Anuj Dubey

Ashley Kurian, Anuj Dubey, Modini Ayyagari et al.

Side-channel attacks can recover neural network parameters from physical signals, even on commercial edge accelerators. Existing defenses require changes to hardware, instruction set, or compiler, and cannot be deployed on fixed-function platforms such as TPUs. We present the first training-time defense that protects models on off-the-shelf TPUs without modifying the hardware or firmware. Our approach trains multiple functionally equivalent parameter versions per layer and randomly composes them at inference. This reduces the correlation that side-channel attacks rely on while preserving model accuracy. We enforce diversity between parameter versions by adding a regularization term in the loss function during training. We show that this diversity increases leakage variance while leaving the mean signal unchanged, which provably reduces the signal-to-noise ratio exploited by attackers. We derive theoretical bounds that relate leakage to the number of parameter versions and their pairwise distance, and provide a simple calibration method to predict leakage for new configurations before deployment or side-channel measurements. We implement our method on a Google Edge TPU and evaluate it on representative and real-world models. Our defense, in a high-diversity configuration, can hide leakage by reducing the Test Vector Leakage Assessment t-score below the standard leakage detection threshold of 4.5 for the majority of a neural network, with less than 1% accuracy change and moderate overhead. Our results thus show, for the first time, that training-time defenses can provide practical side-channel protection for widely deployed AI hardware.

Anuj Dubey, Rosario Cammarota, Vikram Suresh et al.

Machine learning (ML) models can be trade secrets due to their development cost. Hence, they need protection against malicious forms of reverse engineering (e.g., in IP piracy). With a growing shift of ML to the edge devices, in part for performance and in part for privacy benefits, the models have become susceptible to the so-called physical side-channel attacks. ML being a relatively new target compared to cryptography poses the problem of side-channel analysis in a context that lacks published literature. The gap between the burgeoning edge-based ML devices and the research on adequate defenses to provide side-channel security for them thus motivates our study. Our work develops and combines different flavors of side-channel defenses for ML models in the hardware blocks. We propose and optimize the first defense based on Boolean masking. We first implement all the masked hardware blocks. We then present an adder optimization to reduce the area and latency overheads. Finally, we couple it with a shuffle-based defense. We quantify that the area-delay overhead of masking ranges from 5.4$\times$ to 4.7$\times$ depending on the adder topology used and demonstrate first-order side-channel security of millions of power traces. Additionally, the shuffle countermeasure impedes a straightforward second-order attack on our first-order masked implementation.

Anuj Dubey, Rosario Cammarota, Aydin Aysu

Recent work on stealing machine learning (ML) models from inference engines with physical side-channel attacks warrant an urgent need for effective side-channel defenses. This work proposes the first $\textit{fully-masked}$ neural network inference engine design. Masking uses secure multi-party computation to split the secrets into random shares and to decorrelate the statistical relation of secret-dependent computations to side-channels (e.g., the power draw). In this work, we construct secure hardware primitives to mask $\textit{all}$ the linear and non-linear operations in a neural network. We address the challenge of masking integer addition by converting each addition into a sequence of XOR and AND gates and by augmenting Trichina's secure Boolean masking style. We improve the traditional Trichina's AND gates by adding pipelining elements for better glitch-resistance and we architect the whole design to sustain a throughput of 1 masked addition per cycle. We implement the proposed secure inference engine on a Xilinx Spartan-6 (XC6SLX75) FPGA. The results show that masking incurs an overhead of 3.5\% in latency and 5.9$\times$ in area. Finally, we demonstrate the security of the masked design with 2M traces.

Anuj Dubey, Rosario Cammarota, Aydin Aysu

Differential Power Analysis (DPA) has been an active area of research for the past two decades to study the attacks for extracting secret information from cryptographic implementations through power measurements and their defenses. Unfortunately, the research on power side-channels have so far predominantly focused on analyzing implementations of ciphers such as AES, DES, RSA, and recently post-quantum cryptography primitives (e.g., lattices). Meanwhile, machine-learning, and in particular deep-learning applications are becoming ubiquitous with several scenarios where the Machine Learning Models are Intellectual Properties requiring confidentiality. Expanding side-channel analysis to Machine Learning Model extraction, however, is largely unexplored. This paper expands the DPA framework to neural-network classifiers. First, it shows DPA attacks during inference to extract the secret model parameters such as weights and biases of a neural network. Second, it proposes the $\textit{first countermeasures}$ against these attacks by augmenting $\textit{masking}$. The resulting design uses novel masked components such as masked adder trees for fully-connected layers and masked Rectifier Linear Units for activation functions. On a SAKURA-X FPGA board, experiments show that the first-order DPA attacks on the unprotected implementation can succeed with only 200 traces and our protection respectively increases the latency and area-cost by 2.8x and 2.3x.