Mercury: An Automated Remote Side-channel Attack to Nvidia Deep Learning Accelerator

TL;DR

Mercury is an automated remote side-channel attack method that uses machine learning to accurately extract model architecture details from Nvidia DNN accelerators by analyzing power traces, without prior knowledge.

Contribution

This work introduces Mercury, the first automated remote side-channel attack on off-the-shelf Nvidia DNN accelerators, modeling the extraction as a sequence-to-sequence learning problem.

Findings

Error rate of model extraction below 1%

Effective localization of leakage points using attention mechanisms

Automated process reduces human analysis and domain knowledge requirements

Abstract

DNN accelerators have been widely deployed in many scenarios to speed up the inference process and reduce the energy consumption. One big concern about the usage of the accelerators is the confidentiality of the deployed models: model inference execution on the accelerators could leak side-channel information, which enables an adversary to preciously recover the model details. Such model extraction attacks can not only compromise the intellectual property of DNN models, but also facilitate some adversarial attacks. Although previous works have demonstrated a number of side-channel techniques to extract models from DNN accelerators, they are not practical for two reasons. (1) They only target simplified accelerator implementations, which have limited practicality in the real world. (2) They require heavy human analysis and domain knowledge. To overcome these limitations, this paper presents Mercury, the first automated remote side-channel attack against the off-the-shelf Nvidia DNN accelerator. The key insight of Mercury is to model the side-channel extraction process as a sequence-to-sequence problem. The adversary can leverage a time-to-digital converter (TDC) to remotely collect the power trace of the target model's inference. Then he uses a learning model to automatically recover the architecture details of the victim model from the power trace without any prior knowledge. The adversary can further use the attention mechanism to localize the leakage points that contribute most to the attack. Evaluation results indicate that Mercury can keep the error rate of model extraction below 1%.