멜트다운 취약점을 이용한 인공신경망 추출 공격

국문 초록 (Abstract)

클라우드 컴퓨팅 환경에서 기계학습 서비스를 제공하는 Machine-Learning-as-a-Service(MLaaS) 등이 활발히 개발됨에 따라 보다 다양한 분야에서 인공지능 기술을 손쉽고 효과적인 방법으로 활용할 수 있게 되었다. 클라우드 환경에서는 가상화 기술을 통해 각 사용자에게 논리적으로 독립된 컴퓨팅 공간을 제공하는데, 최근 시스템의 취약점을 이용해 클라우드 테넌트(tenant) 사이에 다양한 부채널이 존재할 수 있다는 연구 결과가 발표되고 있다. 본 논문에서는 이러한 멀티-테넌시(multi-tenancy) 환경에서 멜트다운 취약점을 이용하여 딥러닝 모델의 내부 정보를 추출할 수 있는 현실적인 공격 시나리오를 제시한다. 이후 TensorFlow 딥러닝 서비스에 대한 실험을 통해 92.875%의 정확도와 1.325kB/s의 속도로 인공신경망의 모든 정보를 추출할 수 있음을 보인다.

다국어 초록 (Multilingual Abstract)

Cloud computing technology plays an important role in the deep learning industry as deep learning services are deployed frequently on top of cloud infrastructures. In such cloud environment, virtualization technology provides logically independent and isolated computing space for each tenant. However, recent studies demonstrate that by leveraging vulnerabilities of virtualization techniques and shared processor architectures in the cloud system, various side-channels can be established between cloud tenants. In this paper, we propose a novel attack scenario that can steal internal information of deep learning models by exploiting the Meltdown vulnerability in a multi-tenant system environment. On the basis of our experiment, the proposed attack method could extract internal information of a TensorFlow deep-learning service with 92.875% accuracy and 1.325kB/s extraction speed.

목차 (Table of Contents)

• 요약
• ABSTRACT
• I. 서론
• II. 기존 연구
• III. 배경지식
• IV. 제안 공격 기법
• V. 공격 실험
• VI. 공격 성능 분석
• VII. 대응방안
• VIII. 결론
• References

참고문헌 (Reference)

1 Schwarz, M., "ZombieLoad:Cross-privilege-boundary data sampling" 753-768, 2019

2 Simonyan, K., "Very deep convolutional networks for large-scale image recognition"

3 Deng, L., "The MNIST database of handwritten digit images for machine learning research [best of the web]" 29 (29): 141-142, 2012

4 Duddu, V., "Stealing neural networks via timing side channels"

5 Tramèr, F., "Stealing machine learning models via prediction apis" 601-618, 2016

6 Wang, B., "Stealing hyperparameters in machine learning" 36-52, 2018

7 Rossum, G.V., "Python tutorial" 620 : 1995

8 Papernot, N., "Practical black-box attacks against machine learning" 506-519, 2017

9 Fredrikson, M., "Model inversion attacks that exploit confidence information and basic countermeasures" 1322-1333, 2015

10 Lipp, M., "Meltdown: Reading kernel memory from user space" 973-990, 2018

11 Wei, J., "Leaky DNN: Stealing Deep-learning Model Secret with GPU Context-switching Side-channel" 2020

12 Gruss, D., "Kaslr is dead: long live kaslr" Springer 161-176, 2017

13 Gregg, B., "KPTI/KAISER Meltdown Initial Performance Regressions"

14 Wei, L., "I know what you see:Power side-channel attack on convolutional neural network accelerators" 393-406, 2018

15 Jagielski, M., "High Accuracy and High Fidelity Extraction of Neural Networks" 2020

16 Weisse, O., "Foreshadow-NG:Breaking the virtual memory abstraction with transient out-of-order execution" 2018

17 Dong, G., "Floating-Point Multiplication Timing Attack on Deep Neural Network" 155-161, 2019

18 Yarom, Y., "FLUSH+RELOAD: a high resolution, low noise, L3 cache side-channel attack" 719-732, 2014

19 Moosavi-Dezfooli, S. M., "Deepfool: a simple and accurate method to fool deep neural networks" 2574-2582, 2016

20 Goodrich, M.T., "Data structures and algorithms in Python" John Wiley & Sons Ltd 2013

21 Zhang, Y., "Cross-tenant side-channel attacks in PaaS clouds" 990-1003, 2014

22 Inci, M. S., "Co-location detection on the cloud" Springer 19-34, 2016

23 Yan, M., "Cache Telepathy:Leveraging Shared Resource Attacks to Learn DNN Architectures" 2003-2020, 2020

24 Batina, L., "CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel" 515-532, 2019

25 Zhu, J., "CPU security benchmark" 8-14, 2018