English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

New data processing pipelines and novel network architectures increasinglydrive the success of deep learning. In consequence, the industry considerstop-performing architectures as intellectual property and devotes considerablecomputational resources to discovering such architectures through neuralarchitecture search (NAS). This provides an incentive for adversaries to stealthese novel architectures; when used in the cloud, to provide Machine Learningas a Service, the adversaries also have an opportunity to reconstruct thearchitectures by exploiting a range of hardware side channels. However, it ischallenging to reconstruct novel architectures and pipelines without knowingthe computational graph (e.g., the layers, branches or skip connections), thearchitectural parameters (e.g., the number of filters in a convolutional layer)or the specific pre-processing steps (e.g. embeddings). In this paper, wedesign an algorithm that reconstructs the key components of a novel deeplearning system by exploiting a small amount of information leakage from acache side-channel attack, Flush+Reload. We use Flush+Reload to infer the traceof computations and the timing for each computation. Our algorithm thengenerates candidate computational graphs from the trace and eliminatesincompatible candidates through a parameter estimation process. We implementour algorithm in PyTorch and Tensorflow. We demonstrate experimentally that wecan reconstruct MalConv, a novel data pre-processing pipeline for malwaredetection, and ProxylessNAS- CPU, a novel network architecture for the ImageNetclassification optimized to run on CPUs, without knowing the architecturefamily. In both cases, we achieve 0% error. These results suggest hardware sidechannels are a practical attack vector against MLaaS, and more efforts shouldbe devoted to understanding their impact on the security of deep learningsystems.

How to 0wn NAS in Your Spare Time