English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

DNN accelerators have been widely deployed in many scenarios to speed up theinference process and reduce the energy consumption. One big concern about theusage of the accelerators is the confidentiality of the deployed models: modelinference execution on the accelerators could leak side-channel information,which enables an adversary to preciously recover the model details. Such modelextraction attacks can not only compromise the intellectual property of DNNmodels, but also facilitate some adversarial attacks.  Although previous works have demonstrated a number of side-channel techniquesto extract models from DNN accelerators, they are not practical for tworeasons. (1) They only target simplified accelerator implementations, whichhave limited practicality in the real world. (2) They require heavy humananalysis and domain knowledge. To overcome these limitations, this paperpresents Mercury, the first automated remote side-channel attack against theoff-the-shelf Nvidia DNN accelerator. The key insight of Mercury is to modelthe side-channel extraction process as a sequence-to-sequence problem. Theadversary can leverage a time-to-digital converter (TDC) to remotely collectthe power trace of the target model's inference. Then he uses a learning modelto automatically recover the architecture details of the victim model from thepower trace without any prior knowledge. The adversary can further use theattention mechanism to localize the leakage points that contribute most to theattack. Evaluation results indicate that Mercury can keep the error rate ofmodel extraction below 1%.

Mercury: An Automated Remote Side-channel Attack to Nvidia Deep Learning Accelerator