CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel

Lejla Batina, Dirmanto Jap, Shivam Bhasin, Stjepan Picek

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

31 Downloads (Pure)

Abstract

Machine learning has become mainstream across industries. Numerous examples prove the validity of it for security applications. In this work, we investigate how to reverse engineer a neural network by using side-channel information such as timing and electromagnetic (EM) emanations. To this end, we consider multilayer perceptron and convolutional neural networks as the machine learning architectures of choice and assume a non-invasive and passive attacker capable of measuring those kinds of leakages. We conduct all experiments on real data and commonly used neural network architectures in order to properly assess the applicability and extendability of those attacks. Practical results are shown on an ARM Cortex-M3 microcontroller, which is a platform often used in pervasive applications using neural networks such as wearables, surveillance cameras, etc. Our experiments show that a side-channel attacker is capable of obtaining the following information: the activation functions used in the architecture, the number of layers and neurons in the layers, the number of output classes, and weights in the neural network. Thus, the attacker can effectively reverse engineer the network using merely side-channel information such as timing or EM.

Original languageEnglish
Title of host publicationProceedings of the 28th USENIX Security Symposium
PublisherUSENIX Association
Pages515-532
Number of pages18
ISBN (Electronic)9781939133069
Publication statusPublished - 2019
Event28th USENIX Security Symposium - Santa Clara, United States
Duration: 14 Aug 201916 Aug 2019

Conference

Conference28th USENIX Security Symposium
CountryUnited States
CitySanta Clara
Period14/08/1916/08/19

Fingerprint Dive into the research topics of 'CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel'. Together they form a unique fingerprint.

Cite this