Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This work proposed a method to reconstruct machine learning pipelines and network architectures using cache side-channel attack. It is based on a previous proposed method Flush+Reload that generates the raw trace of function calls. Then the authors applied several techniques to rebuild the computational graph from the raw traces. The proposed method is used to reconstruct MalConv which is a data pre-processing pipeline for malware detection and ProxyLessNas which is a network architecture obtained by NAS. 

Overall, the paper is well-written and easy to read. The problem of stealing machine learning pipelines/architectures is interesting and important, since it enables an attacker to actually know the private networks that are being used for prediction. Therefore, I think this is a promising direction for future work.

I hope the authors can address my concerns as follows:

Q1: What is the knowledge of the attacker? The authors should be explicit in summarizing the detailed search space of the attacker. Currently i found it very hard to understand the capability of attacker. This is important in evaluating this work.

Q2: Can the authors add some discussion on how to defend against the proposed attack? For example, one can add some null/useless operation during execution to make the reconstruction process harder? 

Q3: I am curious why the authors choose ProxylessNAS-CPU for evaluation. There is a bunch of other architectures found by NAS, e.g. MNas, ENas?
review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: Summary
---
This paper proposes to use a computer security method, "Flush+Reload" to infer the DNN architecture of a victim in the setting where both the attacker and the victim share the same machine in a cloud computing scenario. This does not require any physical access to the machine, however it does require that a CPU is shared, and the inference of the architectural details is based on the time it takes to reload computations from cache. 
The paper is overall clear and well written.

Motivations of the paper
---
However, concerning the motivations of the paper, I'd like some clarifications. As far as I know, in the deep learning community, the most effective architectures are published and public (VGG, Inception, ResNet, Transformer...).
I am a bit confused by the sentence "As a result, in the industry such novel DL systems are kept as trade secrets or
intellectual property as they give their owners a competitive edge (Christian & Vanhoucke, 2017)." which justifies that architectures are kept secret and thus may be prone being stolen.
This US patent is public and explains the method. As far as I know, it has never been enforced. Furthermore, this patent is associated with the paper "Going deep with convolutions", Szegedy et al. which introduced the Inception architecture, is public, very well-known, and thus I do not believe anyone would have any commercial interest in stealing it. 
Furthermore, I do have the impression that the edge many companies have over their competitors is the private datasets they own much more than the architectural details.

Method and applicability
---
While the method Flush+Reload itself is not novel, its application to the DNNs case and the way to reconstruct the architecture (generating the candidates, pruning) is.
However, I do have some practical concerns about the applicability of the method.

As far as I understand, it can only work on one CPU. Most DNNs, even for inference, are run on (one or multiple) GPUs. Can the method be extended to work on GPUs?

Also, while the assumption that both the attacker and the victim use the same framework is realistic to me, I believe, they should also both use the same version of the said library, no? Otherwise some operations might be faster in some versions and slower in others, this is thus an additional and much stronger assumption to make.

At last, this would require the victim to use a public cloud service. However, as far as I know, many of the companies who could potentially design new architectures have their own private cloud. I am not certain that someone disposing of a new, private, and powerful architecture would use it on a public cloud service. 

Experiments
---
The experimental section seems very limited to me. The authors show that they are able to reconstruct perfectly 2 architectures. While this is encouraging, I would like to see the limits of the proposed method.
Why not generate N random (or not so random) architectures and try to reconstruct them? Where does the method fail, where does it succeed?
What if the victim used a custom layer that the method could not recover? Does it still recover a similar architecture?


Conclusion
---
While the paper, proposed to use Flush+Reload for recovering DNNs architectures and succeeds for at least 2 non trivial architectures, I do not recommend acceptance.
First I am concerned by the problem this paper is tackling. Can this realistically happen in a real-life scenario?
Second, I am worried that the method suffers from very strong limitations in practice (eg the usage of a CPU for both victim and attacker).
Finally, and importantly, while the experiments show some interesting first results, they are limited, I am not able to judge the strengths and weaknesses of the method, and thus I cannot assess the usefulness of the proposed method.

Note: I have to say that this paper is definitely out of my area of expertise, even though I am confident in my understanding of the paper, it may be that some of my concerns are unfounded. If this is the case I will adjust my score accordingly.
review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: This paper proposes a way to attack and reconstruct a victim's neural architecture that is co-located on the same host. They do it through cache side-channel leakage and use Flush+Reload to extract the trace of victim's function call, which tells specific network operations. To recover the computational graph, they use the approximate time each operation takes to prune out any incompatible candidate computation graph. They show that they can reconstruct exactly the MalConv and ProxylessNAS. 

The paper looks very interesting but also alarming -- more research should be done to countermeasure this attack. I have the following questions: 

1. To reconstruct the network, you need to generate potentially exponentially number of candidates and do some pruning based on the estimated parameters. This also looks very expensive. I am wondering compared to just doing NAS yourself, how much gain in terms of resources and time this attack can give? 

2. What is the limitation of the proposed approach, i.e., does it work on any network structures, e.g., sequence networks, graph convolutional networks, etc. 

3. In the experiments shown, you can reconstruct MalConv and ProxylessNAS with zero error, does the proposed approach alway find the exact match? Under what circumstances can you find the exact match?
review_title: Official Blind Review #3

Meta-review: This paper proposes using Flush+Reload to infer the deep network architecture of another program, when the two programs are running on the same machine (as in cloud computing or similar). 

There is some disagreement about this paper; the approach is thoughtful and well executed, but one reviewer had concerns about its applicability and realism. Upon reading the author's rebuttal I believe these to be largely addressed, or at least as realistically as one can in a single paper. Therefore I recommend acceptance.
Decision: Accept (Poster)