Neural networks have become popular due to their versatility and
state-of-the-art results in many applications, such as image classification,
natural language processing, speech recognition, forecasting, etc. These
applications are also used in resource-constrained environments such as
embedded devices. In this work, the susceptibility of neural network
implementations to reverse engineering is explored on the NVIDIA Jetson Nano
microcomputer via side-channel analysis. To this end, an architecture
extraction attack is presented. In the attack, 15 popular convolutional neural
network architectures (EfficientNets, MobileNets, NasNet, etc.) are implemented
on the GPU of Jetson Nano and the electromagnetic radiation of the GPU is
analyzed during the inference operation of the neural networks. The results of
the analysis show that neural network architectures are easily distinguishable
using deep learning-based side-channel analysis.

通过进行侧信道分析，探索了神经网络在资源受限环境中的容易被逆向工程攻击的脆弱性，并发现神经网络架构可以通过深度学习的侧信道分析轻易被区分。

边缘 GPU 中的 CNN 架构提取

CNN architecture extraction on edge GPU

The globalization of the Integrated Circuit (IC) supply chain, driven by
time-to-market and cost considerations, has made ICs vulnerable to hardware
Trojans (HTs). Against this threat, a promising approach is to use Machine
Learning (ML)-based side-channel analysis, which has the advantage of being a
non-intrusive method, along with efficiently detecting HTs under golden
chip-free settings. In this paper, we question the trustworthiness of ML-based
HT detection via side-channel analysis. We introduce a HT obfuscation (HTO)
approach to allow HTs to bypass this detection method. Rather than
theoretically misleading the model by simulated adversarial traces, a key
aspect of our approach is the design and implementation of adversarial noise as
part of the circuitry, alongside the HT. We detail HTO methodologies for ASICs
and FPGAs, and evaluate our approach using TrustHub benchmark. Interestingly,
we found that HTO can be implemented with only a single transistor for ASIC
designs to generate adversarial power traces that can fool the defense with
100% efficiency. We also efficiently implemented our approach on a Spartan 6
Xilinx FPGA using 2 different variants: (i) DSP slices-based, and (ii)
ring-oscillator-based design. Additionally, we assess the efficiency of
countermeasures like spectral domain analysis, and we show that an adaptive
attacker can still design evasive HTOs by constraining the design with a
spectral noise budget. In addition, while adversarial training (AT) offers
higher protection against evasive HTs, AT models suffer from a considerable
utility loss, potentially rendering them unsuitable for such security
application. We believe this research represents a significant step in
understanding and exploiting ML vulnerabilities in a hardware security context,
and we make all resources and designs openly available online:
this https URL

本文研究硬件安全背景下的机器学习漏洞，主要聚焦在硬件木马、机器学习和侧信道分析，通过设计对抗噪声的方法来绕过机器学习侧信道分析，并提供开放的资源和设计。