NeuroPlug：利用空间填充曲线封堵NPU中的侧信道泄漏
NeuroPlug: Plugging Side-Channel Leaks in NPUs using Space Filling Curves
AI总结：
NeuroPlug通过空间填充曲线和乘法变量C实现CX+N混淆，抵御侧信道攻击，并基于梅林变换量化搜索空间，性能提升15%。
摘要：
如今，保护深度神经网络（DNN）免受侧信道攻击是一个重要问题，因为获取原始数据和训练复杂模型需要投入大量的时间和资源。所有已发表的防御措施（CMs）都会向信号X（感兴趣的参数，例如泄漏的净内存流量）中添加噪声N。对手观察到X+N；我们将证明，利用有针对性的测量、统计分析和各种合理假设的侧信息，很容易过滤掉这种噪声。我们提出了一种新颖的防御措施NeuroPlug，它对这些攻击方法具有免疫力，这主要是因为我们在公式CX+N中采用了不同的表述。我们引入了一个乘法变量C，它自然产生于特征图压缩；该变量在混淆感兴趣的参数方面起着关键作用。我们的方法基于将所有计算映射到一维空间填充曲线，然后执行一系列基于分块、压缩和分箱的混淆操作。随后，我们提出了一个基于梅林变换的理论框架，该框架使我们能够根据所添加的噪声和对手所拥有的侧信息，精确量化搜索空间的大小。NeuroPlug提供的安全保证通过一系列统计和基于信息论的测试得到了验证。我们还展示了与最接近的竞争工作相比，性能显著提升了15%。
英文摘要：
Securing deep neural networks (DNNs) from side-channel attacks is an important problem as of today, given the substantial investment of time and resources in acquiring the raw data and training complex models. All published countermeasures (CMs) add noise N to a signal X (parameter of interest such as the net memory traffic that is leaked). The adversary observes X+N ; we shall show that it is easy to filter this noise out using targeted measurements, statistical analyses and different kinds of reasonably-assumed side information. We present a novel CM NeuroPlug that is immune to these attack methodologies mainly because we use a different formulation CX + N . We introduce a multiplicative variable C that naturally arises from feature map compression; it plays a key role in obfuscating the parameters of interest. Our approach is based on mapping all the computations to a 1-D space filling curve and then performing a sequence of tiling, compression and binning-based obfuscation operations. We follow up with proposing a theoretical framework based on Mellin transforms that allows us to accurately quantify the size of the search space as a function of the noise we add and the side information that an adversary possesses. The security guarantees provided by NeuroPlug are validated using a battery of statistical and information theory-based tests. We also demonstrate a substantial performance enhancement of 15% compared to the closest competing work.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
