首次揭示图神经网络在电路设计中存在梯度泄露风险,可能暴露门类型和硬件木马特征。
Leaking Circuit Secrets: Gradient Leakage Attacks on Graph Neural Networks
- 通过梯度泄露攻击分析GNN模型,评估其在电路数据上的隐私脆弱性
- 注意力机制(GAT)加剧信息泄露,而注入聚合(GIN)更具抗泄露能力
- 现有防御方法效果受限且可能降低模型性能,需更优解决方案
随着图神经网络(GNN)在电路设计与硬件安全任务中成为标准工具,其安全与隐私风险亟需关注。本文首次系统评估了在电路设计与硬件安全任务中,针对GNN的梯度泄露攻击(GLA)这一被忽视的实际威胁。我们测试了GraphSAGE、GCN、GIN、GAT等主流GNN模型,在ISCAS'85、EPFL和TrustHub等标准网表基准上的表现,发现这些模型易受梯度泄露攻击,可能暴露门类型、硬件木马的独特属性等敏感信息,进而帮助攻击者分析逻辑锁机制或绕过木马检测。分析表明,模型架构特征显著影响泄露程度:注意力机制(如GAT)加剧泄露,而注入式聚合(GIN)表现出更强的鲁棒性。我们进一步评估了差分隐私、梯度裁剪、安全聚合、量化压缩及对抗训练等主流防御技术,发现它们仅在特定场景下有效,且常以牺牲模型性能为代价。本工作为构建隐私保护的GNN提供了关键洞见,并呼吁开发更高效可靠的防御方案。相关方法与数据已公开。
原文摘要 · Abstract (English)
As graph neural networks (GNNs) become standard tools for critical tasks in circuit design and analysis, their security and privacy risks require careful attention. Here, we present the first comprehensive evaluation of gradient leakage attacks (GLAs) on GNNs in circuit-design and hardware-security tasks, a practical threat that has been largely overlooked. We assess state-of-the-art (SOTA) GNNs, including GraphSAGE, GCN, GIN, and GAT, trained on standard netlist benchmarks (ISCAS'85, EPFL, and TrustHub), for their fundamental vulnerability to GLAs. We find that GLAs can expose sensitive information, such as gate types and distinctive properties of hardware Trojans, which may assist adversaries in analyzing logic locking schemes or evading Trojan detection mechanisms. Our analysis shows that these risks are influenced by architectural features, with attention mechanisms (GAT) exacerbating leakage, while injective aggregation (GIN) provides comparatively stronger resilience. We further evaluate several SOTA defense techniques, including differential privacy, gradient clipping, secure aggregation, model compression with quantization, and adversarial training. We find that these techniques improve resilience only in specific settings and can also compromise model performance. Overall, our work provides key insights toward privacy-preserving GNNs and highlights the need for more robust and efficient defenses. We release our full methodology and artifacts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。