arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2002.06776cs.CRcs.LG
收藏

如何在业余时间使用NAS

How to 0wn NAS in Your Spare Time

University of Maryland(马里兰大学)

Sanghyun Hong, Michael Davinroy, Yiğitcan Kaya, Dana Dachman-Soled, Tudor Dumitraş

摘要:

新的数据处理管道和新颖的网络架构越来越多地推动了深度学习的成功。因此,业界将性能最佳的架构视为知识产权,并投入大量计算资源通过神经架构搜索(NAS)来发现此类架构。这为对手窃取这些新架构提供了激励;当在云中使用时,为了提供机器学习即服务,对手也有机会通过利用一系列硬件侧通道来重建架构。然而,在不知道计算图的情况下重建新颖的架构和流水线是具有挑战性的(例如,层、分支或跳过连接),体系结构参数(例如,卷积层中滤波器的数量)或特定的预处理步骤(例如嵌入)。在本文中,我们设计了一种算法,通过利用缓存侧信道攻击的少量信息泄漏来重建一种新的深度学习系统的关键组件,Flush+ Quad。我们使用Flush+ Rollad来推断计算的轨迹和每次计算的时间。然后,我们的算法从轨迹中生成候选计算图,并通过参数估计过程消除不兼容的候选。我们在PyTorch和Tensorflow中实现了我们的算法。我们通过实验证明,我们可以重建MalConv,一种用于恶意软件检测的新型数据预处理管道,以及ProxylessNAS- CPU,一种用于ImageNet分类的新型网络架构,优化为在CPU上运行,而无需知道架构家族。在这两种情况下,我们都实现了0%的误差。这些结果表明,硬件侧通道是针对MLaaS的实用攻击载体,应该投入更多精力来了解它们对深度学习系统安全性的影响。

英文摘要:

New data processing pipelines and novel network architectures increasingly drive the success of deep learning. In consequence, the industry considers top-performing architectures as intellectual property and devotes considerable computational resources to discovering such architectures through neural architecture search (NAS). This provides an incentive for adversaries to steal these novel architectures; when used in the cloud, to provide Machine Learning as a Service, the adversaries also have an opportunity to reconstruct the architectures by exploiting a range of hardware side channels. However, it is challenging to reconstruct novel architectures and pipelines without knowing the computational graph (e.g., the layers, branches or skip connections), the architectural parameters (e.g., the number of filters in a convolutional layer) or the specific pre-processing steps (e.g. embeddings). In this paper, we design an algorithm that reconstructs the key components of a novel deep learning system by exploiting a small amount of information leakage from a cache side-channel attack, Flush+Reload. We use Flush+Reload to infer the trace of computations and the timing for each computation. Our algorithm then generates candidate computational graphs from the trace and eliminates incompatible candidates through a parameter estimation process. We implement our algorithm in PyTorch and Tensorflow. We demonstrate experimentally that we can reconstruct MalConv, a novel data pre-processing pipeline for malware detection, and ProxylessNAS- CPU, a novel network architecture for the ImageNet classification optimized to run on CPUs, without knowing the architecture family. In both cases, we achieve 0% error. These results suggest hardware side channels are a practical attack vector against MLaaS, and more efforts should be devoted to understanding their impact on the security of deep learning systems.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑