Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel

1 INTRODUCTION . The Graphics Processing Unit ( GPU ) is a favored vehicle for executing a neural network . As it computes , it also hums—electromagnetically . What can this hum tell us ? Could listening to the GPU ’ s electromagnetic ( EM ) radiation reveal details about the neural network ? We study this question and find that magnetic induction sensing reveals a detailed network structure , including both topology and hyperparameter values , from inferences of otherwise unknown networks running on GPUs . Reverse engineering a network structure has attracted increasing research effort , motivated by several concerns . First , it has been well known that the performance of a network model hinges on its judiciously designed structure—but finding an effective design is no easy task . Significant time and energy is expended in searching and fine-tuning network structures ( Zoph et al. , 2018 ) . Moreover , in industry , optimized network structures are often considered confidential intellectual property . It is therefore important to understand the extent to which this valuable , privileged information can be compromised . Worse yet , a reverse engineered “ surrogate ” model also makes the black-box “ victim ” model more susceptible to adversarial transfer attacks ( Papernot et al. , 2017 ; Liu et al. , 2016 ) , in which a vulnerability identified in the surrogate is exploited on the victim . Success in the exploit is contingent on the ability of the surrogate to successfully model the vulnerabilities of the victim . Recovering accurate , detailed network topology and hyperparameters informs the modeling of a good surrogate . We examine the fluctuation of magnetic flux from the GPU ’ s power cable , and ask whether a passive observer can glean the information needed to reconstruct neural network structure . Remarkably , we show that , through magnetic induction sensing , a passive observer can reconstruct the complete network structure even for large and deep networks . Threat model . We consider an adversary that ( i ) is able to place a magnetic induction sensor in close proximity to the GPU ’ s power cable , ( ii ) knows the dimension of the input feature vector , and ( iii ) is able to launch a query of known batch size . We also consider that our attacker uses the same deep learning framework ( e.g. , PyTorch , TensorFlow ) as the black-box model . The adversary is otherwise weak , lacking access to the model source , binaries , training data , and underlying training data distribution ; without ability to execute code on the host CPU and GPU ; and without knowledge of the input values and output results of the launched queries . Not only that—it also lacks direct access to the GPU hardware , beyond the proximity to the power cable . The adversary only requires access to their own GPU hardware , matching the brand/version of the victim , e.g. , as purchased on the open market . Physical principle . The GPU consumes energy at a variable rate that depends on operations performed . Every microprocessor instruction is driven by transistor electron flows , and different instructions require different power levels ( Grochowski & Annavaram , 2006 ) . The many compute cores of a GPU amplify the fluctuation in energy consumption , and so too the current drawn from the power cable . Current induces magnetic flux governed by the Biot-Savart law ( Griffiths , 2005 ) , and current fluctuations induce EM ripples whose propagation through the environment is governed by the Ampère-Maxwell law . Even a cheap , $ 3 magnetic induction sensor ( see Fig . 2 ) placed within a few millimeters of the power cable suffices to record these EM ripples . Technique and results . To reconstruct the black-box network ’ s structure , we propose a two-step approach . First , we estimate the network topology , such as the number and types of layers , and types of activation functions , using a suitably trained neural network classifier . Then , for each layer , we estimate its hyperparameters using another set of deep neural network ( DNN ) models . The individually estimated hyperparameters are then jointly optimized by solving an integer programming problem to enforce consistency between the layers . We demonstrate the potential accuracy of this side-channel attack in recovering the details for a wide range of networks , including large , deep networks such as ResNet101 . We further apply this recovery approach to demonstrate black-box adversarial transfer attacks . 1.1 RELATED WORK : MODEL EXTRACTION BY QUERIES AND SIDE-CHANNEL ANALYSIS . Our work falls under the umbrella of black-box model extraction . Absent access to the model ’ s internals , one might infer structure from observed input-output pairs . For instance , Tramèr et al . ( 2016 ) demonstrated that , for simple models such as decision trees and support vector machines hosted on a cloud , certain internal information can be extracted via a multitude of queries . This approach , which was extended to infer details of deep neural networks ( Oh et al. , 2019 ; Liu et al. , 2016 ; Duddu & Rao , 2019 ) , is typically able to recover certain information , such as optimization learning rate and network structure type , but has not demonstrated recovery of full structural details . A contrasting approach , side-channel analysis ( SCA ) , extracts information gained from the physical implementation of a model , rather than in the mathematical model itself . Analysis of timing ( Kocher , 1996 ) , power ( Kocher et al. , 1999 ; Luo et al. , 2015 ) , cache flushes ( Yarom & Falkner , 2014 ) , and audio ( Genkin et al. , 2014 ) have been prominently demonstrated to extract secret keys from cryptographic procedures such as the Digital Signature and Advanced Encryption Standards . SCA was recently used to infer machine learning models by observing power consumption profiles ( Xiang et al. , 2020 ; Wei et al. , 2018 ; Dubey et al. , 2019 ) , timing information ( Duddu et al. , 2018 ) and memory/cache access ( Hu et al. , 2020 ; Hong et al. , 2019 ; Hua et al. , 2018 ; Yan et al. , 2020 ) . These methods placed a malware process on the machine hosting the black-box model . Our threat model does not involve introducing processes on the host . Recently , Batina et al . ( 2019 ) exploited EM radiation for network model extraction . They focused on EM radiation from embedded processors . In contrast to GPUs , embedded processors emit a relatively weak EM signal , necessitating delicate measurement devices and even mechanical opening of the chip package . Our advance . All these previous works are demonstrated on shallow networks ( e.g. , fewer than 20 layers ) . It remains unclear whether these methods can also extract deep network models , ones that are structurally more complex and more prevalent in practice . We demonstrate successful recovery of the full structure of deep networks , such as RetNet101 ( He et al. , 2016 ) . With that , we hope to raise awareness of the GPU ’ s EM radiation as an information-rich , easily-probed side channel . 2 MAGNETIC SIGNALS FROM GPUS . Before getting into the weeds , let us provide our intuition : we think of the magnetic signal as the GPU ’ s “ speech. ” The GPU speaks a series of “ words , ” demarcated by silence . Each word names the computational step that was executed . Let us now refine this explanation further , and ground it in physical principles . We use step to refer to performing a specific kind of network operation , such as a linear operation , batch normalization , pooling , activation function , etc . A layer is a sequences of steps , e.g. , a ( i ) linear operation , then ( ii ) pooling , then ( iii ) activation . While there may be data dependencies between steps , there are no such dependencies within a step . The parallel nature of GPU computation lends itself to a natural implementation of networks , wherein each step is executed in parallel , i.e. , single instruction multiple data ( SIMD ) parallelism . Transitions between steps , however , are synchronized ( Buck , 2007 ) : in our example above , activation begins only after pooling completes . This cross-step synchronization allows for implementations structured into modules , or GPU kernels . This modular approach is employed in widely-used deep learning frameworks such as PyTorch and TensorFlow ( Paszke et al. , 2019 ; Abadi et al. , 2016 ) . Signal . Kernel execution demands transistor flips , which place electric load on the GPU processor , in turn emitting magnetic flux from its power cable . An induction sensor measures this flux and produces proportional voltage . The time-varying voltage is our acquired signal ( see Fig . 1 ) . Different steps correspond to different GPU kernels , transistor flips , electric loads , and signal characteristics , which are distinguished even by the naked eye ( see Fig . 1 ) . Cross-step synchronization involves idling , dramatically reducing electric load and signal level ( see Fig . 1 ) . These rapid sharp drops demarcate steps . We observe that signal strongly correlates to the kind of GPU operations , rather than the specific values of computed floating point numbers . We verify this by examining signals using both PyTorch and TensorFlow and on multiple kinds of GPUs ( see Sec . 5 ) . The signal is also affected by the input to the network . Although the specific input data values do not influence the signal , the input data size does . When the GPU launches a network , the size of its single input ( e.g. , image resolution ) is fixed . But the network may be provided with a batch of input data ( e.g. , multiple images ) . As the batch size increases , more GPU cores will be utilized in each step . The GPU consequently draws more power , which in turn strengthens the signal . Once all GPU cores are involved , further increase of input batch size will not increase the signal strength , but elongate the execution time until the GPU runs out of memory . Therefore , in launching a query to the black-box network model , the adversary should choose a batch size sufficiently large to activate a sufficient number of GPU cores to produce a sufficient signal-to-noise ratio . We find that the range of the proper batch sizes is often relatively large ( e.g. , 64 ∼ 96 for ImageNet networks ) , loosely depending on the size of the single input ’ s features and the parallel computing ability of the GPU . In practice , the adversary can choose the batch size by experimenting with their own GPUs under various image resolutions . Notably however , we do not require knowledge of batch size to robustly recover network topology ( as opposed to hyperparameters ) , only that the batch size is sufficiently large enough to provide a clear signal . While we used a consumer friendly sensor with limited sampling rate ( see 4.1 ) and corresponding signal-to-noise ratio ( SNR ) , a sensor with high sampling rate and SNR would correspondingly require a smaller minimum batch size . 3 SIGNAL ANALYSIS AND NETWORK RECONSTRUCTION . We prepare for the attack by training several recovery DNN models ; we refer to training before the attack as pretraining . After the attacker launches a batch query ( whose input and output values are irrelevant ) we recover structure from the acquired signal in two stages : ( i ) topology and ( ii ) hyperparameters . To recover topology , a pretrained DNN model associates a step to every signal sample . This per-sample classification partitions the signal into segments corresponding to steps . We estimate hyperparameters for each individual segment in isolation , using a step-specific pretrained DNN model , and resolve inconsistencies between consecutive segments using an integer program . The pretraining of our recovery DNN models is hardware-specific , and good recovery requires pretraining on like hardware .

Summary: The paper presents a method for capturing the shape (type of layers) and their respective parameters of a neural network through the magnetic field induced as the GPU drains power. In particular, the GPU is snooped using an off-the-shelf magnetic induction sensor which is placed along the power cable of the GPU. It turns out that under some assumptions (knowledge of GPU model and deep learning framework, knowledge of input size and ability to launch query of specific batch size), based on the correlation of the power consumption pattern of the GPU with the operations being performed it is possible to recognize the type of operation being performed as well as the respective hyper-parameters with very few errors.