A Quantization Method for Reconfigurable Convolutional Neural Network Model Based on Energy Side Channel Security

Abstract

This paper discloses a method for quantifying a reconfigurable convolutional neural network model based on energy side channel security. By constructing an energy side channel security model for integrated circuit hardware design, defining the energy side channel security properties required for the hardware design, and using design space search to optimize architecture selection, this method implements a quantification scheme for the energy side channel security model of the convolutional neural network, thereby revealing the formation mechanism of energy side channel vulnerabilities in convolutional neural network hardware. This method can further improve the computational performance and security of convolutional neural network hardware designs.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a reconfigurable convolutional neural network model quantization method. Background Art

[0002] With the continuous iteration and advancement of artificial intelligence technology, convolutional neural networks (CNNs) in the field of deep learning have been widely applied in various scenarios, including computer vision, image processing, and natural language processing. CNNs are trained using a backpropagation algorithm, optimizing network parameters by minimizing a loss function. Therefore, the key factors in the operation of CNNs come from two aspects: 1) the design of the CNN's hierarchical structure; and 2) the setting of key network parameters. These key parameters are obtained during the CNN training phase using a large amount of private, in-domain training data. Since this training data is inherently private, the key parameters derived from it are also highly private. Because of this, many neural network model hackers attempt to exploit energy side channel information to extract key parameters from CNNs and reverse engineer the CNN model's functionality.

[0003] Side-channel analysis is a primary method for extracting key parameters from convolutional neural networks. Model stealers can exploit the cache time side channel of a convolutional neural network accelerator to extract key weight parameters, or they can exploit the energy side channel present in the convolutional neural network hardware implementation to extract the hierarchical structure characteristics and key weight parameters of the convolutional neural network. However, this work primarily validates reverse engineering attacks against common convolutional neural network accelerator platforms, making it difficult to provide in-depth analysis and security measurements of side-channel security issues arising from hardware architecture changes. Changes in the hardware implementation architecture can lead to new, unpredictable side-channel vulnerabilities.

[0004] Convolutional neural networks are resource-intensive algorithm applications that require not only a large amount of computing resources but also a large amount of storage resources. Especially for some edge reasoning application scenarios, due to the limited computing and storage resource configuration, how to use model quantization to simplify complex neural network models and deploy complex models on resource-constrained devices is a major challenge. Existing convolutional neural network model quantization solutions usually only consider performance factors such as storage overhead, power consumption and computing speed, and lack design considerations for the above-mentioned new energy side channel hardware security properties. In addition, convolutional neural networks have their own hierarchical structure customization solutions (for example, AlexNet[3], ResNet[4], VGGNet[5], etc.) according to different application scenarios. These derived convolutional neural network models further enrich the diversity of convolutional neural network model hardware implementations. Existing methods usually only consider performance and area optimization in the design stage, and cannot guarantee the security properties of the design. Introducing defense after the design is completed will increase the design cost. Therefore, there is an urgent need for a convolutional neural network model quantization design framework based on energy side channel security to solve the above problems. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, this paper provides a reconfigurable convolutional neural network model quantization method based on energy side channel security. By constructing an energy side channel security model for integrated circuit hardware design, defining the energy side channel security properties that the hardware design must meet, and using design space search to optimize architecture selection, this paper implements a quantization scheme for the energy side channel security model of convolutional neural networks, thereby revealing the formation mechanism of energy side channel vulnerabilities in convolutional neural network hardware. This paper can further improve the computational performance and security of convolutional neural network hardware designs.

[0006] The technical solution adopted by the present invention to solve the technical problem includes the following steps:

[0007] Step 1: Extract the convolutional neural network structure information and decompose the hardware functional modules;

[0008] Identify the hierarchical structure of convolutional neural network hardware functional modules and the combination of modules, use hardware description language HDL to build the RTL register transfer level design of the hardware circuit of the basic functional modules, define the data structure to store the functional units and their connection relationships, and construct the logic netlist diagram of the hardware design;

[0009] Step 2: Analysis of the energy side channel principle model of the convolutional neural network functional module;

[0010] The isolated sample analysis method is used to analyze and model the energy side channel leakage behavior of the convolutional neural network functional module;

[0011] The energy side channel dynamic function V(t) of the convolutional neural network functional module is described as follows:

[0012] V(t)=I(t)*R+L*d I / d t +∫I(t)d t / C

[0013] Where I(t) is the dynamic current value, R is the power supply network resistance value, L is the power supply network inductance value, and C is the equivalent value of the combined capacitance effect of the inherent device capacitance, metal filling, and parasitic capacitance in the PDN network; d I / d t represents the derivative of the dynamic current I(t) with respect to time t;

[0014] Define CS(t) to describe the dynamic side channel leakage model as follows:

[0015] CS(t)=B c (t)+C c (t)

[0016] Among them, B c (t) is the bit flip change value at the model input, C c (t) is the bit flip change value of the model combination path;

[0017] The definition of NS(t) describes the energy side channel noise model as follows:

[0018] NS(t)={f1(t),f2(t),…,f n (t)}

[0019] Among them, f1(t) is the noise generated by the lookup table, f2(t) is the noise generated by the block storage, f3(t) is the noise generated by the digital signal processing unit, and f4(t)~f n (t) is the noise generated by other structural variation factors;

[0020] The energy side channel leakage models of various functional modules are integrated to obtain the basic energy side channel leakage model library;

[0021] Step 3: Convolutional neural network hardware TDA combination model construction;

[0022] A three-step TDA energy side channel combination model construction method is used to map the convolutional neural network hardware functional modules constructed in step 1 to the basic energy side channel leakage model library constructed in step 2. Then, a three-step TDA model combination model construction method is used to construct an energy side channel TDA combination model for the instantiated functional modules in the convolutional neural network hardware. This results in an energy side channel vulnerability combination model for the entire convolutional neural network hardware design.

[0023] Step 4: Energy side channel security attribute description;

[0024] The energy side channel security attributes are described by two security indicators. The first is the energy side channel security qualitative description indicator TVLA, which is calculated as follows:

[0025]

[0026] in, Represent the sampling means of data set d1 and data set d2 respectively, and Represent the sampling variance of data set d1 and data set d2 respectively, m represents the number of samples in data set d1, and n represents the number of samples in data set d2; if If the absolute value of is greater than 4.5, it indicates that there is energy side channel leakage;

[0027] The second is the energy side channel security quantitative description indicator MTD, which is determined by the amount of sampled data consumed to successfully break the design. The correlation coefficient calculation method for the first-order energy side channel attack is as follows:

[0028]

[0029] Among them, r represents the actual dynamic energy sampling data obtained, Indicates that the model constructs dynamic energy simulation data, cov indicates covariance, represents the standard deviation;

[0030] Step 5: Comprehensive indicator model verification and design space search;

[0031] The comprehensive performance safety balance index PST is constructed and calculated as follows:

[0032] PST=(1-a / M i )*(b / R i +(1-c / P i ))

[0033] Among them, M i represents the MTD value, R i Indicates resource consumption, P i Indicates the quantization accuracy value, a, b, c are the scaling coefficients;

[0034] Conduct a design space search for convolutional neural network model quantization. By implementing different model quantization strategies at the hardware level, conduct a design space search for convolutional neural network model quantization schemes and screen out the optimal convolutional neural network model quantization strategy.

[0035] Preferably, the energy side channel vulnerability combination model includes a trigger module, a dominant module and an auxiliary conduction module, wherein the trigger module is used to stimulate bit flipping at the model input end, the dominant module generates dynamic energy consumption, and the auxiliary conduction module is affected by the internal signal flipping of the dominant module and also generates dynamic energy consumption synchronously.

[0036] Preferably, the different model quantization strategies include 3-bit, 5-bit, 8-bit, 16-bit, 18-bit, and 32-bit.

[0037] The beneficial effects of the present invention are as follows:

[0038] The beneficial effect of the present invention is that in the early stage of convolutional neural network hardware design, standard hardware description languages ​​(Verilog, VHDL) can be used to establish an energy side channel leakage security model for hardware design, and isolated sample analysis can be used to realize instantiation verification of energy side channel security properties, thereby helping convolutional neural network designers to avoid potential energy side channel leakage in the design. In addition, the comprehensive performance security balance index constructed by the present invention can be combined to carry out design space search, further improving the computing performance and security performance of the convolutional neural network hardware design implementation, and revealing the formation mechanism of energy side channel vulnerabilities in convolutional neural network hardware design. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is an implementation flow chart of the present invention.

[0040] Figure 2 It is an energy side channel leakage TDA model built for convolution kernels.

[0041] Figure 3 It is the comprehensive indicator construction and design space search of different model quantification schemes. DETAILED DESCRIPTION

[0042] The present invention will be further described below with reference to the accompanying drawings and examples.

[0043] In response to the problems existing in the existing technology, the present invention provides a reconfigurable convolutional neural network model quantization method based on energy side channel security. The design framework introduces a security measurement mechanism during the design phase to detect potential energy side channel security vulnerabilities, thereby using more reasonable design options to eliminate or circumvent unreasonable design vulnerabilities and screen out the optimal convolutional neural network hardware model quantization solution.

[0044] This method works by modularizing the functional architecture of a convolutional neural network and defining the required architecture properties for hardware design, such as resource matching, execution scheduling, and design optimization. The generated design test architecture is then extracted and combined with the expected security properties to verify the energy side channel security model. Finally, a design space search method is used to select the design architecture that optimally balances security and performance properties. This method can accurately locate energy side channel vulnerabilities in the design architecture and reveal their formation mechanisms. This method offers significant advantages in the design of quantified hardware security models for energy side channels in convolutional neural networks.

[0045] A reconfigurable convolutional neural network model quantization method based on energy side channel security includes the following steps:

[0046] Step 1: Extract the convolutional neural network structure information and decompose the hardware functional modules;

[0047] Extract the convolutional neural network structure information and decompose the convolutional neural network hardware into functional modules, identify the hierarchical structure of the functional modules of the convolutional neural network hardware and the combination method between modules, use the hardware description language (HDL, Hardware Description Language) to build the hardware circuit (RTL, Register Transfer Level) register transfer level design of the basic functional module, define the data structure to implement the storage of functional units and their connection relationships, and construct the logic netlist diagram of the hardware design.

[0048] Step 2: Analysis of the energy side channel principle model of the basic convolutional neural network functional module;

[0049] This paper uses an isolated sample analysis method to analyze and model the energy side channel leakage behavior of basic functional units. This method can maximize the energy side channel characteristics existing in the architecture and separate and quantify the noise interference in the architecture. Assume that the energy side channel dynamic function V(t) of the basic convolution functional module is described as follows:

[0050] V(t)=I(t)*R+L*d I / d t +∫I(t)d t / C

[0051] Where I(t) is the dynamic current value, R is the power supply network resistance value, L is the power supply network inductance value, and C is the inherent device capacitance, metal filling, and parasitic capacitance in the PDN network.

[0052] This paper further defines Confidentiality-Switching (CS) and Noise-Switching (NS) to describe the sources of energy side channel leakage, where CS(t) describes the dynamic side channel leakage model as follows:

[0053] CS(t)=B c (t)+C c (t)

[0054] Among them, B c (t) is the bit flip change value at the model input, C c (t) is the bit flip change value of the model combination path.

[0055] NS(t) describes the energy side channel noise model as follows:

[0056] NS(t)={f1(t),f2(t),…,f n (t)}

[0057] Among them, f1(t) is the noise generated by the lookup table, f2(t) is the noise generated by the block storage, f3(t) is the noise generated by the digital signal processing unit, and f n (t) is the noise caused by other architectural variations.

[0058] When energy side channel leakage models of multiple functional module units are constructed, a basic energy side channel leakage model library can be integrated.

[0059] Step 3: Convolutional neural network hardware TDA combination model construction;

[0060] Based on the qualitative modeling of the energy side channel model of the convolutional neural network functional module, a more detailed energy side channel vulnerability combination model can be further constructed according to the specific composition of the convolutional neural network.

[0061] The present invention adopts a three-step TDA energy side channel combination model construction method. By mapping the convolutional neural network functional module constructed in step 1 to the convolutional neural network energy side channel principle model library constructed in step 2, and then using the three-step TDA model combination model construction method to construct an energy side channel TDA combination model for the instantiated functional module in the convolutional neural network hardware, the energy side channel combination model of the entire convolutional neural network hardware design can be obtained. The energy side channel vulnerability combination model consists of three parts: a triggering block, a dominating block, and an affiliated conduction block. The triggering block mainly functions to stimulate bit flipping at the model input end, the dominating block mainly generates dynamic energy consumption, and the affiliated module is affected by the internal signal flipping of the dominating module and also generates dynamic energy consumption synchronously.

[0062] The combined energy side channel leakage method adopted by the present invention can generate a combined energy side channel model for convolutional neural networks with different architecture combinations.

[0063] Step 4: Description of energy side channel security properties;

[0064] The energy side channel security attributes are mainly described by two security indicators. The first is the energy side channel security qualitative description indicator TVLA, which is calculated as follows:

[0065]

[0066] in, represents the sampling mean, represents the sampling variance, m represents the number of samples in dataset d1, and n represents the number of samples in dataset d2. If the absolute value of the statistic t is greater than 4.5, it indicates that there is an energy side channel leakage.

[0067] The second is the energy side channel security quantitative description indicator MTD, which is determined by the amount of sampled data consumed to successfully break the design. The correlation coefficient calculation method for the first-order energy side channel attack is as follows:

[0068]

[0069] Among them, r represents the actual dynamic energy sampling data obtained, Indicates that the model constructs dynamic energy simulation data, cov indicates covariance, represents the standard deviation. A correct guess of the weights will produce a large value.

[0070] Step 5: Comprehensive indicator model verification and design space search;

[0071] The present invention uses the constructed comprehensive index of balanced performance and safety to conduct design space search. The comprehensive performance and safety balance index PST is constructed using the safety performance index MTD obtained in step 4, the resource consumption R generated during synthesis, and the quantization accuracy P of the convolution kernel. The calculation method is as follows:

[0072] PST=(1-a / M i )*(b / R i +(1-c / P i ))

[0073] Among them, M i represents the MTD value, R i Indicates resource consumption, P i represents the quantization precision value, and a, b, and c are the scaling factors. The larger the PST value, the stronger the overall performance of the design.

[0074] Conduct a design space search for convolutional neural network model quantization. By implementing different model quantization strategies (such as 3-bit, 5-bit, 8-bit, 16-bit, 18-bit, and 32-bit) at the hardware level, we can search the design space for convolutional neural network model quantization solutions and select the optimal convolutional neural network model quantization strategy.

[0075] The convolutional neural network hardware design framework based on energy side channel security proposed in this invention adopts standard hardware description language to model the convolutional neural network hardware design, and uses isolated sample analysis to realize the instantiation verification of energy side channel security properties. It can effectively avoid the additional design overhead brought by post-design security defense, improve the energy side channel security of convolutional neural network hardware design, and use design space search to achieve the optimal design efficiency of the computing performance and security performance of the convolutional neural network hardware model.

[0076] Example:

[0077] The verification hardware platform and hardware environment used for implementation are: SAKURA-G side channel evaluation platform; Picoscope3000 series high-precision signal sampler; Intel i7-6700 CPU, @3.4G 3.4G (2 processors) computer, 4.0GB memory; the running software environment is: Windows 10 64-bit operating system.

[0078] The present invention uses model quantization in convolutional neural networks as a design space search example. The neural network approximates operands such as weights and activation values ​​by converting them from high-precision floating-point numbers to lower-precision integers, thereby improving the calculation speed of the neural network model and reducing the power consumption and storage overhead of the hardware while maintaining the accuracy of the model. First, the functional modules in the convolutional neural network model are modularly extracted according to step 1, and then the energy side channel vulnerability analysis is performed on different functional modules according to step 2. The energy side channel leakage TDA model is established according to step 3, and then different model quantization schemes are set for the convolution operation of the key functional modules. The energy side channel security properties of different quantization schemes are obtained according to step 4; then, based on step 4, a comprehensive performance index PST is constructed through step 5, and a design space search of different model quantization schemes is carried out, and the schemes in the design space are compared and analyzed to obtain a suitable model quantization scheme.

[0079] The logical relationship of each part of the present invention is as follows Figure 1 As shown, the specific implementation is as follows:

[0080] Step 1: Decomposition of RTL code of convolutional neural network functional module;

[0081] The functional modules of the convolutional neural network architecture (convolutional layer operation, activation layer operation, pooling layer operation, fully connected layer operation, batch normalization operation) are functionally decomposed and the RTL code of the corresponding modules is written. The logic synthesis tool provided by Xilinx is used to map the functional modules to specific on-chip implementation resources and obtain the network table information of the corresponding functional modules.

[0082] Step 2: Energy side channel analysis of convolutional neural network functional modules;

[0083] The energy side channel dynamic function V(t) is modeled for different functional modules in the convolutional neural network architecture, and the dynamic side channel leakage model CS(t) and noise model NS(t) are modeled according to the characteristics of different functional modules. The leakage model CS(t) and noise model NS(t) are analyzed according to the network table information of the functional module obtained in step 1, and the dominant energy side channel impact of different functional modules is classified and analyzed.

[0084] Step 3: Convolutional neural network TDA model construction;

[0085] The energy side channel dynamic leakage model obtained from the classification in step 2 is further constructed using a TDA model. This constructs a three-step energy side channel leakage mechanism model consisting of a triggering block, a dominating block, and an affiliated block. This model is used to model and analyze bit flips in functional modules and predict energy side channel vulnerabilities based on instantiation scenarios. Figure 2 A three-step TDA model based on a convolutional neural network is demonstrated. The triggering block consists of registers and is mainly responsible for generating bit flips at the input end. The dominating block consists of multipliers and is the main energy side channel generated by the bit flip at the input end. The affiliated block consists of functional components such as addition trees or activation functions that are attached to the dominating block and is an important component for completing convolution or activation operations. Since bit flips in the dominating block will also be transmitted to the affiliated blocks, their composition will also greatly affect the degree of energy side channel leakage.

[0086] Step 4: Energy side channel security property description

[0087] Before conducting actual energy side channel platform testing, describe the energy side channel security properties of the functional module under test. Construct a security property description that combines qualitative and quantitative assessments. The qualitative description uses TVLA to assess whether the functional module has energy side channel leakage, obtaining the qualitative assessment metric T. The quantitative description uses CPA to quantify the leakage level of the functional module's energy side channel vulnerability, obtaining the quantitative security assessment metric MTD.

[0088] Step 5: Comprehensive indicator construction and design space exploration

[0089] We further conducted a comprehensive performance evaluation of the functional modules of the convolutional neural network and constructed a comprehensive indicator (PST) to describe the comprehensive performance and security of the design. Combined with the energy side channel security properties obtained in step 4, we searched for the optimal design architecture across a range of design spaces, including operation quantization schemes, module combination schemes, and architectural parallelization strategies. Figure 3 The comprehensive evaluation metrics of PST for test benchmark cases in the design search space formed by different quantization strategies are presented.

[0090] exist Figure 3In the test case, the "digital bit number (8-bit)" before the benchmark case represents the quantization accuracy of the neural network weight or input, "fixed" and "float" represent "fixed-point number" and "floating-point number" respectively, and "DSP" and "LUT" represent the FPGA on-chip resources used as "digital signal processing unit" and "lookup table" respectively. Figure 3 Across the various test benchmark cases, we found that low-bit (3-bit, 5-bit) convolution operations implemented using a lookup table (LUT) achieved superior overall performance, including more reliable energy side channel security properties and improved resource utilization. Furthermore, the PST value for an 8-bit convolution operation implemented using the FPGA's on-chip DSP was positive, making it a viable convolution kernel construction solution. However, the PST values ​​for the remaining test benchmark cases were negative, indicating significant energy side channel security risks and not recommended as a convolution kernel construction solution.

Claims

1. A reconfigurable convolutional neural network model quantization method based on energy side channel security, characterized in that: The steps include: Step 1: Extract the convolutional neural network structure information and decompose the hardware functional modules; Identify the hierarchical structure of convolutional neural network hardware functional modules and the combination of modules, use hardware description language HDL to build the RTL register transfer level design of the hardware circuit of the basic functional modules, define the data structure to store the functional units and their connection relationships, and construct the logic netlist diagram of the hardware design; Step 2: Analysis of the energy side channel principle model of the convolutional neural network functional module; The isolated sample analysis method is used to analyze and model the energy side channel leakage behavior of the convolutional neural network functional module; The energy side channel dynamic function V(t) of the convolutional neural network functional module is described as follows: V(t)=I(t)*R+L*d I / d t +∫I(t)d t / C Where I(t) is the dynamic current value, R is the power supply network resistance value, L is the power supply network inductance value, and C is the equivalent value of the combined capacitance effect of the inherent device capacitance, metal filling, and parasitic capacitance in the PDN network; d I / d t represents the derivative of the dynamic current I(t) with respect to time t; Define CS(t) to describe the dynamic side channel leakage model as follows: CS(t)=B c (t)+C c (t) Among them, B c (t) is the bit flip change value at the model input, C c (t) is the bit flip change value of the model combination path; The definition of NS(t) describes the energy side channel noise model as follows: NS(t)={f1(t),f2(t),...,f n (t)} Among them, f1(t) is the noise generated by the lookup table, f2(t) is the noise generated by the block storage, f3(t) is the noise generated by the digital signal processing unit, and f4(t)~f n (t) is the noise generated by other structural variation factors; The energy side channel leakage models of various functional modules are integrated to obtain the basic energy side channel leakage model library; Step 3: Convolutional neural network hardware TDA combination model construction; A three-step TDA energy side channel combination model construction method is used to map the convolutional neural network hardware functional modules constructed in step 1 to the basic energy side channel leakage model library constructed in step 2. Then, a three-step TDA model combination model construction method is used to construct an energy side channel TDA combination model for the instantiated functional modules in the convolutional neural network hardware. This results in an energy side channel vulnerability combination model for the entire convolutional neural network hardware design. Step 4: Energy side channel security attribute description; The energy side channel security attributes are described by two security indicators. The first is the energy side channel security qualitative description indicator TVLA, which is calculated as follows: in, Represent the sampling means of data set d1 and data set d2 respectively, and Represent the sampling variance of data set d1 and data set d2 respectively, m represents the number of samples in data set d1, and n represents the number of samples in data set d2; if If the absolute value of is greater than 4.5, it indicates that there is energy side channel leakage; The second is the energy side channel security quantitative description indicator MTD, which is determined by the amount of sampled data consumed to successfully break the design. The correlation coefficient calculation method for the first-order energy side channel attack is as follows: Among them, r represents the actual dynamic energy sampling data obtained, Indicates that the model constructs dynamic energy simulation data, cov indicates covariance, represents the standard deviation; Step 5: Comprehensive indicator model verification and design space search; The comprehensive performance safety balance index PST is constructed and calculated as follows: PST=(1-a / M i )*(b / R i +(1-c / P i )) Among them, M i represents the MTD value, R i Indicates resource consumption, P i Indicates the quantization precision value, a, b, c are the scaling coefficients; Conduct a design space search for convolutional neural network model quantization. By implementing different model quantization strategies at the hardware level, conduct a design space search for convolutional neural network model quantization schemes and screen out the optimal convolutional neural network model quantization strategy.

2. The method for quantizing a reconfigurable convolutional neural network model based on energy side channel security according to claim 1 is characterized in that: The energy side channel vulnerability combination model includes a trigger module, a dominant module and an auxiliary conduction module. The trigger module is used to stimulate bit flipping at the model input end, the dominant module generates dynamic energy consumption, and the auxiliary conduction module is affected by the internal signal flipping of the dominant module and also generates dynamic energy consumption synchronously.

3. The method for quantizing a reconfigurable convolutional neural network model based on energy side channel security according to claim 1, characterized in that: The different model quantization strategies include 3-bit, 5-bit, 8-bit, 16-bit, 18-bit, and 32-bit.

Images