通过光学探测从边缘AI芯片中提取大模型资产
LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing
- 利用激光电压成像技术探测芯片运行时的局部内存与计算电路
- 成功恢复嵌入、注意力权重及量化MLP参数等关键推理数据
- 即使部分数据无法读取，仍可推断资产值，适用于安全评估场景
将大语言模型推理部署至边缘AI加速器带来了新的物理安全隐患。在执行过程中，模型参数和中间推理状态反复加载并处理于芯片上，易受物理侧信道攻击。本文通过部署激光电压成像技术，证明可在推理期间从局部内存和计算子电路中提取大模型资产，包括嵌入、注意力机制、量化MLP权重、激活值及其他推理状态。为验证方法，我们在基于FPGA的LLM加速器上实施攻击。由于此类加速器在地址、瓦片、模块和层间复用相同缓冲区与计算子电路，资产值的读取仅需在推理期间探测不同内存。我们实现了目标值的完整恢复；同时建立了即便部分权重或位无法读取也能恢复资产值的方法。此外，我们推导出成像努力与资产维度之间的下界关系，表明直接恢复的复杂度随目标资产规模呈线性增长。
原文摘要 · Abstract (English)
The move of LLM inference to edge AI accelerators introduces new physical vulnerabilities. During execution, model parameters and intermediate inference states are repeatedly loaded into and processed on the chip, making them suscep- tible to physical side-channel attacks. In this work, by deploying laser voltage imaging, we show that one can extract LLM assets during inference, namely embeddings, attention, and quantized MLP weights, activations, and other inference states, from localized memories and compute subcircuits. To validate our claims, we perform an attack on an FPGA-based LLM accelerator. Since such accelerators reuse the same buffers and compute subcircuits across addresses, tiles, modules, and layers, reading asset values comes down to probing different memories during inference. We demonstrate full recovery of the targeted values; however, we also establish a methodology to recover asset values even if some weights or bits remain unread. We further derive lower bounds that relate imaging effort to asset dimensions and show that even direct recovery scales linearly with the size of the targeted asset
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。