Private Image Reconstruction from System Side Channels Using Generative Models

1 INTRODUCTION . Side channel analysis ( SCA ) recovers program secrets based on the victim program ’ s nonfunctional characteristics ( e.g. , its execution time ) that depend on the values of program secrets . SCA constitutes a major threat in today ’ s system and hardware security landscape . System side channels , such as CPU cache accesses and operating system ( OS ) page table accesses made by the victim software , are widely used to recover program secrets under various real-world scenarios ( Gullasch et al. , 2011 ; Aciicmez & Koc , 2006 ; Wu et al. , 2012 ; Hähnel et al. , 2017 ; Xu et al. , 2015 ; Yarom et al. , 2017 ) . To conduct SCA , attackers first conduct an online phase to log a trace of side channel data points made by the victim software ( e.g. , its accessed CPU cache lines ) . Then , attackers launch an offline phase to analyze the logged trace and infer secrets ( e.g. , private inputs ) . Enabled by advances in system research , the online phase can be performed smoothly ( Xu et al. , 2015 ) . Nevertheless , the offline phase is challenging , requiring comprehension of victim software ’ s input-relevant operations and how such operations influence side channels . The influence is program-specific and obscure ( see an example in Fig . 1 ) . Even worse , side channel data points made by real-world software are usually highly noisy . For instance , executing libjpeg ( libjpeg , 2020 ) to decompress one unknown JPEG image produces a trace of over 700K side channel data points , where only a small portion depends on the image content . Identifying such input-dependent data points from over 700K records is extremely difficult . Launching SCA to recover images processed by media software constitutes a common threat in the era of cloud computing ( Xu et al. , 2015 ; Hähnel et al. , 2017 ) , especially when machine learning as a service ( MLaaS ) is substantially offered ( e.g. , for face recognition ) . When envisioning the high ∗Corresponding Author risk of violating user privacy , there is a demanding need to understand the adversarial capability of reconstructing private images with SCA . To date , the offline inference phase of existing SCA attacks requires lots of manual efforts with heuristics ( Xu et al. , 2015 ; Hähnel et al. , 2017 ) . While some preliminary studies explore to use AI models to infer secrets ( Hospodar et al. , 2011 ; Kim et al. , 2019 ; Cagli et al. , 2017 ; Hettwer et al. , 2018 ) , their approaches are primarily driven by classification , i.e. , predicting whether a particular bit of crypto key is 0 or 1 . In contrast , reconstructing user private images requires to synthesize and enhance images from a more holistic perspective . Recent advances in generative models , such as generative adversarial network ( GAN ) and variational autoencoder ( VAE ) , have enabled a major thrust in image reconstruction , given subtle signals in even cross-modal settings , e.g. , voice-to-face or text-to-image ( Radford et al. , 2016 ; Reed et al. , 2016 ; Wen et al. , 2019 ; Hong et al. , 2018b ) . Inspired by this breakthrough , we propose an SCA framework using generative models . Given a trace of side channel data points made by image analysis software ( e.g. , libjpeg ) when processing a user input , we reconstruct an image visually similar to the input . Each logged side channel trace , containing around a million records , is first encoded into a matrix and pre-processed by a convolutional neural network ( CNN ) for feature extraction . Then , a VAE network with a learned prior ( referred to as VAE-LP ) is employed to reconstruct an image with a holistic visual appearance . We further supplement VAE-LP with a GAN model to enhance the recovered image with vivid details . The GAN generator yields the final output . Our attack exploits media libraries , libjpeg ( libjpeg , 2020 ) and uPNG ( Middleditch , 2010 ) , using two popular side channels , CPU cache line accesses and OS page table accesses . Our attack is independent of the underlying computing infrastructure ( i.e. , OS , hardware , image library implementation ) . We require enough side channel logs for training , which is consistently assumed by previous works ( Heuser & Zohner , 2012 ; Maghrebi et al. , 2016 ) . While existing attacks particularly target libjpeg and leverage domain knowledge , system hacking , and manual efforts to infer pixel values ( Xu et al. , 2015 ; Hähnel et al. , 2017 ) , we show that images with many details can be reconstructed in an end-to-end manner . We also show surprising results that enabled by our framework , side channel traces composing one-bit data read/write patterns , which prima facie seems minimally informative , suffice recovering images . We conduct qualitative and quantitative evaluations on specific and general datasets representing daily images that can violate privacy if leaked . The recovered images manifest consistent visual appearances with private inputs . The recovered images also exhibit high discriminability : each recovered image ( e.g. , a face ) can be matched to its reference input among many candidates with high accuracy . In summary , we make the following contributions : At the conceptual level , we present the first generative model-based SCA . Our novel approach learns how program inputs influence system side channels from historical side channel logs to reconstruct user private images automatically . We , for the first time , demonstrate surprisingly effective attacks toward even low-resolution side channels like one-bit data read/write access patterns . At the technical level , we design an effective framework by incorporating various design principles to facilitate image reconstruction from side channels . Our framework pipelines 2D CNN , VAE-LP , and GAN models to systematically enhance the quality of generated images . At the empirical level , our evaluations show that the proposed framework can generate images with vivid details and are closely similar to reference inputs . The reconstructed images show high discriminability , making privacy leakage attacks more practical . This is the first paper to conduct SCA with generative models , revealing new SCA opportunities and unknown threats . Our code is at https : //github.com/genSCA/genSCA . 2 BACKGROUND . To formulate SCA , let the attacked program be P and its input domain be I . For a deterministic and terminating program P , the program execution can be modeled as a mapping P : I → E where E represents program runtime behavior ( e.g. , memory access ) . As a common assumption ( Hähnel et al. , 2017 ) , program inputs are private and profitable for attackers . Since different inputs i , i′ ∈ I can likely induce different e , e′ ∈ E , using input-dependent e ∈ E enables to infer i . Modern computer architectures have primarily zeroed the possibility for adversaries to log e ∈ E. Nevertheless , an attacker ’ s view on P can be modeled as a function view : E → O that maps E to side channel observations O . Hence , the composition ( view ◦ P ) : I → O maps inputs to side channel data points that can be logged by attackers . The view indicates the attacker ’ s capability , and for typical system security scenarios , the view is formulated as view : Emem → Ocache ∪ Opage , where Emem denotes a trace of accessed memory locations when executing P with i , and Ocache andOpage represent CPU cache and OS page table side channels , respectively . Despite being unable to monitor Emem , attackers can log accessed cache lines Ocache or page table entries Opage derived from Emem . Attackers then infer Emem and recover i . We now concretize the procedure by introducing how SCA is used to exploit cloud platforms in a two-step approach as follows : Online Phase to Record O . Considering a cloud environment in Fig . 1 ( a ) , where two users , one normal and one malicious , deploy two virtual machine ( VM ) instances on the host . Private images i ∈ I uploaded by users are processed by media library P within the left VM . Modern computer design , e.g. , Intel SGX ( Intel , 2014 ) , guarantees that i ∈ I and the execution of P can not be viewed from outside the VM . However , when processing i , P usually imposes a large volume of CPU cache and page table accesses , which , as shown in Fig . 1 ( a ) , can be recorded by the co-located malicious VM or the malicious host OS in a fully automated manner ( Han et al. , 2017 ; Chiang et al. , 2015 ; Liu et al. , 2015a ; Xu et al. , 2015 ; Hähnel et al. , 2017 ) . Offline Phase to Infer i . Once side channel traces o ∈ O are collected , an offline phase is conducted to infer ( view ◦P ) −1 : O → I and recover i . Fig . 1 ( b ) presents a sample code , where depending on values of input i , different memory locations ( and cache lines ) will be visited . Fig . 1 ( c ) shows the corresponding trace of logged cache side channel records . To infer i , attackers eliminate the second record ( since it is input-independent ) , and infer i as 1 according to the first record . Attackers anticipate to 1 ) pinpointing a subset of records o∗ ⊆ o that depend on i , and to 2 ) recovering the mapping from o∗ to i . However , real-world side channel traces ( e.g. , generated by uPNG ) could contain over one million records , where only a tiny portion o∗ is input-dependent . Even worse , constructing the mapping between i and o∗ requires a deep understanding of program control flows ( e.g. , how i affects program execution and induces cache accesses in Fig . 1 ( b ) ) . To date , these tasks require either manual effort ( Xu et al. , 2015 ; Hähnel et al. , 2017 ) or formal analysis ( Doychev et al. , 2013 ; Wang et al. , 2017 ; 2019 ) , which are program-specific and error-prone with low scalability . Existing research tackles the offline phase challenge by proposing profiling-based SCA ( Maghrebi et al. , 2016 ; Hettwer et al. , 2018 ; Kim et al. , 2019 ) , where models are trained to approximate ( view◦ P ) −1 : O → I . However , existing work focuses on predicting particular bits of crypto keys from succinct side channel traces , e.g. , a few hundred records ( Hettwer et al. , 2020 ) . In contrast , this is the first work shows that by incorporating generative models , SCA can be conducted to exploit real-world media libraries and holistically reconstruct high-quality and discriminable images . 3 THE PROPOSED FRAMEWORK . A common assumption shared by SCA ( Heuser & Zohner , 2012 ; Hähnel et al. , 2017 ; Xu et al. , 2015 ) is that the attackers can profile the victim software locally or remotely with training inputs and collect corresponding side channel traces . We train a model to learn how different inputs can influence side channel traces . Then , given a side channel trace logged when processing an unknown image , our framework reconstructs an image that is visually similar to the unknown input . Our framework has two pipelined modules ( see Fig . 2 ) . Given a side channel trace Ti corresponding to processing an image i , we first encode Ti into a matrix . The encoded matrix will be fed to the VAE-LP module to generate image îtrace , and we further use GAN to denoise îtrace and yield the final output îGAN . We now elaborate on each module . More details are given in Appendix B .

Summary: The authors present a framework that uses a combination of   VAE and GAN to recover private user images using Side channel analysis of memory access . A VAE-LP model first reconstructs a coarse image from side channel information which is reshaped and processed using a convolutional network. The output of the VAE-LP model is refined using a GAN to add fine details. Compelling results are demonstrated for recovery of private information and state of art metrics are reported.