InferNet：利用聚合GPU配置文件作为旁道进行DNN架构推理
InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference
AI总结：
研究针对DNN面临的安全威胁，提出InferNet方法，利用简单系统级信息，通过分析GPU相关内容推断DNN架构，在多框架、类型和平台上验证其有效性，能以高准确率提取模型架构。
摘要：
深度神经网络（DNN）因其能解决跨领域问题而无处不在，但面临模型窃取、架构提取等安全威胁。以往工作依赖复杂的时间序列分析来进行DNN模型提取攻击，需大量数据。本文介绍InferNet，一种利用简单、非侵入性和粗粒度系统级信息识别受害者应用底层DNN架构的攻击方法。通过分析GPU内核调用等，能高精度推断其架构家族及变体。评估结果表明InferNet在多种AI/ML框架、DNN类型和硬件平台上有效，在各种攻击设置下仅用部分GPU配置文件就能实现100%的模型提取准确率。
英文摘要：
Deep Neural Networks (DNNs) have become ubiquitous for their ability to solve problems across various domains, including computer vision, natural language processing, and speech recognition. However, as their adoption grows, they face a range of security threats, such as model stealing, architecture extraction, and manipulation, which can compromise their integrity, privacy, and functionality. Past works have relied on complex, fine-grained, and time-series analysis to launch DNN model extraction attacks. These approaches require extensive amounts of data, which are often challenging to acquire and analyze effectively. This paper introduces InferNet, an attack method that leverages simple, non-intrusive, and coarse-grained system-level information to identify the underlying DNN architecture of a victim's application. By analyzing GPU kernel calls, memory events, and system-level metrics, InferNet fingerprints the DNN and infers its architecture with very high accuracy. It can predict the architecture family (e.g., Inception vs. BERT), as well as the architecture variant (e.g., InceptionV1 vs. InceptionV3). The evaluation results demonstrate the effectiveness of InferNet across AI/ML frameworks (TensorFlow, PyTorch), different DNN types (vision, LLMs), and hardware platforms (NVIDIA Tesla T4, NVIDIA Quadro RTX 8000). The results show that InferNet achieves 100% model extraction accuracy using only a partial GPU profile under various attack settings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
