NASPY: Automated Extraction of Automated Machine Learning Models

1 INTRODUCTION . Recently Automated Machine Learning ( AutoML ) has attracted lots of attention from the machine learning community , as it can significantly simplify the development of machine learning pipelines with high efficiency and automation . One of the most popular AutoML techniques is Neural Architecture Search ( NAS ) ( Zoph & Le , 2016 ; Elsken et al. , 2019 ) , which can automatically generate high-quality Deep Neural Networks ( DNNs ) for a specified task . It enables non-experts to produce machine learning architectures and models which can outperform hand-designed solutions . From the adversarial perspective , this paper aims to design new attacks to steal the architectures of black-box NAS models . This is known as model extraction attacks , which could cause severe consequences : ( 1 ) searching a good architecture with NAS is an energy- and time-consuming process . Hence the produced architecture is naturally considered as an important intellectual property , and stealing it can lead to copyright violation and financial loss ( Hong et al. , 2020 ) . ( 2 ) Extracting the model architecture can facilitate other black-box attacks , e.g. , data poisoning ( Demontis et al. , 2019 ) , adversarial examples ( Ilyas et al. , 2018 ) , membership inference ( Shokri et al. , 2017 ) . One solution of model extraction is to remotely query the target model and recover the architecture based on the responses ( Oh et al. , 2019 ) . However , such attack requires large computation cost and can only be applied to simple neural networks1 . Then we turn to a more promising solution : hardware attacks ( e.g. , cache side-channel , bus snooping ) . Essentially , when a DNN model executes the inference task on a computer , it leaves architecture-dependent footprints on the low-level hardware components , which could be captured by an adversary to analyze and recover the high-level architecture details . These techniques can give very fine-grained information , and have been utilized by prior works ( Yan et al. , 2020 ; Hua et al. , 2018 ; Naghibijouybari et al. , 2018 ; Hu et al. , 2020 ) to extract the architectures of conventional DNN models . However , there are several challenges when we apply such attack techniques to extract NAS architectures . ( 1 ) These works can only handle simple operations in conventional models , while failing to analyze new operations introduced by NAS ( e.g. , separable convolution , dilated convolution ) . ( 2 ) Some works need complicated manual analysis with prior knowledge of the victim model . For instance , ( Yan et al. , 2020 ) requires the information of the victim model family , and can only extract variants of generic architectures . ( Naghibijouybari et al. , 2018 ) needs to know the layer type ahead . 1It takes 40 GPU-days to recover a 7-layer architecture with a simple chained topology ( Oh et al. , 2019 ) . To the best of our knowledge , there is only one work ( Hong et al. , 2020 ) focusing on the extraction of NAS models , which is not very practical or general . ( 1 ) This work mainly monitors the API traces in the high-level deep learning library , which requires the attacker and victim to share the same library with exactly the same version . This is not practical since users may use different libraries , especially their customized ones . ( 2 ) It needs the accurate dimension estimation to predict the layer type and model topology , which is hard to obtain in the real world . ( 3 ) The NAS model considered in this work is too small and simple , which can not well represent state-of-the-art NAS techniques . We propose NASPY , a learning-based framework for automated extraction of NAS architectures with high efficiency and fidelity . We make several contributions to overcome the above limitations . First , we exploit cache side-channel techniques to monitor the low-level BLAS library . Hence , the framework can be applied to different platforms regardless of the high-level deep learning libraries ( Tensorflow , Pytorch , or other customized libraries ) . This can not be achieved in ( Hong et al. , 2020 ) . Second , we model the extraction attack as a sequence-to-sequence problem , and design new deep learning models to predict the model operation sequence automatically . This does not require the tedious manual analysis , as conducted in ( Yan et al. , 2020 ) . Meanwhile , the models are able to predict new sophisticated operations in NAS , which are missing in ( Yan et al. , 2020 ; Hu et al. , 2020 ) . Third , we propose a new analysis method to precisely recover the exact hyper-parameters without any prior knowledge . In contrast , previous works can only estimate a possible range of hyperparameter values ( Yan et al. , 2020 ; Hu et al. , 2020 ) . Finally , we design strategies to reconstruct the model topology and extract the complete architecture for different scenarios and adversarial goals . We perform extensive experiments to demonstrate the effectiveness of NASPY . Our identification model can predict the operation sequences of different NAS methods ( DARTS ( Liu et al. , 2018 ) , GDAS ( Dong & Yang , 2019 ) and TE-NAS ( Chen et al. , 2021 ) ) with an error rate of 3.2 % . Our hyper-parameter prediction can achieve more than 98 % accuracy . The framework also demonstrates high robustness against random noise introduced by the complex and dynamic hardware systems . To engage the community , we will release the source code of our framework . 2 BACKGROUND . Neural Architecture Search ( NAS ) . This promising autoML technology can systematically generate a good network architecture for a given task and dataset ( Zoph & Le , 2016 ; Elsken et al. , 2019 ) . It defines a search space as the scope of neural networks in consideration , from which it finds the best architecture with different types of search strategies ( Zoph & Le , 2016 ; Real et al. , 2019 ; Liu et al. , 2018 ) . To reduce the search complexity and cost , a neural network is decomposed into multiple cells ( Chen et al. , 2021 ) . A cell can be represented as a Directed Acyclic Graph , where each edge represents a connection between two neural nodes that is associated with an operation selected from a predefined operation set ( Dong & Yang , 2020 ) . A NAS architecture normally has two types of cells : a normal cell computes the feature maps and a reduction cell reduces the spatial size . Multiple normal cells construct a block , and multiple blocks are interconnected by reduction cells to form the final model . Compared to traditional neural networks , NAS adopts some sophisticated operations among the neural nodes , like dilated convolutions and separable convolutions . Hardware attacks . Following the previous works ( Yan et al. , 2020 ; Hong et al. , 2020 ; Hu et al. , 2020 ) , we aim to exploit some hardware attacks to perform the extraction of NAS models . Specifically , we consider the following two attacks . Cache side-channel attacks : CPU caches are introduced between the CPU cores and main memory to accelerate the memory access . Since the attacker can share the same cache with the victim , he can reveal the behavior pattern of the victim from the contention on the usage of cache lines . In this paper , we adopt FLUSH-RELOAD , which is also used in ( Yan et al. , 2020 ; Hong et al. , 2020 ) for model extraction . The adversary leverages the shared low-level BLAS library to infer the victim model , and is able to obtain the sequence of its critical operations , e.g. , the matrix multiplication . Bus snooping attack : data traffic between the processor and memory system is achieved through a bus , which sends data to or loads data from specific addresses . Hence , by observing the memory traffic through the bus , the attacker can obtain the memory address traces of the victim model , which further reveals the connections between model layers . In this paper , we use the bus snooping technique ( Huang et al. , 2014 ) to monitor the read/write addresses of each model layer , which is also adopted in ( Hu et al. , 2020 ) . The adversary can only observe the data addresses and can not access the data passing through buses , which allows NASPY to work even when the model is encrypted . Sequence-to-sequence learning . Seq2seq learning is raising increased attention in the machine learning community , and becomes quite popular for different tasks like speech recognition ( Amodei et al. , 2016 ) , machine translation ( Neubig , 2017 ) , image captioning ( Islam et al. , 2019 ) , question answering ( Palasundram et al. , 2020 ) , etc . Three models are mostly used for seq2seq learning : Recurrent Neural Network ( RNN ) , Connectionist Temporal Classification ( CTC ) , and attention models ( Transformer ) . In this paper , we aim to use seq2seq learning for automated model extraction from the monitored memory activities . We design an RNN-CTC model and a Transformer model to recover the structure operations of NAS models . 3 FRAMEWORK OVERVIEW . 3.1 THREAT MODEL . Adversary ’ s goal . Given a victim model M constructed from NAS , the adversary aims to recover a similar network architecture as M , without searching it with large cost and the original dataset . We consider two types of goals following ( Jagielski et al. , 2020 ) : ( 1 ) accuracy extraction : the adversary aims to reproduce a network architecture , which can give similar model accuracy as the victim model ; ( 2 ) fidelity extraction : the adversary wishes to recover the same architecture and hyper-parameters as the victim one . Adversary ’ s capability . We consider two practical scenarios for extracting model architectures . For each scenario , we assume the attacker only knows the target model is from NAS , without any other prior knowledge , e.g. , the model family , layer type , NAS method , high-level deep learning library . • Remote attack : model extraction in this scenario is adopted in ( Yan et al. , 2020 ; Hong et al. , 2020 ) . The attacker can launch his malicious program on the same machine with the victim model . Although these programs are isolated by the OS or hypervisor , the attacker can still exploit the cache side-channel technique to monitor the victim ’ s low-level executions , e.g. , the sequence of matrix multiplication events . Based on the side-channel sequence , the attacker is able to perform accuracy extraction of the victim model . • Local attack : this scenario is considered in ( Hu et al. , 2020 ) , where the attacker can physically access the machine running the victim model . In addition to launching the cache side-channel attack to retrieve the operation sequence , the attacker can also launch the bus snooping attack to monitor the memory bus and PCIe events . With such memory address traces , the attacker can achieve fidelity extraction of the victim model and recover the exact model topology . 3.2 ATTACK OVERVIEW . Before describing our NASPY framework , we need to understand the workflow of the model inference process . As shown in the left diagram of Figure 1 , given a DNN model , a deep learning library ( e.g. , Tensorflow , Pytorch ) is used to process the computational graph of the model , and convert the model architecture into sequences of connected layer operations . Then these operation sequences are sent to low-level computation libraries for acceleration , such as the BLAS library ( e.g. , OpenBLAS ) for GEneral Matrix Multiplication ( GEMM ) , and the mathematical library ( e.g. , libm ) for activation functions . Those computations will be executed on the hardware platform . By monitoring the hardware activities using cache side-channel and bus snooping techniques , the attacker can observe the event sequences and memory address traces for the model inference process . Overview of NASPY . The adversary ’ s task is to automatically and precisely recover the NAS model architecture from the captured sequences of hardware activities . Figure 1 shows the workflow of our NASPY framework . It consists of three steps , as described below . First , it translates the event sequences from cache side-channel attacks to the operation sequences ( i.e. , input of the low-level computation library ) . We model this as a seq2seq problem , and design two deep learning models ( RNN-CTC and Transformer ) to achieve this prediction . Second , it identifies the values of hyper-parameters in the layer operations recovered from the first step . Previous works ( Hu et al. , 2020 ) can only estimate a range of these values based on the dimension size of layer input and output . In contrast , NASPY can precisely reveal the exact values of the hyper-parameters from the translated operation sequence . Third , NASPY reconstructs the model topology and obtains the complete architecture . For the accuracy extraction attack , the attacker can randomly select a model topology , and assign the recovered operations with the hyper-parameters to it . Our experiment results show that the corresponding model can give similar accuracy as the victim one . For the fidelity extraction attack , the attacker needs to recover the exact model topology . He can leverage the information in the memory address trace from the bus snooping attack to construct the architecture .

Summary: This paper presents an end-to-end adversarial framework to extract the network architecture obtained from Neural Architecture Search (NAS), named NASPY. Previous works focus on extracting conventional ConvNets with simple operations, while requiring heavy human analysis. In contrast, NASPY introduces a seq2seq network to automatically identify complicated operations from the hardware event sequence. In addition, both the value of hyper-parameters and the exact model topology can be obtained with NASPY. Extensive experiments based on DARTS, GDAS, and TE-NAS demonstrate the effectiveness of NASPY.