首次实现对复杂神经网络的高保真硬标签提取，突破传统攻击局限。
A Divide-and-Conquer Strategy for Hard-Label Extraction of Deep Neural Networks via Side-Channel Attacks
- 将复杂网络拆解为线性部分，结合侧信道与密码学方法分治攻击
- 在微控制器上成功提取含170万参数的MLP和精简MobileNetv1，准确率超93%
- 可生成近白盒级对抗样本，转移成功率接近原模型
过去十年中，深度神经网络（DNN）在多种任务中展现出巨大价值。然而，尽管其应用广泛且公开可得，模型知识产权保护仍是一大难题，成为新兴研究方向。已有工作在硬标签环境下通过密码分析方法成功提取全连接型DNN，实现了高保真复制。但现有攻击无法应对复杂结构（非全连接）的DNN，且仅适用于特定神经元配置。本文提出一种端到端攻击框架，用于嵌入式DNN的高保真模型提取。设计了一种新型黑盒侧信道攻击，将DNN分解为多个线性部分，分别进行密码分析提取，在硬标签场景下恢复权重。该方法首次将密码学提取扩展至非全连接DNN，同时保持高保真度。我们在微控制器上验证了多种架构：包括170万参数的多层感知机（MLP）和缩短版MobileNetv1。框架成功提取所有模型，准确率分别为88.4%（MobileNetv1）和93.2%（MLP）。进一步用盗取模型生成对抗样本，在目标模型上实现95.8%与96.7%的转移成功率，接近白盒性能。
原文摘要 · Abstract (English)
During the past decade, Deep Neural Networks (DNNs) proved their value on a large variety of subjects. However despite their high value and public accessibility, the protection of the intellectual property of DNNs is still an issue and an emerging research field. Recent works have successfully extracted fully-connected DNNs using cryptanalytic methods in hard-label settings, proving that it was possible to copy a DNN with high fidelity, i.e., high similitude in the output predictions. However, the current cryptanalytic attacks cannot target complex, i.e., not fully connected, DNNs and are limited to special cases of neurons present in deep networks. In this work, we introduce a new end-to-end attack framework designed for model extraction of embedded DNNs with high fidelity. We describe a new black-box side-channel attack which splits the DNN in several linear parts for which we can perform cryptanalytic extraction and retrieve the weights in hard-label settings. With this method, we are able to adapt cryptanalytic extraction, for the first time, to non-fully connected DNNs, while maintaining a high fidelity. We validate our contributions by targeting several architectures implemented on a microcontroller unit, including a Multi-Layer Perceptron (MLP) of 1.7 million parameters and a shortened MobileNetv1. Our framework successfully extracts all of these DNNs with high fidelity (88.4% for the MobileNetv1 and 93.2% for the MLP). Furthermore, we use the stolen model to generate adversarial examples and achieve close to white-box performance on the victim's model (95.8% and 96.7% transfer rate).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。