A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks
This work addresses security vulnerabilities in neural network implementations for embedded systems, offering a specific defense against side-channel analysis.
The paper tackles the problem of side-channel attacks on neural networks by proposing a desynchronization-based countermeasure to hide timing dependencies in activation functions, achieving overheads between 2.8% and 11% for a VGG-19 network with 4096 neurons.
Model extraction attacks have been widely applied, which can normally be used to recover confidential parameters of neural networks for multiple layers. Recently, side-channel analysis of neural networks allows parameter extraction even for networks with several multiple deep layers with high effectiveness. It is therefore of interest to implement a certain level of protection against these attacks. In this paper, we propose a desynchronization-based countermeasure that makes the timing analysis of activation functions harder. We analyze the timing properties of several activation functions and design the desynchronization in a way that the dependency on the input and the activation type is hidden. We experimentally verify the effectiveness of the countermeasure on a 32-bit ARM Cortex-M4 microcontroller and employ a t-test to show the side-channel information leakage. The overhead ultimately depends on the number of neurons in the fully-connected layer, for example, in the case of 4096 neurons in VGG-19, the overheads are between 2.8% and 11%.