How to 0wn the NAS in Your Spare Time

1 INTRODUCTION . To continue outperforming state-of-the-art results , research in deep learning ( DL ) has shifted from manually engineering features to engineering DL systems , including novel data pre-processing pipelines ( Raff et al. , 2018 ; Wang et al. , 2019 ) and novel neural architectures ( Cai et al. , 2019 ; Zoph et al. , 2018 ) . For example , a recent malware detection system MalConv , with a manually designed pipeline that combines embeddings and convolutions , achieves 6 % better detection rate over previous state-of-the-art technique without pre-processing ( Raff et al. , 2018 ) . In addition to designing data pre-processing pipelines , other research efforts focus on neural architecture search ( NAS ) —a method to automatically generate novel architectures that are faster , more accurate and more compact . For instance , the recent work of ProxylessNAS ( Cai et al. , 2019 ) can generate a novel architecture with 10 % less error rate and 5x fewer parameters than previous state-of-the-art generic architecture . As a result , in the industry such novel DL systems are kept as trade secrets or intellectual property as they give their owners a competitive edge ( Christian & Vanhoucke , 2017 ) . These novel DL systems are usually costly to obtain : generating the NASNet architectures ( Zoph et al. , 2018 ) takes almost 40K GPU hours and the MalConv authors had to test a large number of failed designs in the process of finding a successful architecture . As a result , an adversary who wishes to have the benefits of such DL systems without incurring the costs has an incentive to steal them . Compared to stealing a trained model ( including all the weights ) , stealing the architectural This work was done when Michael Davinroy was a research intern at the Maryland Cybersecurity Center . details that make the victim DL system novel provides the benefit that the new architectures and pipelines are usually applicable to multiple tasks . Training new DL systems based on these stolen details still provides the benefits , even when the training data is different . After obtaining these details , an attacker can train a functioning model , even on a different data set , and still benefit from the stolen DL system ( So et al. , 2019 ; Wang et al. , 2019 ) . Further , against a novel system , stealing its architectural details increases the reliability of black-box poisoning and evasion attacks ( Demontis et al. , 2019 ) . Moreover , stealing leads to threats such as Camouflage attacks ( Xiao et al. , 2019 ) that trigger misclassifications by exploiting the image scaling algorithms that are common in DNN pre-processing pipelines . The emerging Machine-Learning-as-a-Service ( MLaaS ) model that offers DL computation tools in the cloud makes remote hardware side-channel attacks a practical vector for stealing DL systems ( Liu et al. , 2015 ) . Unlike prior stealing attacks , these attacks do not require physical proximity to the hardare that runs the system ( Batina et al. , 2019 ; Hua et al. , 2018 ) or direct query access to train an approximate model ( Tramèr et al. , 2016 ) . Cache side-channel attacks have especially been shown as practical in cloud computing for stealing sensitive information , such as cryptographic keys ( Liu et al. , 2015 ) . Cache side-channel attacks are ubiquitous and difficult to defeat as they are inherent to the micro architectural design of modern CPUs ( Werner et al. , 2019 ) . In this paper , considering the incentives to steal a novel DL system and applicability of cache sidechannel attacks in modern DL settings , we design a practical attack to steal novel DL systems by leveraging only the cache side-channel leakage . Simulating a common cloud computing scenario , our attacker has a co-located VM on the same host machine as the victim DL system , and shares the last-level cache with the victim ( Liu et al. , 2015 ) . As a result , even though the VMs are running on separate processor cores , the attacker can monitor the cache accesses a DL framework—PyTorch or TensorFlow—makes while the victim system is running ( Liu et al. , 2015 ) . The first step of our attack is launching a cache side-channel attack , Flush+Reload ( Yarom & Falkner , 2014 ) , to extract a single trace of victim ’ s function calls ( Section 3 ) . This trace corresponds to the execution of specific network operations a DL framework performs , e.g. , convolutions or batch-normalizations , while processing an input sample . However , the trace has little information about the computational graph , e.g. , the layers , branches or skip connections , or the architectural parameters , e.g. , the number of filters in a convolutional layer . The limited prior work on side-channel attacks against DL systems assumed knowledge of the architecture family of the victim DNN ( Yan et al. , 2018 ; Duddu et al. , 2018 ) ; therefore , these attacks are only able to extract variants of generic architectures , such as VGG ( Simonyan & Zisserman , 2015 ) or ResNet ( He et al. , 2016 ) . To overcome this challenge , we also extract the approximate time each DL operation takes , in addition to the trace , and we leverage this information to estimate the architectural parameters . This enables us to develop a reconstruction algorithm that generates a set of candidate graphs given the trace and eliminates the incompatible candidates given the parameters ( Section 4 ) . We apply our technique to two exemplar DL systems : the MalConv data pre-processing pipeline and a novel neural architecture produced by ProxylessNAS . Contributions . We design an algorithm that reconstructs novel DL systems only by extracting cache side-channel information , that leaks DL computations , using Flush+Reload attack . We show that Flush+Reload reliably extracts the trace of computations and exposes the time each computational step takes in a practical cloud scenario . Using the extracted information , our reconstruction algorithm estimates the computational graph and the architectural parameters . We demonstrate that our attacker can reconstruct a novel network architecture found from NAS process ( ProxylessNAS ) and a novel manually designed data pre-processing pipeline ( MalConv ) with no reconstruction error . We demonstrate the threat of practical stealing attacks against DL by exposing that the vulnerability is shared across common DL frameworks , PyTorch and TensorFlow . 2 BACKGROUND . Here , we discuss prior efforts in both crafting and stealing network architectures . There is a growing interest in crafting novel DL systems as they significantly outperform their generic counterparts . The immense effort and computational costs of crafting them , however , motivates the adversaries to steal them . Effort to Design Deep Learning Systems . Creating deep learning systems traditionally takes the form of human design through expert knowledge and experience . Some problems require novel designs to manipulate the input in a domain-specific way that DNNs can process more effectively . For example , MalConv malware detection system ( Raff et al. , 2018 ) uses a manually designed preprocessing pipeline that can digest raw executable files as a whole . Pseudo LIDAR ( Wang et al. , 2019 ) , by pre-processing the output of a simple camera sensor into a LIDAR-like representation , achieves four times better object detection accuracy than previous state-of-the-art technique . Moreover , recent work also focuses on automatically generating optimal architectures via neural architecture search ( NAS ) . For example , reinforcement learning ( Zoph & Le , 2016 ) or gradient-based approaches ( Cai et al. , 2019 ) have been proposed for learning to generate optimal architectures . Even though NAS procedures have been shown to produce more accurate , more compact and faster neural networks , the computational cost of the search can be an order of magnitude higher than training a generic architecture ( Zoph et al. , 2018 ) . Effort to Steal Deep Learning Systems . Prior work on stealing DNN systems focus on two main threat models based on whether the attacker has physical access to the victim ’ s hardware . Physical access attacks have been proposed against hardware accelerators and they rely on precise timing measurements ( Hua et al. , 2018 ) or electromagnetic emanations ( Batina et al. , 2019 ) . These attacks are not applicable in the cloud setting we consider . The remote attacks that are applicable in the cloud setting , on the other hand , have limitation of requiring precise measurements that are impractical in the cloud ( Duddu et al. , 2018 ) . Further , the attack without this limitation ( Hong et al. , 2018 ) requires the attacker to know the family the target architecture comes from ; thus , it can not steal novel architectures . In our work , we design an attack to reconstruct novel DL systems by utilizing a practical cache side-channel attack in the cloud setting . 3 EXTRACTING THE SEQUENCE OF COMPUTATIONS VIA FLUSH+RELOAD . 3.1 THREAT MODEL . We consider an attacker who aims to steal the key components in a novel DL system , i.e. , a novel pre-processing pipeline or a novel network architecture . We first launch a Flush+Reload ( Yarom & Falkner , 2014 ) attack to extract cache side-channel information leaked by DL computation . Our target setting is a cloud environment , where the victim ’ s DL system is deployed inside a VM—or a container—to serve the requests of external users . Flush+Reload , in this setting , is known to be a weak , and practical , side-channel attack ( Liu et al. , 2015 ) . Further , as in MLaaS products in the cloud , the victim uses popular open-source DL frameworks , such as PyTorch ( Benoit Steiner , 2019 ) or TensorFlow ( Abadi et al. , 2016 ) . Capabilities . We consider an attacker that owns a co-located VM—or a container—in the same physical host machine as the victim ’ s system . Prior work has shown that spinning-up the co-located VM in the third-party cloud computing services does not require sophisticated techniques ( Ristenpart et al. , 2009 ; Zhang et al. , 2011 ; Bates et al. , 2012 ; Kohno et al. , 2005 ; Varadarajan et al. , 2015 ) . Due to the co-location , the last-level cache ( L3 cache ) in the physical host is shared between multiple cores where the attacker ’ s and victim ’ s processes are ; thus , our attacker can monitor the victim ’ s computations leaked at the L3 cache . We also note that , even if the victim uses GPUs , our attacker can still observe the same computations used for CPUs via cache side-channels ( see Appendix A ) . Knowledge . We consider our attacker and the victim use the same version of the same open-source DL framework . This is realistic , in MLaaS scenarios such as AWS SageMaker or Google Cloud ’ s AutoML , as cloud providers recommend practitioners to use the common frameworks to construct their systems . These common practices also allow our attacker to reverse-engineer the frameworks offline and identify the lines of code to monitor with the Flush+Reload technique . For example , AWS provides convenient deployment options for both PyTorch and TensorFlow : https : //docs . aws.amazon.com/sagemaker/latest/dg/pytorch.html , and https : //docs.aws.amazon.com/sagemaker/latest/dg/tf.html . 3.2 FLUSH+RELOAD MECHANISM . Flush+Reload allows an adversary to continually monitor victim ’ s instruction access patterns by observing the time taken to load them from memory . This technique is effective to extract the computation flow of the victim ’ s program when the attacker and victim share memory ( i.e. , a shared library or page deduplication ( Bosman et al. , 2016 ) ) . The attacker flushes specific lines of code in a shared DL framework from the co-located machine ’ s cache-hierarchy and then measure the amount of time it takes to reload the lines of code . If the victim invokes the monitored line of code , the instruction will be reloaded into the shared cache , and when the attacker reloads the instruction , the access to it will be noticably faster . On the other hand , if the victim does not call the monitored line of code , the access to it will be slower because the instruction needs to be loaded from main memory ( DRAM ) . By repeating this process , our attacker can tell when a victim has accessed a line of code .

Summary: This paper proposes a way to attack and reconstruct a victim's neural architecture that is co-located on the same host. They do it through cache side-channel leakage and use Flush+Reload to extract the trace of victim's function call, which tells specific network operations. To recover the computational graph, they use the approximate time each operation takes to prune out any incompatible candidate computation graph. They show that they can reconstruct exactly the MalConv and ProxylessNAS.