subject can also be of relevance to ICLR as the paper made an effort to highlight the aspects more relevant to the ML community.

Hence, leaving the aspect of relevance to the ACs' discretion, I think that overall this is a clearly written paper based on well executed research that presents some interesting results that are potentially impactful in the aspects concerning security of systems employing Deep Learning models.
review_title: Intriguing way to reconstruct neural networks by snooping the GPU power consumption.

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper demonstrates that magnetic side channel information from a GPU (that is processing a deep neural net) can be snooped to recover the architecture and hyperparameters of the neural network. While the concept of side channel information snooping to recover codes/software (including ML models) is widely studied, the novelty claim is that recovering detailed structures of deep models is new. The paper also demonstrates that black-box attacks mounted using a recovered model is quite powerful compared to traditional black-box attacks. 

The paper is well-written and quite useful for the safety-critical applications community that use ML. However, there is no core ML contribution made in this paper. The authors use standard ML models to map the side channel signal to deep learning model architecture. The use of model architecture consistencies as constraints is clever, but nothing significant in terms of contributions to the ML community. So, in my opinion, this paper is better suited for other venues such as cyber security conferences.  
review_title: Good paper, but may not be appropriate for ICLR

Meta-review: 
The paper presents a side-channel attack in a scenario where the attacker is able to place a induction sensor near the power cable of the victim's GPU. The authors train a neural network to analyse the magnetic flux measured by the sensor to recover the structure (layer type and layer parameters) of the target neural network. The authors also show that for a wide range of target network structure, by training a network with the inferred structure, they produce adversarial examples as effective as a white box attack.

The points raised by the reviewers were the following: 1) the result that this type of side-channel attack works is interesting, 2) the practicality of the attack is unclear because the attacker needs hardware access to the victim's GPU, 3) the ML contribution is not really clear and a venue on cyber-security might be more appropriate. 

Side-channel attacks on deep neural networks can be of relevance to ICLR (as pointed to by the authors by the ICLR papers/submissions on system side-channel attacks). Nonetheless, I tend to agree with R1 and R2 that the ML contribution is limited (either in terms of application of ML or methodology), and the concerns of practicality of the approach make me lean towards rejection.
Decision: Reject