멜트다운 취약점을 이용한 인공신경망 추출 공격
Extracting Neural Networks via Meltdown
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
클라우드 컴퓨팅 환경에서 기계학습 서비스를 제공하는 Machine-Learning-as-a-Service(MLaaS) 등이 활발히 개발됨에 따라 보다 다양한 분야에서 인공지능 기술을 손쉽고 효과적인 방법으로 활용할 수 있게 되었다. 클라우드 환경에서는 가상화 기술을 통해 각 사용자에게 논리적으로 독립된 컴퓨팅 공간을 제공하는데, 최근 시스템의취약점을 이용해 클라우드 테넌트(tenant) 사이에 다양한 부채널이 존재할 수 있다는 연구 결과가 발표되고 있다. 본 논문에서는 이러한 멀티-테넌시(multi-tenancy) 환경에서 멜트다운 취약점을 이용하여 딥러닝 모델의 내부 정보를 추출할 수 있는 현실적인 공격 시나리오를 제시한다. 이후 TensorFlow 딥러닝 서비스에 대한 실험을 통해92.875%의 정확도와 1.325kB/s의 속도로 인공신경망의 모든 정보를 추출할 수 있음을 보인다.
Abstract
Cloud computing technology plays an important role in the deep learning industry as deep learning services are deployed frequently on top of cloud infrastructures. In such cloud environment, virtualization technology provides logically independent and isolated computing space for each tenant. However, recent studies demonstrate that by leveraging vulnerabilities of virtualization techniques and shared processor architectures in the cloud system, various side-channels can be established between cloud tenants. In this paper, we propose a novel attack scenario that can steal internal information of deep learning models by exploiting the Meltdown vulnerability in a multi-tenant system environment. On the basis of our experiment, the proposed attack method could extract internal information of a TensorFlow deep-learning service with 92.875% accuracy and 1.325kB/s extraction speed.
참고문헌 (25)
- Lipp, M., "Meltdown: Reading kernel memory from user space", 27th USENIX Security Symposium, pp.973~990 (2018)
- Weisse, O., "Foreshadow-NG:Breaking the virtual memory abstraction with transient out-of-order execution" (2018)
- Schwarz, M., "ZombieLoad:Cross-privilege-boundary data sampling", Proceedings of the 2019ACM SIGSAC Conference on Computer and Communications Security, pp.753~768 (2019)
- Yarom, Y., "FLUSH+RELOAD: a high resolution, low noise, L3 cache side-channel attack", 23rd USENIX Security Symposium, pp.719~732 (2014)
- Moosavi-Dezfooli, S. M., "Deepfool: a simple and accurate method to fool deep neural networks", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.2574~2582 (2016)
- Fredrikson, M., "Model inversion attacks that exploit confidence information and basic countermeasures", Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp.1322~1333 (2015)
- Rossum, G.V., "Python tutorial", Amsterdam:Centrum voor Wiskunde en Informatica, 620 (1995)
- Zhang, Y., "Cross-tenant side-channel attacks in PaaS clouds", Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp.990~1003 (2014)
- Inci, M. S., "Co-location detection on the cloud", International Workshop on Constructive Side-Channel Analysis and Secure Design, pp.19~34 (2016), Springer
- Tramèr, F., "Stealing machine learning models via prediction apis", 25th USENIX Security Symposium, pp.601~618 (2016)
- Papernot, N., "Practical black-box attacks against machine learning", Proceedings of the 2017ACM on Asia conference on computer and communications security, pp.506~519 (2017)
- Jagielski, M., "High Accuracy and High Fidelity Extraction of Neural Networks", 29th USENIX Security Symposium (2020)
- Wang, B., "Stealing hyperparameters in machine learning", 2018 IEEE Symposium on Security and Privacy, pp.36~52 (2018)
- Wei, L., "I know what you see:Power side-channel attack on convolutional neural network accelerators", Proceedings of the 34th Annual Computer Security Applica-tions Conference, pp.393~406 (2018)
- Dong, G., "Floating-Point Multiplication Timing Attack on Deep Neural Network", 2019 IEEE International Conference on Smart Internet of Things, pp.155~161 (2019)
- Batina, L., "CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel", 28th USENIX Security Symposium, pp.515~532 (2019)
- Duddu, V., "Stealing neural networks via timing side channels", arXiv preprint, arXiv:1812.11720, ~ (2018)
- Wei, J., "Leaky DNN: Stealing Deep-learning Model Secret with GPU Context-switching Side-channel", 2020IEEE, 2020, ~
- Yan, M., "Cache Telepathy:Leveraging Shared Resource Attacks to Learn DNN Architectures", 29th USENIX Security Symposium, pp.2003~2020 (2020)
- "IEEE Signal Processing Magazine", 2012, 141~142
- Simonyan, K., "Very deep convolutional networks for large-scale image recognition", arXiv preprint, arXiv:1409.1556, ~ (2014)
- Goodrich, M.T., "Data structures and algorithms in Python" (2013), John Wiley & Sons Ltd
- Gruss, D., "Kaslr is dead: long live kaslr", International Symposium on Engineering Secure Software and Systems, pp.161~176 (2017), Springer
- "KPTI/KAISER Meltdown Initial Performance Regressions" (2018)[URL]
- Zhu, J., "CPU security benchmark", Proceedings of the 1st Workshop on Security-Oriented Designs of Computer Architectures and Processors, pp.8~14 (2018)