Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel

1 INTRODUCTION . The Graphics Processing Unit ( GPU ) is a favored vehicle for executing a neural network . As it computes , it also hums—electromagnetically . What can this hum tell us ? Could listening to the GPU ’ s electromagnetic ( EM ) radiation reveal details about the neural network ? We study this question and find that magnetic induction sensing reveals a detailed network structure , including both topology and hyperparameter values , from inferences of otherwise unknown networks running on GPUs . Reverse engineering a network structure has attracted increasing research effort , motivated by several concerns . First , it has been well known that the performance of a network model hinges on its judiciously designed structure—but finding an effective design is no easy task . Significant time and energy is expended in searching and fine-tuning network structures ( Zoph et al. , 2018 ) . Moreover , in industry , optimized network structures are often considered confidential intellectual property . It is therefore important to understand the extent to which this valuable , privileged information can be compromised . Worse yet , a reverse engineered “ surrogate ” model also makes the black-box “ victim ” model more susceptible to adversarial transfer attacks ( Papernot et al. , 2017 ; Liu et al. , 2016 ) , in which a vulnerability identified in the surrogate is exploited on the victim . Success in the exploit is contingent on the ability of the surrogate to successfully model the vulnerabilities of the victim . Recovering accurate , detailed network topology and hyperparameters informs the modeling of a good surrogate . We examine the fluctuation of magnetic flux from the GPU ’ s power cable , and ask whether a passive observer can glean the information needed to reconstruct neural network structure . Remarkably , we show that , through magnetic induction sensing , a passive observer can reconstruct the complete network structure even for large and deep networks . Threat model . We consider an adversary that ( i ) is able to place a magnetic induction sensor in close proximity to the GPU ’ s power cable , ( ii ) knows the dimension of the input feature vector , and ( iii ) is able to launch a query of known batch size . We also consider that our attacker uses the same deep learning framework ( e.g. , PyTorch , TensorFlow ) as the black-box model . The adversary is otherwise weak , lacking access to the model source , binaries , training data , and underlying training data distribution ; without ability to execute code on the host CPU and GPU ; and without knowledge of the input values and output results of the launched queries . Not only that—it also lacks direct access to the GPU hardware , beyond the proximity to the power cable . The adversary only requires access to their own GPU hardware , matching the brand/version of the victim , e.g. , as purchased on the open market . Physical principle . The GPU consumes energy at a variable rate that depends on operations performed . Every microprocessor instruction is driven by transistor electron flows , and different instructions require different power levels ( Grochowski & Annavaram , 2006 ) . The many compute cores of a GPU amplify the fluctuation in energy consumption , and so too the current drawn from the power cable . Current induces magnetic flux governed by the Biot-Savart law ( Griffiths , 2005 ) , and current fluctuations induce EM ripples whose propagation through the environment is governed by the Ampère-Maxwell law . Even a cheap , $ 3 magnetic induction sensor ( see Fig . 2 ) placed within a few millimeters of the power cable suffices to record these EM ripples . Technique and results . To reconstruct the black-box network ’ s structure , we propose a two-step approach . First , we estimate the network topology , such as the number and types of layers , and types of activation functions , using a suitably trained neural network classifier . Then , for each layer , we estimate its hyperparameters using another set of deep neural network ( DNN ) models . The individually estimated hyperparameters are then jointly optimized by solving an integer programming problem to enforce consistency between the layers . We demonstrate the potential accuracy of this side-channel attack in recovering the details for a wide range of networks , including large , deep networks such as ResNet101 . We further apply this recovery approach to demonstrate black-box adversarial transfer attacks . 1.1 RELATED WORK : MODEL EXTRACTION BY QUERIES AND SIDE-CHANNEL ANALYSIS . Our work falls under the umbrella of black-box model extraction . Absent access to the model ’ s internals , one might infer structure from observed input-output pairs . For instance , Tramèr et al . ( 2016 ) demonstrated that , for simple models such as decision trees and support vector machines hosted on a cloud , certain internal information can be extracted via a multitude of queries . This approach , which was extended to infer details of deep neural networks ( Oh et al. , 2019 ; Liu et al. , 2016 ; Duddu & Rao , 2019 ) , is typically able to recover certain information , such as optimization learning rate and network structure type , but has not demonstrated recovery of full structural details . A contrasting approach , side-channel analysis ( SCA ) , extracts information gained from the physical implementation of a model , rather than in the mathematical model itself . Analysis of timing ( Kocher , 1996 ) , power ( Kocher et al. , 1999 ; Luo et al. , 2015 ) , cache flushes ( Yarom & Falkner , 2014 ) , and audio ( Genkin et al. , 2014 ) have been prominently demonstrated to extract secret keys from cryptographic procedures such as the Digital Signature and Advanced Encryption Standards . SCA was recently used to infer machine learning models by observing power consumption profiles ( Xiang et al. , 2020 ; Wei et al. , 2018 ; Dubey et al. , 2019 ) , timing information ( Duddu et al. , 2018 ) and memory/cache access ( Hu et al. , 2020 ; Hong et al. , 2019 ; Hua et al. , 2018 ; Yan et al. , 2020 ) . These methods placed a malware process on the machine hosting the black-box model . Our threat model does not involve introducing processes on the host . Recently , Batina et al . ( 2019 ) exploited EM radiation for network model extraction . They focused on EM radiation from embedded processors . In contrast to GPUs , embedded processors emit a relatively weak EM signal , necessitating delicate measurement devices and even mechanical opening of the chip package . Our advance . All these previous works are demonstrated on shallow networks ( e.g. , fewer than 20 layers ) . It remains unclear whether these methods can also extract deep network models , ones that are structurally more complex and more prevalent in practice . We demonstrate successful recovery of the full structure of deep networks , such as RetNet101 ( He et al. , 2016 ) . With that , we hope to raise awareness of the GPU ’ s EM radiation as an information-rich , easily-probed side channel . 2 MAGNETIC SIGNALS FROM GPUS . Before getting into the weeds , let us provide our intuition : we think of the magnetic signal as the GPU ’ s “ speech. ” The GPU speaks a series of “ words , ” demarcated by silence . Each word names the computational step that was executed . Let us now refine this explanation further , and ground it in physical principles . We use step to refer to performing a specific kind of network operation , such as a linear operation , batch normalization , pooling , activation function , etc . A layer is a sequences of steps , e.g. , a ( i ) linear operation , then ( ii ) pooling , then ( iii ) activation . While there may be data dependencies between steps , there are no such dependencies within a step . The parallel nature of GPU computation lends itself to a natural implementation of networks , wherein each step is executed in parallel , i.e. , single instruction multiple data ( SIMD ) parallelism . Transitions between steps , however , are synchronized ( Buck , 2007 ) : in our example above , activation begins only after pooling completes . This cross-step synchronization allows for implementations structured into modules , or GPU kernels . This modular approach is employed in widely-used deep learning frameworks such as PyTorch and TensorFlow ( Paszke et al. , 2019 ; Abadi et al. , 2016 ) . Signal . Kernel execution demands transistor flips , which place electric load on the GPU processor , in turn emitting magnetic flux from its power cable . An induction sensor measures this flux and produces proportional voltage . The time-varying voltage is our acquired signal ( see Fig . 1 ) . Different steps correspond to different GPU kernels , transistor flips , electric loads , and signal characteristics , which are distinguished even by the naked eye ( see Fig . 1 ) . Cross-step synchronization involves idling , dramatically reducing electric load and signal level ( see Fig . 1 ) . These rapid sharp drops demarcate steps . We observe that signal strongly correlates to the kind of GPU operations , rather than the specific values of computed floating point numbers . We verify this by examining signals using both PyTorch and TensorFlow and on multiple kinds of GPUs ( see Sec . 5 ) . The signal is also affected by the input to the network . Although the specific input data values do not influence the signal , the input data size does . When the GPU launches a network , the size of its single input ( e.g. , image resolution ) is fixed . But the network may be provided with a batch of input data ( e.g. , multiple images ) . As the batch size increases , more GPU cores will be utilized in each step . The GPU consequently draws more power , which in turn strengthens the signal . Once all GPU cores are involved , further increase of input batch size will not increase the signal strength , but elongate the execution time until the GPU runs out of memory . Therefore , in launching a query to the black-box network model , the adversary should choose a batch size sufficiently large to activate a sufficient number of GPU cores to produce a sufficient signal-to-noise ratio . We find that the range of the proper batch sizes is often relatively large ( e.g. , 64 ∼ 96 for ImageNet networks ) , loosely depending on the size of the single input ’ s features and the parallel computing ability of the GPU . In practice , the adversary can choose the batch size by experimenting with their own GPUs under various image resolutions . Notably however , we do not require knowledge of batch size to robustly recover network topology ( as opposed to hyperparameters ) , only that the batch size is sufficiently large enough to provide a clear signal . While we used a consumer friendly sensor with limited sampling rate ( see 4.1 ) and corresponding signal-to-noise ratio ( SNR ) , a sensor with high sampling rate and SNR would correspondingly require a smaller minimum batch size . 3 SIGNAL ANALYSIS AND NETWORK RECONSTRUCTION . We prepare for the attack by training several recovery DNN models ; we refer to training before the attack as pretraining . After the attacker launches a batch query ( whose input and output values are irrelevant ) we recover structure from the acquired signal in two stages : ( i ) topology and ( ii ) hyperparameters . To recover topology , a pretrained DNN model associates a step to every signal sample . This per-sample classification partitions the signal into segments corresponding to steps . We estimate hyperparameters for each individual segment in isolation , using a step-specific pretrained DNN model , and resolve inconsistencies between consecutive segments using an integer program . The pretraining of our recovery DNN models is hardware-specific , and good recovery requires pretraining on like hardware .

Summary: This paper demonstrates that magnetic side channel information from a GPU (that is processing a deep neural net) can be snooped to recover the architecture and hyperparameters of the neural network. While the concept of side channel information snooping to recover codes/software (including ML models) is widely studied, the novelty claim is that recovering detailed structures of deep models is new. The paper also demonstrates that black-box attacks mounted using a recovered model is quite powerful compared to traditional black-box attacks.