Measurement and randomization of computer system behavior to mitigate and exploit side channel information

Abstract

Methods and systems for measuring emissions by a digital system by selecting a side-channel, detecting emissions of the selected side-channel, quantifying the emissions, generating a random difference value that indicates a difference of the emissions from random and employing the resulting difference as a feedback mechanism to adjust the digital system to modify the signature of the emissions to more closely resemble random emissions. The emissions may take the form of one or more physical characteristics of the digital system that are measurable externally to the digital system, such as power consumed by the digital system, heat generated by the digital system, and frequency and / or volume of digital communications transmitted by the digital system. The digital system may employ a Multi-Exit Neural Network (MeNN).

Description

UCT-02325 Measurement and Randomization of Computer System Behavior to Mitigate and Exploit Side Channel Information RELATED APPLICATIONS

[0001] This application claims priority to U.S. provisional patent application 63 / 684,116 filed on August 16, 2024, to U.S. provisional patent application 63 / 684,125 filed on August 16, 2024, to U.S. provisional patent application 63 / 767,369 filed on March 5, 2025, and to U.S. provisional patent application 63 / 767,370 filed on March 5, 2025, each of which is hereby incorporated by reference in its entirety. FEDERALLY SPONSORED RESEARCH AND DEVELOPMENT

[0002] This invention was made with government support under CCF-1822949, CCF-2119184, CNS-1764039, and CISE-ANR-2124393 awarded by the United States National Science Foundation. The government has certain rights in the invention. BACKGROUND

[0003] This disclosure relates generally to the field of computer systems and more specifically to computer system security and privacy.

[0004] Digital systems can exhibit externally observable behavior which can inadvertently cause leakage of information about the system, specifically information that the implementers intended to be private but is now exposed through a side channel. While many computer systems exhibit such side channels and the broad techniques described in this document apply in general to such systems, deep neural networks represent one example system that is currently being widely deployed due to their flexibility in solving a number of problems. For example, deep neural networks (DNNs) are increasingly being used in a variety of environments including in dataUCT-02325 processing centers, on user devices and on micro-controllers employed in connection with sensors. DNNs can have high resource costs and Multi-Exit Neural Networks (MeNN) which contain early exit points have been introduced to reduce computation needs while providing acceptable results. The early exit(s) produce can produce an observable signature which may be used by a third-party to observe the behavior of a system employing a MeNN and potentially to use such observations to attack the system. SUMMARY

[0005] A computer-implemented method for managing a computerized system is disclosed. A first side channel is measured. The first side channel is characterized by a first signal that is observable external to the computerized system. The first signal is quantified to generate a first side channel leakage value. A random difference value is generated. The random difference value is indicative of a difference between the first side channel leakage value and a random leakage value. The random leakage value is indicative of random behavior of the computerized system as exhibited by the first side channel. The random difference value is employed as feedback to control the computerized system.

[0006] Employing the random difference value as feedback to control the computerized system may comprise modifying behavior of the computerized system to reduce the random difference value.

[0007] The first side channel may comprise frequency of digital communications transmitted by the computerized system to one or more digital systems external to the computerized system.

[0008] The digital communications may be encrypted.

[0009] The first side channel may comprise quantity of power consumed by the computerized systemUCT-02325

[0010] The first side channel may comprise heat generated by the computerized system.

[0011] The computerized system may comprise a multi-exit neural network. The first side channel may comprise frequency of encrypted digital communications transmitted by the computerized system to one or more digital systems external to the computerized system. The encrypted digital communications may be caused in part by exits from the multi-exit neural network.

[0012] The computerized system may comprise a low-power embedded system. The low-power embedded system may execute a multi-exit neural network (MeNN). The MeNN may operate in conjunction with a server in communication with the low-power controller. The first side channel may comprise frequency of encrypted digital communications transmitted by a low-power microcontroller to the server.

[0013] The computerized system may comprise a plurality of low-power embedded systems that together execute a deep distributed multi-exit neural network (MeNN). The distributed MeNN may operate in conjunction with a server in communication with the low-power controllers. The first side channel may comprise frequency of encrypted digital communications transmitted by one or more low-power microcontrollers to the server.

[0014] A computer-implemented method for performing inference by a neural network is disclosed. The method comprises determining, for each of a plurality of classes and for each of a plurality of exits from the neural network, a respective confidence threshold that causes a predefined proportion of samples predicted by the corresponding class to terminate inference at a corresponding branch of the corresponding class. Each class is selectable as an output of the neural network. The method comprises storing each confidence threshold in a memory. The method comprises receiving an input sample for input to the neural network. The methodUCT-02325 comprises processing the input sample through a first exit branch to obtain (a) a provisional class label and (b) a confidence value. The method comprises comparing the confidence value to the confidence threshold associated with the provisional class label and the first exit branch. The method comprises, responsive to the confidence value satisfying the confidence threshold, outputting the provisional class label as a final prediction. The method comprises, responsive to the confidence value failing to satisfy the confidence threshold, processing the input sample through at least one subsequent exit branch. The operations of the method are repeated for each received sample to the neural network.

[0015] The method may comprise, for each exit branch and class of the neural network, storing an exit-bias probability function with an associated confidence threshold. The associated confidence threshold maps a confidence value to a corresponding exit probability q. The method may comprise, at run-time, computing the exit probability q for a provisional class label by evaluating the exit-bias probability function using the confidence value produced at a current exit branch. The method may comprise generating a random value r drawn from a uniform distribution over an interval [0, 1]. The method may comprise terminating inference at the current exit branch when r ≤ q. The method may comprise otherwise forwarding activations to a subsequent exit branch. Each exit-bias probability function may be calibrated such that associated stochastic exit behavior is biased toward, but not identical to, deterministic exit decisions produced by the corresponding confidence threshold. This may reduce side-channel information leakage while maintaining substantially the same inference accuracy.

[0016] The method may comprise evaluating the Per-Class Exiting to generate a confidence- biased exit probability which determines exiting behavior. The method may comprise adaptingUCT-02325 bias magnitude on highly-correlated streams. The method may comprise enforcing exit quotas over short windows to limit an adversary’s ability to discover data-dependent information.

[0017] A computer-implemented method for inferring a class label predicted by a target multi- exit neural network (MeNN) model. The inference is done without decryption or white-box access. The method comprises providing a surrogate MeNN model that is architecturally compatible with a target MeNN model and having internal parameters that are accessible to an attacker. The method comprises supplying to the surrogate MeNN model a plurality of reference input samples having known ground-truth labels. The method comprises, for each of the reference input samples, recording (i) an exit index produced by the surrogate MeNN model and (ii) a corresponding ground-truth label, thereby forming a plurality of exit-label pairs. The method comprises generating, from the exit-label pairs, a statistical mapping that, for each exit index, provides a posterior probability distribution over a plurality of class labels. The method comprises passively monitoring a side channel. The side channel comprises one of execution time, heat patterns, power, usage patterns, network traffic, and network traffic frequency associated with inference of an unknown input sample processed by the target MeNN model. The method comprises determining, from one or more side-channel characteristics of the surrogate MeNN model, an exit index taken by the target MeNN model for the unknown input sample. The method comprises selecting, as an inferred class label from the target model for the unknown input sample, a class having a highest posterior probability under the statistical mapping conditioned on the exit index. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] FIG. 1 is flow diagram illustrating measurement of emissions by and control of a digital system.UCT-02325

[0019] FIG. 2 is flow diagram illustrating measurement of emissions of a digital system.

[0020] FIG.3 is a block diagram illustrating a sensing system with a Deep Neural Network (DNN) employing two exits.

[0021] FIG.4 is a block diagram illustrating a threat model against distributed Multi-Exit Neural Networks (MeNNs).

[0022] FIG.5 is a block diagram illustrating an example of a black box attacker.

[0023] FIG.6 is a block diagram illustrating decision process of a Confidence-Guided Randomness (CGR) at a kthexit point.

[0024] FIG. 7 is a graph illustrating maximum attack accuracy across 21 target exit rates.

[0025] FIG.8 is a graph illustrating inference accuracy (%) on an activity dataset.

[0026] FIG.9 is a graph illustrating maximum attack accuracy (%) on Nearest-Neighbor dataset orders.

[0027] FIG.10 is a graph illustrating early exit rates per prediction under a Max Prob policy for a target MeNN trained on MNIST and a substitute trained on spoken digits.

[0028] FIG.11 is a graph illustrating inference accuracy and attack accuracy against distributed MeNNs executing on a low-power micro-controller unit (MCU).

[0029] FIG.12 is a graph illustrating maximum attack accuracy for MeNNs with two, three and four exits.

[0030] FIG.13 is a block diagram of computer hardware that may be employed in certain embodiments of computer systems described herein.

[0031] FIG.14 is an algorithm for an MeNN inference routine that may be employed in certain embodiments of computer systems described herein.UCT-02325

[0032] FIG.15 is a graph illustrating average inference accuracy and maximum attack accuracy on the Activity dataset for window sizes (^^) and noise rates (^^) under the Same-Label order.

[0033] FIG.16 is a graph illustrating mean inference accuracy and worst-case attack accuracy (right) for different maximum bias (^^) values aggregated across ^^ ∈ {1.5, 2.0, 2.5} and ^^ = {0.5, 0.7, 0.9, 0.99}.

[0034] FIG.17 is a graph illustrating mean inference accuracy and worst-case attack accuracy for different increase factors (^^) aggregated across ^^ ∈ {0.4, 0.5, 0.6, 0.7, 0.8, 0.9} and ^^ ={0.5, 0.7, 0.9, 0.99}.

[0035] FIG.18 is a graph illustrating mean inference accuracy and worst-case attack accuracy for different decrease factors (^^) aggregated across ^^ ∈ {0.4, 0.5, 0.6, 0.7, 0.8, 0.9} and ^^ = {1.5, 2.0, 2.5}.

[0036] FIG.19 depicts a computing node, in accordance with one or more embodiments of this disclosure. DETAILED DESCRIPTION

[0037] In the following detailed description, reference will be made to the accompanying drawing(s), in which identical functional elements are designated with like numerals. The aforementioned accompanying drawings show by way of illustration, and not by way of limitation, specific embodiments and implementations consistent with principles of the present invention. These implementations are described in sufficient detail to enable those skilled in the art to practice the invention and it is to be understood that other implementations may be utilized and that structural changes and / or substitutions of various elements may be made without departing from the scope and spirit of present invention. The following detailed description is, therefore, not to be construed in a limited sense.UCT-02325

[0038] Disclosed herein are methods and systems for measuring emissions by a digital system 100 as shown in FIG.1 by selecting a side-channel 102, detecting emissions 104 of the selected side-channel, quantifying the emissions 106, generating a random difference value that indicates a difference of the emissions from random and employing the resulting difference as a feedback mechanism to adjust the digital system 110 to modify the signature of the emissions 108 to more closely resemble random emissions. The emissions may take the form of one or more physical characteristics of the digital system that are measurable externally to the digital system (or internally to a malicious actor who gained access to the system but not to the software they are trying to learn about), such as power consumed by the digital system, heat generated by the digital system, active vs. idle time, and frequency and / or volume of digital communications transmitted by the digital system. A significant benefit is increased security to the digital system as the emissions generate feedback that is employed by the digital system to modify behavior of the digital system to cause the emissions of interest to more closely resemble random behavior, while retaining desired performance of the digital system.

[0039] Aspects of the foregoing may be employed to characterize and measure a system of interest as shown in FIG. 2. This may take the form of computer-implemented method similar to that shown in FIG. 1 except that the operations 102, 104, 106 and 108 are performed by a observational system 200 that observes computerized system 100 by selecting 102 a first side channel and detecting 104 emissions presented by the selected side channel. The emissions are characterized by a first signal that is observable external to the system 100 that is of interest. The first signal is quantified 106 to generate a first side channel leakage value. A random difference value is generated that is indicative of a difference between the first side channel leakage value and a random leakage value indicative of random behavior of the computerized system asUCT-02325 exhibited by the first side channel is generated 108. The random difference value may be used to provide a characterization or assessment of information leakage of the system 100.

[0040] The foregoing quantifies privacy characteristics of a digital system based on how distinguishable one or more externally observable characteristics of the digital system deviates from random behavior. The deviation of the behavior from random is quantified and employed as feedback to modify behavior of the digital system. This modification may be performed along a continuum to adjust behavior of the digital system to maintain desired performance while reducing susceptibility to external threats.

[0041] The digital systems referenced above may take a variety of forms including a server in a data center, a user-oriented device such as a laptop computer or mobile phone or a sensor based micro-controller. The foregoing may be better understood in the context of the following description of a Multi-Exit Neural Network (MeNNs) executed by a low power micro-controller that is in communication with a server computer.

[0042] Distributed Multi-exit Neural Networks (MeNNs) use partitioning and early exits to reduce the cost of neural network inference on low-power sensing systems. Existing MeNNs exhibit high inference accuracy using policies that select when to exit based on data-dependent prediction confidence. This specification presents a side-channel attack against distributed MeNNs employing data- dependent early exit policies. An adversary can observe when a distributed MeNN exits early using encrypted communication patterns. An adversary can then use these observations to discover the MeNN’s predictions with over 1.85X the accuracy of random guessing. In some cases, the side-channel leaks over 80% of the model’s predictions. This leakage occurs because prior policies make decisions using a single threshold on varying prediction confidence distributions. The first method, Per-Class Exiting (PCE), uses multipleUCT-02325 thresholds to balance exit rates across predicted classes. Each class may be identified by a label. This policy retains high accuracy and lowers prediction leakage, but this method may not have privacy guarantees. These guarantees are obtained with a second policy, Confidence-Guided Randomness (CGR), which randomly selects when to exit using probabilities biased toward PCE’s decisions. CGR provides statistically equivalent privacy with consistently higher inference accuracy than exiting early uniformly at random. Both PCE and CGR have low overhead, making them viable security solutions in resource-constrained settings. While this specification uses MeNNs as an example, these policies are applicable to any computer system running software with multiple paths (or control flows), where the path the software takes from input to output is determined by some combination of features of the input and operating environment. In other words, these policies are applicable to a broad class of computer systems which (1) change their behavior in response to some input or environmental factors and (2) do not already (prior to applying the policy) act randomly. A significant challenge in such systems is that their input-dependent behavior is usually implemented to exploit some sort of tradeoff. In the MeNN example, the neural network will exit early when it determines that it can reduce computation without harming accuracy. A different system might exit early when it realizes that for a given input it can reduce energy while maintaining latency. The input-dependent behavior produces the side-channel. Therefore, a key goal of the policies described herein is to maintain as many of the benefits of the tradeoff as possible while mitigating the impact of the side-channel.

[0043] Battery-powered sensors are common in applications for areas such as agriculture and healthcare. Sensor devices collect measurements from their environment, process these values, and communicate results to a server. For reliable performance, devices must meet energy and latency constraints. Thus, sensors seek ways to improve their efficiency, and a commonUCT-02325 technique for doing so is to push data processing onto the sensor device. This method is beneficial because local processing allows the device to transmit smaller aggregate results.

[0044] Modern sensor processing uses deep neural networks (DNNs) due to their high-quality results. However, DNNs have high resource costs, making them challenging to deploy on low power devices. Prior systems address this challenge by partitioning DNNs between sensor and server. The sensor device holds a subset of the DNN, and the system performs inference as follows: (i) process measurements on the sensor with the DNN subset; transmit the intermediate DNN activations to the server; and (iii) complete inference with the remaining DNN layers.

[0045] In this process, the sensor always transmits the intermediate state (Step 2), and this step requires expensive wireless communication. Sensing systems address this problem by augmenting DNNs with early exits (FIG.3). These inference models, called Multi-exit Neural Networks (MeNNs), contain early exit points which create predictions using a subset of the entire DNN. Distributed MeNNs form an initial prediction on the sensor, alleviating the need to communicate with the server.

[0046] MeNNs face a key decision when reaching an exit point: whether to terminate inference. This exit decision, which represents where the MeNN stops inference, comes with a tradeoff. Exiting earlier leads to lower inference costs by skipping subsequent layers. Early exits, however, generally reduce accuracy. Data-dependent adaptive behavior is an emerging method to balance this tradeoff. These methods determine when to terminate inference by comparing the neural network’s prediction confidence (e.g., the maximum classification probability) to a single threshold. Inference terminates when the confidence exceeds the threshold. This strategy is data- dependent because the prediction confidence is a function of the given input. These data-UCT-02325 dependent methods yield high accuracy under cost constraints because not all inputs are equally difficult to classify.

[0047] Various embodiments comprise performing MeNN early exiting from a privacy perspective. Previous data-dependent exit policies show asymmetric behavior on different predicted classes. That is, the MeNN exits early for some classes more frequently than others. This behavior occurs because MeNNs produce different distributions of prediction confidence for different classes (§2.3). Standard data-dependent methods, however, apply a single threshold to all prediction confidence values. This single threshold thus causes different average exit behavior across predictions.

[0048] This asymmetry means an adversary can learn about a distributed MeNN’s predictions by observing its exit decisions, creating a privacy issue in sensing systems for two reasons: (i) sensors leak when the distributed MeNN exits early through side-channels derived from encrypted communication patterns (§§3.2, 6.8); and (ii) sensors collect values with temporal correlations, so an adversary who extracts when the MeNN exits early observes consecutive elements with similar predictions.

[0049] With these properties, an adversary can use communication side-channels to observe a distributed MeNN’s pattern of exit decisions. The adversary can then use this pattern to infer the model’s most frequent prediction over short timescales. For example, on the task of activity recognition, this side-channel may allow a white box attacker (§3.2) to uncover 52.00% of the MeNN’s predictions (§6.8). This leakage extends to ten tasks; on average, data-dependent policies enable a white box attacker to infer MeNN predictions 1.85X more frequently than random guessing (§6.2). Further, a black box attacker (§3.2) may be built which can still inferUCT-02325 MeNN predictions at 1.56X the rate of random guessing (§6.7). Thus, privacy-conscious sensor systems cannot gain the benefits of MeNNs.

[0050] There are two common approaches to closing side-channels based on asymmetric behavior. The first method standardizes resource use. For MeNNs, this principle forces all inputs to exit at the same point. This design negates the benefits of MeNNs, resulting in either suboptimal accuracy (§6.4) or prohibitive overhead (§6.9). The second approach randomizes behavior. This method leads to an MeNN policy that exits early uniformly at random. Unfortunately, random exiting imposes a high accuracy cost (§6.4). Various embodiments comprise imposing exit policies with the following properties: (Pl) Achieve perfect privacy by having no observable relation between exit decisions and MeNN predictions. (P2) Exhibit minimal energy overhead compared to previous data-dependent methods. (P3) Display greater inference accuracy than Random exiting. (P4) Do not require retraining or redesign of existing MeNNs. This last property is important because neural network training is expensive. Solutions requiring new architectures or retraining are not compatible with existing MeNNs.

[0051] Various embodiments comprise developing one or more exit policies to meet (Pl)-(P4). Per-Class Exiting (PCE), augments prior data-dependent methods by using different confidence thresholds for each class (§4). PCE tunes these thresholds to exhibit symmetric exit rates for better privacy (§6.2). The policy retains high inference accuracy because it still makes decisions using prediction confidence (§6.4). Despite improved empirical privacy, PCE has no privacy guarantees (Pl). To achieve these guarantees, PCE with randomization may be augmented through a new policy called Confidence-Guided Randomness (CGR) (§5). CGR randomly selects an exit using probabilities biased toward PCE’s confidence-based decisions. Further, CGR optimizes the MeNN’s accuracy while maintaining privacy by adapting the bias magnitude usingUCT-02325 trends in the MeNN’s predictions. By using both prediction confidence and randomization, CGR has higher accuracy than exiting early uniformly at random (§6.4) with statistically equivalent privacy (§6.2). CGR also incurs negligible overhead (§6.9) and works with already-trained MeNNs, allowing the policy to successfully satisfy (Pl)-(P4).

[0052] Various embodiments show that previous data-dependent MeNN exit policies leak information about model predictions. For two-exit distributed MeNNs, an adversary can infer the model’s predictions under both white box and black box assumptions. Various embodiments comprise a policy called Per-Class Exiting (PCE) that uses different thresholds for inputs of each class. This method reduces the leakage of prior data-dependent policies and preserves accuracy to within 0.4 percentage points. (3) Various embodiments comprise a policy, Confidence-Guided Randomness (CGR), which integrates randomization into PCE. CGR has theoretical privacy benefits. Compared to exiting uniformly at random, CGR displays statistically equivalent privacy with higher accuracy on over 90% of target exit rates.

[0053] Various embodiments demonstrate the privacy implications of performing data- dependent distributed MeNN inference on sensing systems. According to various embodiments, privacy-conscious applications can safely achieve the performance benefits of MeNNs.

[0054] 2.1 Multi-Exit Neural Networks (MeNNs). Deep neural networks (DNNs) are statistical inference models with layers of linear and nonlinear transformations. Under supervised learning, DNNs f^^fit their parameters ^^ by minimizing a loss function (e.g., cross-entropy) on a labelleddataset D  =  { ൫^^(௧),  ^^(^)൯ }^ି^^ୀ^ . DNNs may be considered on classification tasks where ^ ^^ =has the predicted probabilities for each class in [L] = {0,1, … , ^^ − 1}. The predictedclass is ^^^ = argmaxℓ∈[^]^^^ℓ .UCT-02325

[0055] Standard DNNs process inputs ^⃗^ with all parameters θ^⃗ . However, this design isunnecessary to achieve high accuracy, as not all inputs are equally difficult to classify. DNNs can preserve accuracy with reduced execution costs using early exits; each exit is an intermediate classifier that creates a prediction with a subset of model parameters. Various embodimentscomprise a Multi-exit Neural Network (MeNN), as a collection of ^^ classifiers ^^(^)^^ =is a DNN that takes an input or output ofandcreates the predicted probabilities ^ ^^(^) ∈ ℝ^. At time ^^, the output of ^(^,௧)is ^^

[0056] MeNNs distributed across devices in a sensing system may be considered. The sensor device contains the initial layers of the MeNN, and the server contains the remaining portion of the model (FIG.3). When crossing between devices, the system must transmit the required statecontinue inference.

[0057] 2.2 Early Exit Policies. Multi-exit neural networks (“MeNNs”) must determine an exit point at which inference is terminated. A trade-off is presented: Later exits apply additional parameters and achieve higher accuracy, whereas earlier exits reduce execution cost because fewer layers are computed and less inter-device communication is required.

[0058] Prior MeNNs manage this tradeoff in a data-dependent manner using predictionconfidence. Common confidence functions ℎ: ℝ^ → ℝ include the maximumuvalue and entropyin the predicted distribution. When inference reaches the ^^௧^exit, the system compares theconfidence ℎ൫^^^(^)൯ to a threshold τ(^). If ℎ൫^^^(^)൯ ≥ τ(^), the model is “confident enough” andstops inference; otherwise, the system continues to the next exit. The thresholdscontrol how the MeNN balances the tradeoff between accuracy and execution cost. Larger thresholds yield more accurate results, and smaller thresholds result in low-cost inference. Because confidence isUCT-02325 a deterministic because the confidence is a deterministic function of the ^^௧^prediction, ^ ^^(^), various methods comprise data-dependent decisions. For example, the MeNN’s exit decisionscontain information about the model’s predictions, where the exit decision for time ^^, ^^௧ ∈ [^^],is the exit at which the MeNN stops inference.

[0059] Early exit methods are represented using a policy π: ℝ^ × ℕ → {0,1}, which takes theprediction ^ ^^(^) ∈ ℝ^ and the exit ^^ ∈ [^^]. The function outputs 0 to terminate inference and 1 tocontinue. The algorithm depicted in FIG.14 shows this procedure. The equation below is a general data-dependent policy for the confidence ℎ where [⋅]^is 1 when the condition holds and0 otherwise. Concrete policies use a specific implementation for ℎ such as ℎெ^௫^^^^(^^^) =m^∈[a^x] ^^^ప .

[0060] 2.3 Example of Information Leakage. Data-dependent exit policies create a relationship between predictions and exit decisions, enabling an adversary to infer model predictions by merely observing the exit pattern. This capability is valuable when direct access to the model’s classifications is unavailable due to encrypted communication or lack of device access. (§3).

[0061] This property was demonstrated on a speech detection task. A BranchyNet MeNN with two total exits and a data-dependent policy (Equation 1) with hMaxProb was used. When predicting the word “on,” the MeNN exits early 61.61% of the time; when predicting “off;” the early exit rate is 33.44%. Thus, early exiting means the MeNN is more likely to have predicted “on” than “off.” An adversary observing these exit decisions can infer the presence of either word from this difference, indicating that data-dependent policies expose valuable information about the MeNN’s predictions. This asymmetric behavior stems from the prediction confidence having different distributions for different classes. In this example, the average confidence isUCT-02325 0.8328 for “on” and 0.7623 for “off.” The policy, however, uses the same threshold for all inputs (Equation 1). Thus, instances of “on” are more likely to exit early through confidence scores above the single threshold, causing asymmetric behavior. Various embodiments comprise the use of multiple thresholds to account for distribution differences (§§4, 5). As shown, this privacy problem occurs on multiple tasks, MeNNs, and confidence functions (§6.2). The breadth of this leakage means the issue goes beyond a specific dataset, model architecture, or prior data- dependent policy. MeNNs are not trained to exhibit this asymmetric behavior. Nevertheless, this phenomenon was empirically observed on every considered task.

[0062] 2.4 Goals of Private Exit Policies. MeNN exit policies ^^: ℝ^ × ℕ → {0,1} are designedto meet criteria on ordered input streams ^^^ = [^^(௧)]்ି^௧ୀ^ of length ^^. The criteria may compriseone or more of: 1. π should not leak information about the MeNN’s predictions; there should be no observable relationship between the policy’s decisions and the MeNN’s classifications (P1). This quality should hold for all possible ordered streams ^^^, as system designers cannot anticipate the exact stream at design time. This consideration encompasses datasets with temporal correlations and shifting input distributions. 2. The policy must adhere to given exit rates {ρ }^ି^ ∑^ି^^ ^ୀ^ where ^ୀ^ ρ^ = 1. Under π,the MeNN should stop at exit ^^ on ρ^ ⋅ ^^ of inputs in ^^^. This criterion is necessary tomeet the resource limits of low-power devices (P2). A purely randomized policy meets these two criteria by stopping at exit ^^ with probability ρ^. However, this method reduces the MeNN’s inference accuracy (§6.4). 3. The policy should provide better inference accuracy than random exiting, which trivially satisfies P1 and P2 but degrades performance (P3).UCT-02325 4. Solutions should not require retraining or redesigning the MeNN (P4). This property is necessary because DNN training is expensive, and security solutions should work for existing MeNNs. Policies under the definition ^^ operate only on the MeNN’s predictions. Thus, these policies satisfy this property, as ^^ is not tightly coupled with the MeNN parameters. Indeed, Algorithm 1 shows how ^^ can change without altering the MeNN.

[0063] For example, it is not guaranteed that there exist MeNN exit policies that meet all four properties.

[0064] 3. Threat Model.

[0065] 3.1 Target System and Attack Goal. Various embodiments comprise a sensing system composed of edge devices and a centralized server. Each device periodically captures measurements and processes these values using a distributed MeNN, encrypting all communication. This MeNN may be referred to as a target model. The adversary may be a passive observer who uses the target MeNN’s exit decisions to expose its predictions. Theattacker may see blocks of B > 0 exit decisions. The attacker may use an attack model^^^^: [^^]^ → [^^] to infer the MeNN’s most frequent prediction in this block. Section 3.2 discusseshow the attacker may observe these exit decisions. The attacker may use a training phase to find the parameters ^^, below where ^^is the exit decision and ^^^(^^,௧)is the MeNN’s prediction attime ^^. ^^^^^^^^^^^^^^^^(⋅) returns the most common argument value.UCT-02325

[0066] The stream ^^^ may comprise temporal correlations. Such correlations may occur in sensor settings. On correlated streams, each block may contain related inputs with similar labels. Correlated streams present a greater privacy challenge. Correlated inputs cause MeNNs to make similar predictions and related exit decisions under data-dependent policies, allowing the adversary to view blocks of nearby decisions under one class. Streams with independent inputs prevent this temporal linkage. More precisely, an exit decision from one input gives theadversary one of ^^ options to recover a prediction ℓ ∈ [^^]. For uncorrelated inputs, the attackermust view each decision in isolation; when ^^ < ^^, this recovery is underdetermined. Forcorrelated inputs, the attacker may link adjacent decisions under approximately the sameprediction. With this ability, the attacker can use one of ^^^ > ^^ possible inputs to extract thisblock’s most frequent prediction ℓ ∈ [^^]. Thus, the attacker can use more features on correlatedstreams. The adversary targets the MeNN’s predictions instead of the true labels, as ground truth is unavailable at runtime. An adversary who infers the MeNN’s results learns what the target system knows.

[0067] 3.2 Adversary Capabilities. The adversary may be assumed to be targeting a sensing system known to use a distributed MeNN. The attacker has no physical device access but can sniff the communication between the sensor and the server. These assumptions are realistic for wearable sensors and devices in remote locations. The adversary cannot directly read the MeNN’s predictions due to encrypted communication. Further, without physical access, the attacker cannot deploy their own sensor to derive equivalent insights. Various embodiments may comprise exit policies following Kerckhoffs’s Principle and allow the adversary to know the policy’s details. The attacker may be assumed to know the sampling period and the target task’s label space.UCT-02325

[0068] The adversary may expose the MeNN’s predictions by inferring the model’s exit decisions using communication side-channels. Examples of how distributed MeNNs leak the decision to exit early through communication patterns are described herein. This general pattern holds for distributed MeNNs.

[0069] Deep distributed neural networks (DDNNs) implement distributed MeNNs across a hierarchy of devices. The system conserves resources by only transmitting information when continuing inference to the next device. An adversary can learn the exit decision using the presence or absence of wireless traffic.

[0070] SPINN performs distributed MeNN inference under latency constraints. When the MeNN partition point occurs after the first early exit, SPINN only communicates when not exiting early. This behavior creates the same side-channel as that of DDNNs. SPINN also supports partitions before the first exit. This setting still leaks information because SPINN requires the sensor to always compute a local prediction by continuing until the first early exit. If this exit signals termination, the sensor sends a second message to the server to stop computation. The attacker can infer an early exit using the presence of this second message.

[0071] In both cases, the passive adversary can use communication patterns to discover early exit behavior (FIG.4). In FIG. 4, an exit decision of 0 means stopping on the sensor. This side- channel exists even when data is encrypted, as encryption does not obfuscate communication volume. This adversary only knows whether the system exits on the sensor or server. Forexample, MeNNs with ^^ = 2 exits where the sensor holds the initial exit are considered byvarious embodiments. Various embodiments extend to MeNNs with ^^ > 2 (§6.10).

[0072] The adversary uses the attack model ^^^^, to infer the target MeNN’s predictions from the extracted exit decisions. At least two sets of assumptions for how the attacker fits the parametersUCT-02325 ^^ (Equation 3, which illustrates an example of a black box attacker) from examples of blocks of exit decisions and MeNN predictions may be considered. In both cases, the attacker applies ^^^^, at runtime to the target MeNN executing on an unseen testing dataset. 1. White Box: The white box adversary has access to an offline version of the target MeNN and training dataset. The attacker uses exit patterns and predictions from this MeNN on the target task to fit the attack model ^^^^. 2. Black Box: The black box adversary cannot access the target MeNN or training dataset. Instead, this adversary trains a substitute MeNNon a related task and fits ^^^^using exit decisions and predictions from(FIG.5). The black box adversary may be used to confirm that the white box assumptions are not too strong.

[0073] 3.3 Exemplary Settings Exemplary distributed DNNs in applications requiring prediction privacy are described.

[0074] Sensitive facilities use DNNs to perform license plate recognition for authorized access. Huawei’s AutoSplit framework applies distributed DNNs in this context. Prediction privacy is necessary, as the DNN’s predictions indicate which license plates have access. The attacker could use leaked predictions to create fake credentials which pass the authorization check. Further, the server may be hosted off-premise (e.g., in the cloud). Thus, when the adversary cannot access the physical location without credentials, they can still sniff the communication to the remote server. This property means the system cannot leak information about authorization decisions through communication patterns.

[0075] Manufacturing plants apply DNNs to detect defective parts, and Boomerang leverages distributed DNNs for this application. Prediction privacy is essential for two reasons. First, theUCT-02325 defect rate indicates the manufacturer’s efficiency. This information is valuable to competitors. Second, an adversary launching a supply chain attack can use exposed DNN predictions to know whether their attack is successful. In both cases, an adversary may be unable to physically access all the validation points without alerting the building’s security. Instead, the attacker can more easily observe the communication patterns to a single server, especially if the server is remote. When validating a supply chain attack, the adversary wants to know if their inserted defect passes the target’s inspection. Thus, rather than finding the true defect rate, it is more valuable to learn what the target system knows.

[0076] 4. PER-CLASS EXITING (PCE). Data-dependent MeNN policies using a single threshold can leak information through their exit decisions (§2.3). The first solution, Per-Class Exiting (PCE), replaces the single confidence threshold with separate thresholds for each class (§4.1). With this design, PCE stops a fraction ρ^of inputs for every class at exit ^^^^ thus preserving resource usage and improving privacy compared to prior work. Unfortunately, PCE has no theoretical privacy guarantees, and adversarial orderings with high prediction leakage may be constructed (§4.2).

[0077] 4.1 Policy Design. PCE may be formally described using an MeNN ^^(^)^^with target exitrates ρ ∈ [0,1] ∀^^ ∈ [^^]. Co ^^ nsider the prediction confidence function ℎ: ℝ → ℝ (§2.2).Focusing on the ^^௧^ exit, PCE uses thresholdsfor each class ℓ ∈ [^^] that satisfy theprobability below. The terms ^^^(^) ∈ ℝ^ and ^^ are random variables for the ^^௧^ exit’s predictionand the true label, respectively.

[0078] Equation 4 states that for each label, inputs should stop at exit ^^ with rate ^^^. In practice, the thresholds may be fit using the empirical confidence distributions on the task’s validation set.UCT-02325 PCE performs inference using Algorithm 1 with π^^ாbelow wherethe predicted probabilityfor class ^^ ∈ [^^] at exit ^^. The time ^^ ∈ [^^] may be omitted, as the policy is stateless.

[0079] This design augments previous data-dependent exit policies (Equation 1) with different thresholds for each class. It is emphasized that the policy selects thresholds using the MeNN’s prediction at each exit. To protect the overall classification, PCE should instead choosethresholds using the final result i.e., usewhere ℓ = arg m^∈[a^x] ^^^^ and ^ ^^ is the MeNN’s finalpredicted probabilities. At an early exit, the final prediction ^^^ is not known when not terminating inference. PCE thus uses the current exit’s prediction ^^^(^)as an approximation.

[0080] 4.2 Adversarial Data Orderings. PCE uses a data-dependent approach that fits thresholds such that the overall exit rates for each label are ρ^. This behavior means that PCE delivers good privacy on uncorrelated input orders without introducing randomization, as such streams only require long-term balancing (§6.5.2). However, this long-term balancing makes no guarantees about eliminating short-term patterns.

[0081] This insight suggests there exist input orders causing high leakage. This idea is formalized in Proposition 1 below. The proof describes how to build the adversarial ordering ^^^ and attack model(§3.1). As confirmation, the proof may be followed to build an adversarialordering with inputs from Fashion MNIST. An attack on a two-exit MeNN with PCE (ρ^ = 0.9).As expected, the adversary infers 100% of the MeNN’s predictions. Thus, despite lower empirical leakage than prior methods (§6.2), PCE delivers no privacy guarantees on correlated inputs. Instead, PCE better protects MeNNs processing unrelated inputs over time. It isUCT-02325 emphasized that Proposition 1 applies to any deterministic policy, not just PCE. FIG.14illustrates pseudocode for a two-exit MeNN. The exit index ^^ ∈ [^^] is omitted from π. The two-exit MeNN applies π at exit ^^ = 0.

[0082] Proposition 1. Let ^^: ℝ^ → {0,1} be a deterministic policy on a two-exit MeNNfor arational exit rate ^^^ = ^ெ ∈ (0,1). Let ^^ be the set of possible samples (^^, ^^), ^^௫ =∈[^^], (^^, ℓ) ∈ ^^} be the inputs, and= {^^: (^^, ℓ) ∈ ^^} be the inputs with label ℓ. Assume ∀^^Then, there exists anwith the1. The policy ^^ exhibits an early exit rate of ^^^ on ^^^.2. There exists a function ^^ ^^^: {0,1} ெ → [^^] such thatMostFreq(^^(௧), … , ^^(௧ା^ெି^)) where ^^ = ^^ ⋅ ^^^^ for^^ ∈ [^^].3. Not all non-overlapping blocks of ^^^^ exit decisions (in property 2) have the same most frequent label.

[0083] 5. CONFIDENCE-GUIDED RANDOMNESS (CGR). PCE uses a modified data- dependent method to balance the long term exit rates across classes. This method, however, does not address temporal correlations. In fact, Proposition 1 indicates that temporal dependencies can compromise any deterministic policy. Thus, temporal patterns must be obfuscated through randomization. Unfortunately, exiting early uniformly at random achieves poor inference accuracy (§6.4).

[0084] A new policy, Confidence-Guided Randomness (CGR), is instead presented. CGR is an interpolation between PCE and uniformly randomized exiting, merging the benefits of both approaches. When detecting uncorrelated inputs, CGR behaves like PCE to achieve higherUCT-02325 accuracy. On segments with high correlations, CGR applies greater randomization to maintain privacy.

[0085] CGR has three features. First, the policy evaluates PCE and uses its decision to create a confidence-biased exit probability which determines the exiting behavior (§5.1). Second, CGR adapts the bias magnitude on highly-correlated streams (§5.2). Finally, CGR enforces exit quotas over short windows to limit an adversary’s ability to discover data-dependent information (§5.3). By employing randomness, CGR achieves theoretical benefits over PCE (§5.4).

[0086] 5.1 Confidence-Biased Randomization. CGR uses PCE as an internal data-dependent method (FIG. 6). When reaching the kth exit, CGR builds an exit probability that is biasedtowardat step ^^ ∈ [^^]. CGR samples this biased probability to make a randomexit decision. Thus, CGR leverages prediction confidence through PCE, enabling higher inference accuracy than pure randomization.

[0087] This design may be formalized by considering the ^^௧^exit of an MeNNwith exitrate ^^^ ∈ [0,1]. CGR uses a bias∈ [0,1) (discussed in §5.2) at step ^^ to make randomizeddecisions with the following probabilities. The rates for^^) = 1 are one minus thosebelow. The exit indices are omitted for brevity.

[0088] These equations show how the exit probabilities are biased in the direction of PCE. Forexample, when = 0, CGR exit (^,௧)s with rate+ ^^^(1 − ^^ ) = ^^^ +^^(^,௧)(1 − ^^^) ≥ ^^^ where the inequality holds because 0 ≤≤ 1. Thus, CGR alignswith the PCE’s decision and exits more frequently than the target rate ^^^. Note that theseUCT-02325probabilities maintain an overall exit rate of ^^^ when ^^0) = ^^^. Thiscondition holds when the test distribution matches that of the training set.

[0089] 5.2 Adapting the Probability Bias Magnitude. The probability biases control a tradeoffbetween accuracy and privacy. If ^^(^,௧) ≈ 1, CGR skews toward PCE, yielding high inferenceaccuracy with possible leakage (§4). If= 0, CGR is fully randomized. CGR balances thistradeoff using the insight that PCE provides good privacy on uncorrelated input streams. Thus, CGR exploits periods of low correlation by leveraging PCE to achieve high accuracy. On highly correlated segments, CGR applies more randomness to ensure privacy. To protect the MeNN’s predictions (§2.4), CGR measures correlations using the model’s results.

[0090] CGR implements this design by adaptively setting the bias ^^(^,௧) with the parameters ^^ <1 < ^^. The policy has a maximum bias of ^^ ∈ [0,1). CGR sets ^^(^,௧) at step ^^ ≥ 1 as followswhere ^^(^,^) = ^^.

[0091] The parameters ß and γ control how the bias changes in response to the MeNN’spredictions. For example, when ^^ >> 1 and ^^ ≈ 1, CGR will quickly increase and slowlydecrease the bias. This behavior causes CGR to have a higher average bias, thereby aligningmore with PCE than pure randomization. Based on experiments, ^^ = 2.0 and ^^ = 0.9 providefavorable results, and these settings are robust across multiple datasets and data orders. Overall, CGR uses this procedure to adapt the bias to offset temporal trends in the MeNN’s predictions.CGR makes randomized decisions even when using a high bias ^^(^,௧) < 1.

[0092] 5.3 Short-Term Exit Quotas. CGR may leak predictions if the attacker infers the policy’s biased probabilities, as these probabilities encode PCE’s decisions (Equation 7). CGRUCT-02325 protects against this leakage by enforcing exit quotas over short windows. The quotas ensure the MeNN stops a set number of times at each exit point, balancing the exit counts and reducing the adversary’s analysis to smaller sample sizes. For each window, the attacker can only extract the bias direction before an exit quota becomes saturated; afterward, the policy never stops at this exit and uses no information from PCE. Exposing small samples benefits privacy because it limits the adversary’s ability to derive meaningful statistical significance on biased exit rates.

[0093] CGR implements exit quotas using a window ^^ ∈ ℕ. The policy enforces that ^^^ =⌊^^ ⋅ ^^⌋ + ^^ inputs stop at exit ^^ w ∑^ି^^ ^ here ^^^ ∈ {0,1} are random such that ^ୀ^= ^^. Thesystem no longer exits at output ^^ upon meeting its quota. After each window, the policy resetsthe quotas and randomly selects a new ^^ ∼ [^^^^^, ^^^^௫] where the bounds are parameters.This randomization limits the adversary’s ability to locate each window.

[0094] Randomizing the window size, however, does not fully prevent the attacker from discovering when CGR uses biased probabilities. For example, the adversary can use a run of exits at a single output to infer a window’s end. The theoretical privacy of this attack is not well- established. However, this attack does not present a problem for at least three reasons. First, the adversary’s recovery of each window is only approximate due to randomization. Second, CGR already protects against periods of high potential leakage by adapting its bias parameter (§5.2). Finally, CGR’s empirical information leakage is statistically equivalent to random exiting (§6.2, §6.5).

[0095] 5.4 Theoretical Benefits. This section demonstrates CGR’s theoretical benefits. The main result is Proposition 2 which establishes a bound on the probability ratio of finite exit patterns from inputs of different classes. This result improves upon PCE, which can leak an unbounded amount of information over finite time horizons (Proposition 1). A key property ofUCT-02325 CGR is that its bounds apply to any data stream, including those with temporal correlations and distributional shifts.

[0096] Proposition 2 further provides a guideline on how to set a from a security perspective, as a determines the difference between the upper and lower probability bounds. However, CGR willnot be tight with the established bounds because the policy uses biases< ^^ (§6.5) due tosimilar predictions over time (§5.2). Smaller biases create narrower probability bounds, allowing CGR to provide better empirical privacy than the proposition guarantees.

[0097] Let ^^^ be the CGR policy exit quotas and ^^, ^^: ℝ → ℝ be functions such that ^^(^^) =(1 − ^^ − ^^^(1 − ^^)) / ^^^ and ^^(^^) = (1 − ^^^(1 − ^^)) / ^^^ where ^^^ is the exit rate for ^^ = 2.

[0098] PROPOSITION 2. Consider a two-exit MeNN with a target early exit rate ^^^. Suppose a0,1 and ^^ ∈ [^^] are observed.Let these ^^ inputs belong to the same class and ^^ = ∑்ି^௧ୀ^ ^^௧. Then, ^^^ displays the followingbounds for any labels ℓ^, ℓ^ ∈ [^^].^^(^^) ^ 1 − ^^ ்ି^ (௧)^^^(^^) ^^(^^ = ^^௧∀^^|^^ = ℓ )൬ ^ ൬ ^ ^^^(^^) 1 − ^^ ^ ≥^^^(^^) ^^(^^(௧)^ = ^^௧∀^^|^^ = ℓ^)

[0099] One consequence of Proposition 2 results from the bounds having the form (^^^)^(^^^)்ି^and (^^^)^(^^^)்ି^ where ^^^, ^^^ < 1 <As ^^ → ∞, the bounds go to zero and infinity,respectively. Thus, the biased probabilities can cause unbounded exit rate differences over an infinite horizon. CGR prevents worst-case scenarios by avoiding highly biased rates over long windows, confirming the benefits of the adaptive bias procedure and use of exit quotas.UCT-02325

[0100] 6. EVALUATION. Various embodiments comprise evaluating the information leakage and inference accuracy of distributed MeNNs using previous data-dependent policies and the proposed methods. In summary, the following may be found: 1. Standard data-dependent policies leak information about MeNN predictions through their exit patterns. This leakage occurs from practical (§6.2) and theoretical (§6.3) perspectives. PCE uses multiple thresholds to reduce this leakage, and CGR obtains near-perfect privacy. 2. PCE and CGR use prediction confidence to display higher inference accuracy than a fully randomized policy (§6.4). 3. PCE has higher leakage on input streams with stronger correlations (§6.5). CGR adapts itself to protect against these trends, showing near-random leakage under temporal correlations and distribution shifts (§6.6). 4. Single-threshold data-dependent policies still leak valuable information to a black box attacker who has no access to the MeNN and training dataset (§6.7). 5. On a realistic distributed MeNN setup, prior data-dependent policies leak predictions to an attacker with access to encrypted communication patterns (§6.8). Various methods described herein provide protection in this end-to-end setting. 6. PCE and CGR show negligible overhead on a low-power microcontroller (MCU) (§6.9). Thus, policies described herein improve privacy while retaining the efficiency of MeNNs. 7. Prior data-dependent policies leak more information on MeNNs with more exits (§6.10). In contrast, CGR protects MeNNs independent of the number of exit points.UCT-02325

[0101] 6.1 Experimental Setup. 6.1.1 Datasets and Neural Network Parameters. Various embodiments comprise evaluating MeNNs on ten standard tasks (Table 1) covering many input types and label spaces. BranchyNet MeNNs may be used, focusing on models with two total exits. On Cifar, VGG models are used with early exiting after the first pooling layer. W may be use pd. Pre-trained versions of each VGG model; early exits may be attached and these output layers may be fine tuned. Dense models may be used; early exits may be attached and these output layers fine-tuned. Dense models may be applied on Activity, Food Quality, and WISDM and convolutional networks on the remainder. These MeNNs may have four hidden layers, with early exiting after the first. At most ten training epochs may be executed using Adam (step size of 10-3), a batch size of 16, and a dropout rate of 0.3.

[0102] For two-exit MeNNs, may be run on 21 exit rates ^^^ = 0.0,0.05, … ,1.0^^^ =0.0,0.05, … ,1.0. A tighter range may be used for MeNNs with more exits (§6.10). The datasetsare unordered, and two methods may be used to create the temporal correlations present in sensor settings. 1. Same-Label builds blocks of size ^^ by selecting (1 − ^^) ⋅ ^^ random elements of asingle label and ^^ ⋅ ^^ inputs from arbitrary classes. ^^ = 10 and ^^ = 0.2 are set. Appendix§9.1 considers alternate settings. 2. Nearest-Neighbor constructs ^^-sized blocks by choosing a random anchor element and using the anchor’s ^^ − 1 nearest neighbors in order.Various embodiments focus on Same-Label orders, as Nearest-Neighbor produces weak correlations on inputs such as colored images.

[0103] Table 1. Dataset # Train # Val # Test # Classes Activity 36,790 13,629 20,441 6UCT-02325 Dataset # Train # Val # Test # Classes Cifar-10 39,796 10,204 10,000 10 Cifar-100 39,796 10,204 10,000 100 EMNIST 87,800 25,000 18,800 47 Fash. MNIST 47,798 12,202 10,000 10 Food Quality 2,945 196 198 2 GTSRB 38,580 10,799 9,120 43 MNIST 47,798 12,202 10,000 10 Speech Cmds 28,532 3,457 4,482 11 WISDM 32,005 5,858 21,769 3

[0104] 6.1.2 Exit Policies. The following baseline exit policies may be used. 1. Random selects the MeNN exit uniformly at random using the rates ρ^. This policy has perfect privacy because it makes data-independent decisions. 2. Entropy is a data-dependent method (Equation 1) with confidence ℎா^௧^^^௬(^^^) =3. MaxProb is a data-dependent policy (Equation 1) with confidence ℎெ^௫^^^^(^^^) =max^∈[^]^^^^.

[0105] PCE and CGR may be applied to both confidence functions. CGR may be used with amaximum bias of ^^ = 0.5 adaptation factors of ^^ = 2.0 and ^^ = 0.9 of [5,20] (§5). Theseparameters may be set using a grid search (§9.2) and fixed for all datasets.

[0106] Confidence thresholds ^^^^ may be fit for an exit rate ^^ by setting ^^ to the (1 − ^^)௧^quantile of the MeNN’s confidence values on the task’s validation set. Both Random and CGR may be executed over five trials as these policies have stochastic behavior.

[0107] 6.1.3. Adversary Design. The attack modelmay be designed using an AdaBoost ensemble with 100 decision trees. The attack model uses non-overlapping blocks of B adjacent exit decisions to infer the MeNN’s most frequent prediction in this block. This block sizeUCT-02325 matches that of the dataset order. Two variants with different input features may be created. The first uses each exit point’s frequency, and the second uses the exact exit pattern. The frequencies may be used against Same-Label orders and the patterns on Nearest-Neighbor streams (§6.1.1). The exact pattern leads to overfitting on Same-Label orders.may be trained with two different assumptions (§3.2). 1. White box attackers use patterns from the target MeNN’s on the original task’s validation set. 2. Black box adversaries use patterns from a substitute MeNN on a related task’s validation set. For example, may always be evaluated on the target MeNN processing the test fold.

[0108] 6.1.4. Aggregate Metrics. Policies may be evaluated on many sets of target exit rates. For inference accuracy, the average result across all targets may be computed. For privacy metrics, the worst-case result may be computed by calculating the maximum over the targets, as policies should not leak information for any target exit rates (Pl). This methodology aligns with prior work in measuring security from a worst-case perspective. Trials may be aggregated by taking the average trial result for each target exit rate.

[0109] 6.1.5. Hardware Setup. Experiments may be conducted in simulation and on a low-power microcontroller (MCU). The simulator runs MeNNs in Tensorflow and records the predictions and exit decisions (§§6.2, 6.7, 6.10). The adversary observes the exact exit decisions. An end-to- end side-channel attack may be performed on a two-exit distributed MeNN with the initial exit on a TI MSP430 FR5994 MCU and the remaining model on a server (§6.8). The MCU processes inputs every second and uses Bluetooth Low Energy (BLE) to transmit the intermediate state when not exiting early. This setup follows DDNNs and SPINN on a two-device system. TheUCT-02325 sensor applies AES-128 encryption. The encrypted packets may be captured using Wireshark and this log provided to the attacker.5% of packets may be dropped to simulate a lossy link. The attacker only observes traffic when the system does not exit early. The adversary finds the number of early exits between transmissions as follows, where R is the sampling period and dn is the time of the nthmessage. num_early_exits(^^) = max(⌊(^^^ − ^^^ି^) / ^^⌋ − 1,0) (9)

[0110] It is emphasized that the side-channel attack applies to variants of this system; e.g., if the sensor sends predictions when exiting early, the attacker can infer early exits using differences in message sizes.

[0111] 6.2 White Box Attack. The practical privacy of MeNN exit policies under white box assumptions may first be measured (§6.3 discusses theoretical leakage). The white box methodology in §6.1.3 may be used to infer predictions from two-exit MeNNs with Same-Labelorders (^^ = 10, ^^ = 0.2^^ = 10, ^^ = 0.2).

[0112] FIG.7 shows the maximum attack accuracy across 21 target exit rates (lower is better). In FIG. 7, for each task shown on the horizontal axis, the attack accuracy for each model (Random, Entropy, Max Prob, PCE Entropy, PCE Max Prob, CGR Entropy, CGR Max Prob) isshown from left to right for each dataset. The attack accuracy is the accuracy of the attack modelthis metric measures the fraction of the adversary’s predictions that match the MeNN’s mostcommon classification in each temporal block. These results display how standard data- dependent policies consistently leak information about MeNN predictions. Across all tasks, thesepolicies show mean worst-case attack accuracy that is 1.87 × (Entropy) and 1.85 × (Max Prob)higher than Random. On the Food Quality task, the attacker infers up to 100% of the MeNN’s most frequent predictions in each block. Further, both methods display worse privacy thanUCT-02325 Random on all tasks. Thus, this leakage does not result from a single dataset or confidence function; instead, it comes from the data-dependent approach of previous methods.

[0113] Both PCE and CGR display better privacy. PCE yields 1.16 × (Entropy) and 1.12 ×(Max Prob) higher worst-case attack accuracy than Random. These values are lower than that of prior data-dependent policies (FIG.7), showing the benefit of multiple thresholds. CGRperforms even better, displaying 1.02 × higher worst-case attack accuracy averaged across alltasks. These policies are compared to Random using Welch’s t-test. The null hypothesis is that the attack accuracy normalized to the most frequent MeNN prediction is no different than that of Random. With this methodology, Random and CGR have an insignificant difference at the 0.05 level with ^^-values of 0.21 (CGR Entropy) and 0.09 (CGR Max Prob). Thus, CGR obtains near- random privacy independent of the confidence function. Entropy, Max Prob, and PCE show significant differences.

[0114] Entropy and Max Prob show low attack accuracy on CifarlO0, as this dataset has a large label space (Table 1). However, leakage through the attacker’s average rank (AR) of the correct class was observed. On Cifar-100, Entropy and Max Prob have a worst-case AR of 33.60 and 35.77, respectively. These values are far lower than Random (48.20); thus, attackers still learnvaluable information on tasks with many labels. Across all datasets, CGR has an AR of 0.99 ×Random, further demonstrating its near-random privacy.

[0115] 6.3 Theoretical Information Leakage. The practical attack may be supplemented with an analysis agnostic of the attack model. Privacy may be quantified using the empirical normalized mutual information (NMI) between the MeNN’s exit decisions and predictions. A high NMI means observing the exit decisions reduces the adversary’s uncertainty about the model’s predictions. A policy with no leakage should exhibit an NMI close to Random. TheUCT-02325definition ^^^^^^(^^, ^^) = (2 ⋅ ^^(^^, ^^)) / (^^(^^) + ^^(^^)) where ^^(⋅) is the mutual information and^^(⋅) is the Shannon entropy may be used. The NMI may be measured by comparing individualexit decisions (^^) and MeNN predictions (^^). The NMI may be measured by comparing individual exit decisions (X) and MeNN predictions (Y). This metric does not depend on temporal correlations. The empirical NMI’s bias may be reduced with Miller-Matlow correction. The same setup as §6.2 was used.

[0116] Table 2 shows the maximum NMI, confirming the trends in §6.2. Standard data- dependent policies show high NMI with values up to 0.1725 points higher than Random on average. Further, both policies eclipse Random on all tasks, indicating that this leakage is consistent and independent of the confidence function.

[0117] PCE improves privacy, showing an NMI of up to 0.0203 points higher than Random; thisrate is over 8.4 × lower than previous data-dependent methods (Table 2). On average, CGR has amaximum NMI of only 0.0009 points above Random. This figure is over 191 × lower than priordata-dependent policies. These results provide additional evidence that CGR has near-perfect privacy.

[0118] Table 2 shows maximum empirical normalized mutual information (NMI) (all values x10-2) between exit decisions and MeNN predictions across 21 target rates (lower is better). The final row shows the average (std dev) difference compared to Random.

[0119] Table 2 Dataset Rand Entropy Max Prob Stnd PCE CGR Stnd PCE CGR Activity 0.25 33.99 2.33 0.35 34.22 2.11 0.40 Cifar-10 0.25 5.43 0.66 0.31 5.24 0.76 0.29 Cifar-100 0.45 4.79 1.21 0.50 4.10 1.25 0.52 EMNIST 0.07 7.19 0.31 0.09 7.29 0.30 0.09UCT-02325 Fash. 0.04 19.84 0.28 0.04 19.83 0.25 0.04 MNIST Food Quality 0.24 49.62 3.73 0.11 49.62 5.73 0.33 GTSRB 1.26 8.92 5.26 1.59 9.23 4.45 1.46 MNIST 0.06 6.30 0.85 0.05 6.29 2.44 0.15 Speech 0.33 16.15 3.17 0.50 16.29 3.22 0.48 Cmds WISDM 0.42 23.61 3.32 0.58 18.77 3.14 0.55 Avg Diff v 0.00 17.25 1.78 0.08 16.75 2.03 0.09 Rand (0.00) (14.06) (1.38) (0.12) (14.01) (1.58) (0.06)

[0120] 6.4 Inference Accuracy. The second tradeoff dimension investigated is inference accuracy, as accuracy represents the MeNN’s answer quality. Two-exit MeNNs under the setup in §6.2 were used. Table 3 shows the average MeNN accuracy across all exit rates, and FIG. 8 displays the results on the Activity task. FIG. 8 shows Inference accuracy (%) on the Activity dataset. Error bars show the standard deviation over five trials. In FIG.8, the model and reference number are as follows: Random, Entropy, Max Prob, PCE Entropy, PCE Max Prob, CGR Entropy, CGR Max Prob. Three takeaways were observed. First, Random has a high accuracy penalty; existing policies achieve an average accuracy of 2.03 (Entropy) and 2.30 (Max Prob) points above Random. Second, PCE retains high MeNN accuracy, showing values within 0.5 points of its standard data-dependent variant on seven of ten datasets. Random achieves this mark only twice. Finally, CGR consistently outperforms Random on all tasks with an overallaverage accuracy of 0.51 (Entropy) and 0.57 (Max Prob) points higher. For ^^^ ∈ (0,1), CGReclipses Random on 90% (171 / 190) of target rates under both confidence functions.

[0121] Two additional results were noted. First, an alternate method to eliminate leakage is to use a fixed policy that always exits at the same point. This baseline must use the early exit to meet resource limits (§6.9), resulting in low accuracy. From FIG.8, the early exit has anUCT-02325 accuracy of about 83%; all other policies reach an average accuracy above 87% (Table 3). Thus, PCE and CGR show better accuracy under resource limits than a fixed policy. Second, Entropy and Max Prob perform poorly on WISDM. This result comes from suboptimal exit decisions due to MeNN overconfidence. PCE corrects this problem by setting higher thresholds for the overconfident classes, highlighting an alternative benefit of using multiple thresholds.

[0122] Table 3 shows average (std dev) inference accuracy across 21 target exit rates for each policy and task (higher is better). The standard deviation shows the variation in the average accuracy across five independent trials.

[0123] Table 3 Dataset Rand Entropy Max Prob Stnd PCE CGR Stnd PCE CGR Activity 87.22 89.24 88.46 87.57 89.69 88.85 87.70 (0.02) (0.01) (0.02) Cifar-10 80.35 85.18 84.83 81.69 85.50 85.17 81.78 (0.04) (0.03) (0.01) Cifar-100 61.68 64.47 64.43 62.40 64.81 64.79 62.52 (0.05) (0.04) (0.02) EMNIST 85.92 87.28 87.35 86.37 87.31 87.37 86.39 (0.02) (0.01) (0.01) Fash. MNIST 90.37 91.59 91.38 90.69 91.66 91.46 90.72 (0.03) (0.03) (0.01) Food Quality 97.01 97.34 97.34 97.09 97.34 97.34 97.09 (0.02) (0.01) (0.01) GTSRB 80.45 84.85 83.21 81.21 85.37 83.74 81.39 (0.04) (0.04) (0.05) MNIST 98.64 99.19 99.19 98.83 99.19 99.19 98.83 (0.01) (0.01) (0.01) Speech Cmds 85.94 88.58 87.76 86.43 88.78 87.92 86.40 (0.04) (0.02) (0.01) WISDM 86.31 86.48 87.81 86.68 87.24 87.93 86.77 (0.02) (0.01) (0.02) Avg Diff v 0.00 2.03 1.79 0.51 2.30 1.99 0.57 Rand (0.00) (1.55) (1.18) (0.34) (1.63) (1.31) (0.38)UCT-02325

[0124] 6.5 Alternate Dataset Orders. 6.5.1 Nearest Neighbor. Privacy may be further evaluated using the white box adversary (§3.2) on Nearest-Neighbor orders (§6.1.1) with= 10 (FIG. 9, lower is better). In FIG.9, for each task shown on the horizontal axis, the attack accuracy for each model (Random, Entropy, Max Prob, PCE Entropy, PCE Max Prob, CGR Entropy, CGR Max Prob) is shown from left to right for each dataset. CGR maintains its near-random privacy, showing 0.99× higher attack accuracy than Random on average. Using the methodology of §6.2, CGR’s attack accuracy is not significantly greater than Random. In contrast, PCE shows higher leakage on Nearest-Neighbor orders, displaying an average worst-case attack accuracy that is 1.24× (Entropy) and 1.28× (Max Prob) higher than Random. These values exceed the 1.12× (Entropy) and 1.18× (Max Prob) marks from the Same-Label order on these four tasks. This greater leakage comes from the Nearest-Neighbor order’s high correlations. Nevertheless, PCE still displays better privacy than single-threshold techniques.

[0125] CGR continues to show improved inference accuracy (Table 4), eclipsing Random on 80% (61 / 76) of target exit rates under the Max Prob metric. These results are similar with the Entropy function. However, the gap between CGR and Random is smaller than on Same-Label streams (Table 3). This difference results from CGR’s adaptive bias. The Nearest-Neighbor order contains stronger correlations, often having blocks with over 90% of elements in the same class.In turn, CGR acts more randomly. For example, on the Activity task with ^^^ = 0.5, CGR has anaverage bias of 0.1507 on Nearest-Neighbor and 0.4446 on Same-Label. CGR properly responds to greater correlations by reducing its bias magnitude.

[0126] Table 4 shows Average (std dev) inference accuracy across 21 exit rates for Nearest- Neighbor blocks (higher is better).

[0127] Table 4UCT-02325 Dataset Rand MaxProb Stnd PCE CGR Activity 87.46 (0.02) 89.99 89.17 87.51 (0.01) EMNIST 87.10 (0.01) 88.04 88.10 87.38 (0.02) Fash. MNIST 91.11 (0.03) 92.36 92.09 91.34 (0.01) MNIST 99.44 (0.01) 99.67 99.68 99.48 (0.01) Avg Diff v Rand 0.00 (0.00) 1.06 (0.57) 0.95 (0.48) 0.17 (0.09)

[0128] 6.5.2. Uncorrelated. The attack on data streams with randomly-ordered inputs may be further evaluated. In this setting, the adversary uses each exit decision to infer the MeNN’s individual predictions. Table 5 compares the average inference accuracy and maximum attack accuracy on the Activity task for Uncorrelated and Nearest-Neighbor streams.

[0129] The latter order exhibits the strongest temporal relations. The adversary still learns information about MeNN’s results in uncorrelated settings, though the attack efficacy is lower. This result may occur because the adversary has less context on uncorrelated orders (§3.1). This comparison further shows the benefits of PCE in isolation. On uncorrelated streams, PCEdisplays an attack accuracy within 3 points of Random. This figure is over 2 × smaller thanPCE’s gap to Random on the Nearest-Neighbor order. Thus, for uncorrelated streams, PCE delivers an inference accuracy of 1.7 points above Random for a small cost in privacy. It may be noted that PCE does not achieve an attack accuracy equivalent to either Random or CGR because PCE uses static thresholds fit on a training set, and the testing set contains empirical differences. Table 5 shows Mean inference accuracy (Infr. Acc.) and maximum attack accuracy (Att. Acc.) on the Activity task for Uncorrelated and Nearest-Neighbor orders.

[0130] Table 1 Policy Uncorrelated Nearest-Neighbor Infr. Acc. Att. Acc. Infr. Acc. Att. Acc.UCT-02325 Random 86.86 18.12 87.46 19.86 Max Prob 89.44 36.59 89.99 41.63 PCE Max Prob 88.57 21.14 89.17 26.47 CGR Max Prob 87.36 18.88 87.51 18.35

[0131] 6.6 Distribution Shifts. Sensing systems often face distribution shifts where the data observed at runtime differs from that used during training. The privacy impact of distribution shifts may be evaluated by constructing an alternate testing set for MNIST using the first 10,000digits from the Extended MNIST dataset. This alternate dataset has a higher mean (^^ = 0.172)and standard deviation (^^ = 0.331) pixel value than that of MNIST (^^ = 0.131, ^^ = 0.308) dueto differences in image preprocessing. The same MeNN trained on MNIST as in §6.2 may be used and the MeNN evaluated on this alternate testing set.

[0132] Table 6 shows the white box attack accuracy with the Same-Label order. Table 6 shows Worst-case attack accuracy for exit policies on an MeNN trained on MNIST and tested on either a shifted distribution (EMNIST Digits) or the same distribution (MNIST). Under distributional shifts, PCE has privacy similar to standard data-dependent exiting. This phenomenon occurs because the shifted distribution changes the MeNN’s prediction confidence, breaking thebalancing effect of PCE’s multiple thresholds. For example, when ^^ = 0.75, PCE exits early on96.88% of the digit 1 and 55.08% of the digit 7 in the shifted test set; on standard MNIST, these exit rates are 73.03% and 72.49%, respectively. Thus, under shifted distributions, PCE shows the same asymmetric exit behavior seen in previous data-dependent methods. In contrast, CGR protects against this issue by leveraging randomness. With the Entropy metric, CGR displays a worst-case attack accuracy less than that of Random. Along with this privacy benefit, CGR shows higher mean inference accuracy on the shifted test set. CGR has an average accuracy of 88.33% (Entropy) and 88.30% (Max Prob), compared to 87.07% for Random. Note that theUCT-02325 shifted distribution causes lower MeNN inference accuracy overall (Table 3). This finding aligns with prior work on neural networks facing distributional shifts.

[0133] Table 6 Policy EMNIST Digits MNIST Random 13.60 12.50 Entropy 21.80 27.40 Max Prob 20.10 27.40 PCE Entropy 19.30 13.30 PCE Max Prob 21.10 16.90 CGR Entropy 13.50 13.80 CGR Max Prob 14.20 12.50

[0134] 6.7 Black Box Attack. The white box assumptions may be confirmed as not too strong by considering a weakened attacker with black box access (§3.2). This adversary cannot access the target MeNN and only knows the number of MeNN exits ^^ and the target task’s label space (e.g., the digits 0-9 for MNIST). The adversary uses this knowledge to select a related dataset with the same label space. The attacker trains a substituteon this related dataset (Figure 3). The attacker may be assumed to use a reasonable MeNN architecture for their selected dataset (e.g., ResNet on Cifar-10). The adversary trains their MeNN by optimizing the average individual classification loss of each exit point. Finally, following black box adversarial DNN attacks, the attacker fits an attack modelon patterns from the substituteand applies ^^థto the target MeNN ^^(^)^ on the original dataset. The following attack settings may be used: 1. CifarlO Blurred: The attacker has a version of CifarlO corrupted with a Gaussian blur (r = 0.5). This version has different training and validation splits than the original. The attacker generalizes to the standard CifarlO task.UCT-02325 2. Pen Digits: The adversary attacks an MNIST convolutional MeNN with a dense substitute model trained to classify digits from sequences of (x, y) pen coordinates. 3. Spoken Digits: The attacker targets an MNIST MeNN with a substitute trained on spoken digit audio. 4. Speech Noisy: The adversary uses the Speech dataset perturbed with white noise (SNR = 50). The training and validation splits differ from those of the original. The attacker targets an MeNN on the standard Speech task. 5. WISDM Sim: The adversary uses the WISDM task’s simulated version to target an MeNN trained on real-world data, emulating an attacker collecting its own dataset.

[0135] Compared to the target MeNN, substitutes with different architectures and hyperparameters may be used (e.g., batch sizes). For example, the attacker’s substitute MeNN for Pen Digits uses five fully connected layers with sizes (8, 12, 48, 48, 48), early exiting after the second, and Leaky ReLU activations. The target MeNN processes the MNIST dataset using four convolutional layers with (16, 32, 64, 32) filters, early exiting after the first, and ReLU activations. On Cifar-10, the attacker uses ResNet-18 with early exiting after the second block. The target system uses a VGG architecture. These settings thus consider different neural networks which both achieve good accuracy on their given tasks. Each substitute may be fit three times.

[0136] Table 7 shows the maximum attack accuracy. The weakened adversary still achieves the best results against existing data-dependent policies; MeNNs using Max Prob show a meanworst-case attack accuracy of 1.56 × Random. Although this efficacy is lower than whiteboxsettings (§6.2), the black box attacker still learns valuable information despite having no offlineUCT-02325 access to the target MeNN. CGR continues to show a worst-case attack accuracy close to Random.

[0137] Table 7 Train Task Rand MaxProb Stnd CGR Cifar-10 13.20 23.30 12.80 Cifar-10 Blurred 11.93 (0.52) 19.17 (1.51) 12.30 (0.37) MNIST 12.30 27.40 12.50 Pen Digits 12.83 (0.45) 17.80 (0.72) 12.77 (0.12) Spoken Digit 12.57 (0.21) 20.17 (1.41) 12.80 (0.16) Speech Cmds 12.05 28.79 12.28 Speech Cmds Noisy 12.87 (0.42) 24.78 (4.90) 12.80 (0.28) WISDM 45.96 74.08 46.14 WISDM Sim 45.82 (0.00) 59.30 (2.19) 45.88 (0.09)

[0138] This attack works because the substitute(^)and target ^^^^MeNNs often contain similar exit behavior, even though the target MeNN is unknown to the adversary. FIG.10 shows this phenomenon, where for each prediction along the horizontal axis, the Target Model (MNIST) is on the left and the Substitute Model (Spoken Digit) is on the right. Predictions for zero and seven have similar exit rates across the two MeNNs despite training the target on images and the substitute on audio. However, these rates are not always consistent. When predicting six, the target exits early more frequently, showing why the black box accuracy does not reach that of white box settings.

[0139] 6.8 White Box Attack on Low-Power MCUs. An end-to-end side-channel attack against distributed MeNNs executing on a low-power MCU may be launched (§6.1.5). Eachpolicy may be executed for 500 inputs on the Activity task with the Same-Label order (^^ = 10),creating 50 temporal windows for the attacker.UCT-02325

[0140] FIG. 11 shows inference and attack accuracy, where for the Attack Accuracy and Inference Accuracy shown along the horizontal axis, the policies are shown from left to right in the following order: Random, Max Prob, PCE Max Prob, and CGR Max Prob. In all cases, the attacker discovers the correct exit decisions from the packet trace. Using the white box attack model ^^^^, the Max Prob policy exhibits the highest attack accuracy, while CGR reduces this leakage to Random. Further, CGR outperforms Random in inference accuracy on the MCU. These results match those from simulation (§6.2), showing how the discovered privacy issue and proposed defenses apply to real hardware.

[0141] 6.9 Energy Consumption. MeNNs reduce the average cost of inference. How CGR and PCE preserve this benefit may be shown by measuring their energy on a TI MSP430. The distributed MeNN from §6.8 may be run over 40 trials, recording the average energy to wake the CPU, execute the first exit point, evaluate the policy, and encrypt the result. When continuing inference, the energy to transmit the 128-byte state over BLE may be included. The Fixed policy always uses the same exit.

[0142] Table 8 shows the average energy for each configuration. Two aspects of these results may be highlighted. First, using the full model incurs over two orders of magnitude of overhead. This phenomenon comes from the high energy cost of communication, as early exiting allows the system to keep the BLE module off. This discrepancy shows the prohibitive cost of a Fixed policy that always uses the entire MeNN. Second, PCE and CGR incur some computation overhead compared to Random when exiting early. However, this cost is negligible compared toBLE when using the full MeNN, and for exit rates ^^^ < 1, this BLE cost dominates the energyconsumption. Further, under Welch’s t-test, an insignificant energy difference between Random and either PCE or CGR when continuing inference may be observed, with ^^^^-values of 0.94UCT-02325 (PCE) and 0.39 (CGR). Note that Max Prob has the highest average energy for the full MeNN. This result occurs due to the variance in communication energy; Max Prob also shows an insignificant difference compared to Random when using the full model. Thus, both PCE and CGR incur minimal overhead, allowing them to preserve the efficiency of MeNNs.

[0143] Table 8 Policy Exit Early Continue Fixed 0.047 (0.017) 30.813 (5.234) Random 0.049 (0.018) 31.144 (6.262) Max Prob 0.059 (0.020) 32.799 (6.114) PCE Max Prob 0.057 (0.019) 31.249 (6.243) CGR Max Prob 0.061 (0.020) 32.320 (6.646)

[0144] 6.10 Beyond Two Exits. Prior sections display the leakage present in two-exit MeNNs. However, MeNNs can have more than two exits. How the number of MeNN exit points impacts its privacy in simulation under Same-Label orders may be measured (B = 10). It is emphasized that this analysis does not yield a practical attack under the threat model; the adversary can only observe a binary decision of whether the system exits on the sensor or server (§3.2). Instead, this analysis may be included to demonstrate (1) the potential for information leakage and (2) the performance of the methods on MeNNs with K > 2.

[0145] FIG.12 displays the maximum white box attack accuracy for MeNNs with K = 2, 3, and 4. In FIG.12, for each shown along the horizontal axis the models are shown from left to right in the following order: Random, 2 Exits; Random, 3 Exits; Random, 4 Exits; Max Prob., 2 Exits; Max Prob., 3 Exits; Max Prob., 4 Exits; PCE Max Prob., 2 Exits; PCE Max Prob., 3 Exits; PCE Max Prob., 4 Exits; CGR Max Prob., 2 Exits; CGR Max Prob., 4 Exits; and CGR Max Prob., 4 Exits. Max Prob. has higher leakage on MeNNs with more exits; its average worst-case attackaccuracy is 2.20 × (two exits), 2.53 × (three exits), and 2.79 × (four exits) Random. Both PCEUCT-02325 and CGR have lower leakage compared to this single- threshold policy. In particular, CGRdisplays near-random privacy with an average worst-case attack accuracy of 1.01 × (two),1.01 × (three), and 0.98 × (four) Random. These values have no trend with the number of exits.Further, CGR still shows higher inference accuracy than Random. On the Activity task, CGR has an average accuracy of 88.72 (three exits) and 88.16 (four exits). These values eclipse Random: 88.15 (three) and 87.56 (four). Overall, prior data- dependent methods exhibit greater leakage on MeNNs with more exits, and both PCE and CGR provide protection in all contexts.

[0146] Various embodiments comprise introducing early exits into neural networks. To select an exit point, existing systems use data-dependent exit policies with a single threshold on prediction confidence. Other methods use bandit algorithms, runtime feedback, or decision agreement. Various embodiments focus on policies using maximum probability and entropy confidence, as they are cheap and well-suited for low-power sensors. Various embodiments show how these policies leak information and propose new methods to address this problem.

[0147] Various embodiments partition DNNs across multiple systems to reduce resource costs on edge devices. Both DNNs and SPINN introduce early exit behavior to improve distributed inference, creating distributed MeNNs. Various embodiments develop a side-channel attack against the communication patterns of these distributed MeNNs. Various embodiments defend against this attack through new early exit policies.

[0148] Common attacks against DNNs force misbehavior through adversarial noise. Other work induces adversarial behavior using training set poisoning, attacker-specified triggers, or batch orderings. Popular countermeasures against these attacks include defensive distillation and adversarial training. Further, existing proposals observe that MeNNs reduce the impact of adversarial examples. Previous attacks target MeNNs by crafting adversarial examples toUCT-02325 maximize the execution cost and using exit decisions to improve membership inference queries. These attacks exploit early-exit behavior in neural networks. However, various embodiments evaluate how distributed MeNNs leak predictions through communication patterns.

[0149] Various embodiments address the privacy of DNNs through homomorphic encryption and secure two-party computation. Other embodiments protect DNNs using trusted execution environments and differential privacy. Various embodiments examine DNN privacy, but create a new attack that uses exit patterns to infer MeNN predictions. Prior work leverages power, electromagnetic, and timing / memory side-channels to find DNN architectures and parameters. Various embodiments instead use the communication patterns of distributed MeNNs as a side- channel to uncover model predictions. Various embodiments further create efficient solutions for this new privacy concern.

[0150] Many side-channel attacks exploit variable behavior under different inputs or operating conditions. Various embodiments use timing and power discrepancies to extract encryption keys. Various embodiments study side-channels against varying behavior, but focus on MeNNs, which is new. Various embodiments close side-channels through fixed resource usage or randomized behavior. BuFLO and its extensions standardize traffic patterns to prevent website fingerprinting. Other systems obfuscate compromising communication patterns in sensor networks. Various embodiments use a randomization technique to retain the accuracy and resource benefits of MeNNs.

[0151] Various embodiments comprise a side-channel attack that exploits the communication patterns of distributed Multi-exit Neural Networks (MeNNs) with data-dependent early exiting. This side-channel allows an adversary to discover the MeNN’s predictions with over 1.85X the accuracy of random guessing. Various embodiments address this attack through two new exitUCT-02325 policies: Per-Class Exiting (PCE) and Confidence-Guided Randomness (CGR). PCE uses multiple confidence thresholds to reduce information leakage with inference accuracy close to prior methods. CGR augments PCE with randomization to achieve theoretical privacy guarantees and deliver consistently better inference accuracy than exiting early uniformly at random. This attack highlights how modern inference systems must consider the privacy implications of data- dependent behavior.

[0152] A.1. White Box Attack on Low-Power MCUs: Data Order Parameters

[0153] The provided experiments under the Same-Label order use a single block size (^^ = 10)and noise rate (^^ = 0.2). This analysis may be expanded by varying these parameters for ^^ ∈{10,20,30} and ^^ ∈ {0.1,0.2,0.3}. FIG. 15 shows the inference accuracy and white box attackaccuracy on the Activity task. The difference between each policy’s result and that of Random is displayed. CGR consistently has an inference accuracy of about 0.45 points above Random for all configurations. Further, CGR displays a maximum attack accuracy of only 0.51 points higherthan Random on average across all settings. This figure is over 60 × lower than that of MaxProb. In the worst case, CGR has an attack accuracy of 1.76 points above Random, occurringwhen ^^ = 10 and ^^ = 0.1. However, CGR does not have consistently lower privacy at this noiserate; for ^^ = 20 and ^^ = 0.1, CGR has a worst-case attack accuracy of 0.48 points lower thanRandom. In total, these results align with the previous experiments under a single Same-Label configuration (§6.2, 6.4). It may be noted that the adversary achieves better results against Max Prob. for larger block sizes and lower noise rates, as such characteristics yield stronger temporal correlations.

[0154] The experiments in §6 use the CGR policy with a maximum bias ^^ = 0.5, increasefactor ^^ = 2.0, and decrease factor ^^ = 0.9. The impact of these parameters on the policy’sUCT-02325inference and attack accuracy was evaluated. A grid search over ^^ ={ 0.4, 0.5, 0.6, 0.7, 0.8, 0.9 }, ^^ ∈ { 1.5, 2.0, 2.5 }, and ^^ ∈ {0.5, 0.7, 0.9, 0.99 } was performed.For each setting, the mean inference accuracy and maximum white box attack accuracy across all exit rates ^^ for the CGR policy were computed with the Max Prob confidence metric. Theseexperiments used the Activity dataset under Same-Label data order with $B = 10$ and ^^ = 0.2.Each configuration was executed over three trials and take the average result for each exit rate. The results for each parameter are presented by considering the maximum, average, and minimum values aggregated across all settings for the other two parameters. Figures 12, 13, and 14 display the results from the perspectives of the maximum bias (^^), increase factor (^^), and decrease factor (^^), respectively.

[0155] On average, larger maximum bias ^^ values lead to higher inference and attack accuracy. This trend aligns with CGR’s design (§5); larger biases allow CGR to align more with PCE, delivering better inference performance with worse privacy. Note that even with a large bias(e.g., ^^ = 0.9), CGR can still display lower inference and attack accuracy when the decreasefactor ^^ is small (e.g., ^^ = 0.5).

[0156] Both the increase(^^)and decrease factors(^^)show positive correlations with thepolicy’s inference and attack accuracy. When CGR has a small decrease factor ^^, the policy is quick to decrease the bias. This phenomenon leads to smaller bias terms on average, causing more randomness, lower inference accuracy, and better privacy. The opposite occurs when ^^nears one. In particular, when ^^ ≈ 1 and ^^ ≫ 1 (e.g., ^^ = 0.99,  ^^ = 2.5), CGR shows highinference accuracy (88.14) and attack accuracy (19.73) for a fixed ^^ = 0.9. This result matchesthe theory of CGR’s adaptive bias algorithm (§5.2), as these settings result in quickly increasing and slowly decreasing the bias term.UCT-02325

[0157] In general, it was found that ^^ = 0.5, ^^ = 2.0 and ^^ = 0.9 deliver near-random attackprivacy with favorable inference accuracy. As demonstrated, these settings are robust across multiple different tasks and confidence metrics (§6).

[0158] The terms “computer system” and “computing device” are used interchangeably herein. Unless the context clearly indicates otherwise, neither term implies any limitation on a type of computing system or computing device. In general, a computing system or computing device can be local or distributed and can include any combination of special-purpose hardware and / or general-purpose hardware with software implementing the functionality described herein. The terms “exit,” “exit decision,” and “exit branch” may be used interchangeably.

[0159] FIG. 13 illustrates a block diagram of hardware that may be employed in an implementation of the embodiments disclosed herein employing computer-executable instructions. FIG.13 depicts a generalized example of a suitable general-purpose computing system 1300 in which the described innovations may be implemented in order to improve the processing speed and efficiency with which the computing system 1300 operates to perform the functions disclosed herein. With reference to FIG. 13 the computing system 1300 includes one or more processing units 1302, 1304 and memory 1306, 1308. The processing units 1302, 1306 execute computer-executable instructions. A processing unit can be a general-purpose central processing unit (CPU), processor in an application-specific integrated circuit (ASIC) or any other type of processor. The tangible memory 1306, 1308 may be volatile memory (e.g., registers, cache, RAM), non-volatile memory (e.g., ROM, EEPROM, flash memory, etc.), or some combination of the two, accessible by the processing unit(s). The hardware components in FIG. 13 may be standard hardware components, or alternatively, some embodiments may employ specialized hardware components to further increase the operating efficiency and speed withUCT-02325 which the system 1300 operates. The various components of computing system 1300 may be rearranged in various embodiments, and some embodiments may not require nor include all of the above components, while other embodiments may include additional components, such as specialized processors and additional memory.

[0160] Computing system 1300 may have additional features such as for example, storage 1310, one or more input devices 1314, one or more output devices 1312, and one or more communication connections 1316. An interconnection mechanism (not shown) such as a bus, controller, or network interconnects the components of the computing system 1300. Typically, operating system software (not shown) provides an operating system for other software executing in the computing system 1300, and coordinates activities of the components of the computing system 1300.

[0161] The tangible storage 1310 may be removable or non-removable, and includes magnetic disks, magnetic tapes or cassettes, CD-ROMs, DVDs, or any other medium which can be used to store information in a non-transitory way, and which can be accessed within the computing system 1300. The storage 1310 stores instructions for the software implementing one or more innovations described herein.

[0162] The input device(s) 114 may be a touch input device such as a keyboard, mouse, pen, or trackball, a voice input device, a scanning device, or another device that provides input to the computing system 1300. For video encoding, the input device(s) 1314 may be a camera, video card, TV tuner card, or similar device that accepts video input in analog or digital form, or a CD- ROM or CD-RW that reads video samples into the computing system 1300. The output device(s) 1312 may be a display, printer, speaker, CD-writer, or another device that provides output from the computing system 1300.UCT-02325

[0163] The communication connection(s) 1316 enable communication over a communication medium to another computing entity. The communication medium conveys information such as computer-executable instructions, audio or video input or output, or other data in a modulated data signal. A modulated data signal is a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media can use an electrical, optical, RF, or other carrier.

[0164] The terms “system” and “computing device” are used interchangeably herein. Unless the context clearly indicates otherwise, neither term implies any limitation on a type of computing system or computing device. In general, a computing system or computing device can be local or distributed and can include any combination of special-purpose hardware and / or general-purpose hardware with software implementing the functionality described herein.

[0165] The foregoing explanation describes features of several embodiments so that those skilled in the art may better understand the scope of the invention. Those skilled in the art will appreciate that they may readily use the present disclosure as a basis for designing or modifying other processes and structures for carrying out the same purposes and / or achieving the same advantages of the embodiments herein. Such equivalent constructions do not depart from the spirit and scope of the present disclosure. Numerous changes, substitutions and alterations may be made without departing from the spirit and scope of the present invention. While the above description contains many specificities, these should not be construed as limitations on the scope of the invention, but rather as an exemplification of preferred embodiments thereof Accordingly, the scope of the invention should be determined not by the embodiment(s) illustrated, but by the appended claims and their legal equivalents.UCT-02325

[0166] Although illustrative embodiments of the invention have been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various changes and modifications can be affected therein by one skilled in the art without departing from the scope of the invention as defined by the appended claims.

[0167] As shown in FIG. 19, computer system / server 12 in computing node 10 is shown in the form of a general-purpose computing device. The components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including system memory 28 to processor 16.

[0168] Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, Peripheral Component Interconnect (PCI) bus, Peripheral Component Interconnect Express (PCIe), and Advanced Microcontroller Bus Architecture (AMBA).

[0169] Computer system / server 12 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer system / server 12, and it includes both volatile and non-volatile media, removable and non-removable media.

[0170] System memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatileUCT-02325 computer system storage media. By way of example only, storage system 34 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (not shown and typically called a “hard drive”). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media can be provided. In such instances, each can be connected to bus 18 by one or more data media interfaces. As will be further depicted and described below, memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the disclosure.

[0171] Program / utility 40, having a set (at least one) of program modules 42, may be stored in memory 28 by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data or some combination thereof, may include an implementation of a networking environment. Program modules 42 generally carry out the functions and / or methodologies of embodiments as described herein.

[0172] Computer system / server 12 may also communicate with one or more external devices 14 such as a keyboard, a pointing device, a display 24, etc.; one or more devices that enable a user to interact with computer system / server 12; and / or any devices (e.g., network card, modem, etc.) that enable computer system / server 12 to communicate with one or more other computing devices. Such communication can occur via Input / Output (I / O) interfaces 22. Still yet, computer system / server 12 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) viaUCT-02325 network adapter 20. As depicted, network adapter 20 communicates with the other components of computer system / server 12 via bus 18. It should be understood that although not shown, other hardware and / or software components could be used in conjunction with computer system / server 12. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0173] The present disclosure may be embodied as a system, a method, and / or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0174] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves,UCT-02325 electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0175] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0176] Computer readable program instructions for carrying out operations of the present disclosure may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user’s computer, partly on the user’s computer, as a stand-alone software package, partly on the user’s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user’s computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computerUCT-02325 (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0177] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0178] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function / act specified in the flowchart and / or block diagram block or blocks.UCT-02325

[0179] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0180] In various embodiments, a vector of features that includes machine learning model input(s) may be provided to one or more of the machine learning models described herein. Based on the input features, one or more of the machine learning models described herein may generate one or more outputs. In some embodiments, the output(s) of the one or more machine learning models described herein may be a vector of features.

[0181] A machine learning model is a computational system that can learn from data and perform tasks such as classification, regression, clustering, or generation. A machine learning model typically consists of a set of parameters that define its structure and behavior, and a training algorithm that adjusts these parameters based on a given objective function. In various embodiments, the one or more machine learning models, described herein, may be pre-trained using training data. In various embodiments, training data may be retrospective data. In various embodiments, the retrospective data may be stored in a datastore. In various embodiments, the one or more machine learning models, described herein, may be additionally trained through manual curation of previously generated outputs.

[0182] In various embodiments, the one or more machine learning models, described herein, may be and / or may include a dynamic programming algorithm and / or model, such as a dynamic linear programming algorithm / model or a dynamic nonlinear programming algorithm / model. InUCT-02325 various embodiments, the one or more machine learning models, described herein, may be a trained classifier, a trained regression model, a clustering model, a generation model, and / or another type of model. In various embodiments, the trained classifier may be a random decision forest. However, it will be appreciated that a variety of other classifiers are suitable for use according to the present disclosure, including linear classifiers, support vector machines (SVM), or artificial neural network models, such as generative adversarial networks (GANs), a long short-term memory (LSTM) model, and / or recurrent neural networks (RNNs).

[0183] Suitable artificial neural network models include but are not limited to a feedforward neural network, a radial basis function network, a self-organizing map, learning vector quantization, a recurrent neural network, a Hopfield network, a Boltzmann machine, an echo state network, long short term memory, a bi-directional recurrent neural network, a hierarchical recurrent neural network, a stochastic neural network, a modular neural network, an associative neural network, a deep neural network, a deep belief network, a convolutional neural networks, a convolutional deep belief network, a large memory storage and retrieval neural network, a deep Boltzmann machine, a deep stacking network, a tensor deep stacking network, a spike and slab restricted Boltzmann machine, a compound hierarchical-deep model, a deep coding network, a multilayer kernel machine, a transformer, or a deep Q-network.

[0184] One or more machine learning models described herein may be trained in epochs and / or batches. An epoch is a complete pass through the entire training dataset. A batch is a subset of the training dataset that is processed at a time. For example, all batches may be processed during each epoch. A machine learning model may be updated after processing of each batch.

[0185] A machine learning model may be updated during training based on its loss and / or an optimization algorithm. Loss is determined using a loss function. A loss function is aUCT-02325 mathematical expression that measures the discrepancy between the output of the model and the desired output, such as the ground truth labels or the target values. A loss function quantifies the error or the cost of the model’s predictions. A loss function provides a signal for the training algorithm to update the model’s parameters. Different loss functions may be suitable for different types of tasks and models and may have different properties and implications. Suitable loss functions include but are not limited to mean squared error (MSE), Cross-entropy, Kullback- Leibler divergence (KL divergence), contrastive, hinge, mean absolute error (MSE), Huber, Log- Cosh, and quantile loss.

[0186] An optimization algorithm is a numerical method that iteratively updates the model’s parameters based on the gradient of the loss function with respect to the parameters. An optimization algorithm aims to find the optimal or the best set of parameters that minimizes the loss function, or equivalently, maximizes the objective function. Suitable optimization algorithms include but are not limited to gradient descent, stochastic gradient descent (SGD), Adam, batch gradient descent, mini-batch gradient descent, momentum, Nesterov accelerated Gradient (NAG), adaptive gradient algorithm (Adagrad), and root mean squared propagation.

[0187] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order,UCT-02325 depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

[0188] The descriptions of the various embodiments of the present disclosure have been presented for purposes of illustration but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

UCT-02325 CLAIMS What is claimed is:

1. A computer-implemented method for managing a computerized system comprising: measuring a first side channel that is characterized by a first signal that is observable external to the computerized system; quantifying the first signal to generate a first side channel leakage value; generating a random difference value indicative of a difference between the first side channel leakage value and a random leakage value indicative of random behavior of the computerized system as exhibited by the first side channel; and employing the random difference value as feedback to control the computerized system.

2. The computer-implemented method of claim 1, wherein employing the random difference value as feedback to control the computerized system comprises: modifying behavior of the computerized system to reduce the random difference value.

3. The computer-implemented method of any one of claims 1-2, wherein the first side channel comprises frequency of digital communications transmitted by the computerized system to one or more digital systems external to the computerized system.

4. The computer-implemented method of claim 3, wherein the digital communications are encrypted.

5. The computer-implemented method of any one of claims 1-4, wherein the first side channel comprises quantity of power consumed by the computerized system.

6. The computer-implemented method of any one of claims 1-5, wherein the first side channel comprises heat generated by the computerized system.

7. The computer-implemented method of any one of claims 1-6, wherein the computerized system comprises a multi-exit neural network and wherein the first side channel comprises frequency of encrypted digital communications transmitted by the computerized system, andUCT-02325 caused in part by exits from the multi-exit neural network, to one or more digital systems external to the computerized system.

8. The computer-implemented method of any one of claims 1-7, wherein the computerized system comprises a low-power embedded system that executes a multi-exit neural network (MeNN) that operates in conjunction with a server in communication with the low-power controller and wherein the first side channel comprises frequency of encrypted digital communications transmitted by a low-power microcontroller to the server.

9. The computer-implemented method of any one of claims 1-8, wherein the computerized system comprises a low-power embedded system.

10. The computer-implemented method of any one of claims 1-9, wherein the computerized system comprises a plurality of low-power embedded systems that together execute a deep distributed multi-exit neural network (MeNN) that operates in conjunction with a server in communication with the low-power controllers and wherein the first side channel comprises frequency of encrypted digital communications transmitted by one or more low-power microcontrollers to the server.

11. A computer-implemented method for performing inference by a neural network comprising: (i) determining, for each of a plurality of classes, wherein each class of the classes is selectable as an output of the neural network, and for each of a plurality of exits from the neural network, a respective confidence threshold that causes a predefined proportion of samples predicted by the corresponding class to terminate inference at a corresponding branch of the corresponding class; (ii) storing each confidence threshold in a memory; (iii) receiving an input sample for input to the neural network; (iv) processing the input sample through a first exit branch to obtain (a) a provisional class label and (b) a confidence value;UCT-02325 (v) comparing the confidence value to the confidence threshold associated with the provisional class label and the first exit branch; (vi) responsive to the confidence value satisfying the confidence threshold, outputting the provisional class label as a final prediction; (vii) responsive to the confidence value failing to satisfy the confidence threshold, processing the input sample through at least one subsequent exit branch; and (viii) repeating the foregoing operations (iii), (iv), (v), (vi) and (vii) for each received sample to the neural network.

12. The computer-implemented method of claim 11, further comprising: for each exit branch and class of the neural network, storing, with an associated confidence threshold, an exit-bias probability function that maps a confidence value to a corresponding exit probability q; at run-time, computing the exit probability q for a provisional class label by evaluating the exit-bias probability function using the confidence value produced at a current exit branch; generating a random value r drawn from a uniform distribution over an interval [0, 1]; and terminating inference at the current exit branch when r ≤ q, and otherwise forwarding activations to a subsequent exit branch, wherein each exit-bias probability function is calibrated such that associated stochastic exit behavior is biased toward, but not identical to, deterministic exit decisions produced by the corresponding confidence threshold, thereby reducing side-channel information leakage while maintaining substantially the same inference accuracy.

13. The computer-implemented method of claim 12, further comprising: evaluating the Per-Class Exiting to generate a confidence-biased exit probability which determines exiting behavior; adapting bias magnitude on highly-correlated streams; and enforcing exit quotas over short windows to limit an adversary’s ability to discover data- dependent information.UCT-02325 14. A computer-implemented method for observing a computerized system comprising: measuring a first side channel that is characterized by a first signal that is observable external to the computerized system; quantifying the first signal to generate a first side channel leakage value; and generating a random difference value indicative of a difference between the first side channel leakage value and a random leakage value indicative of random behavior of the computerized system as exhibited by the first side channel.

15. A computer-implemented method for inferring, without decryption or white-box access, a class label predicted by a target multi-exit neural network (MeNN) model, the method comprising: providing a surrogate MeNN model that is architecturally compatible with a target MeNN model and having internal parameters that are accessible to an attacker; supplying to the surrogate MeNN model a plurality of reference input samples having known ground-truth labels and, for each of the reference input samples, recording (i) an exit index produced by the surrogate MeNN model and (ii) a corresponding ground-truth label, thereby forming a plurality of exit-label pairs; generating, from the exit-label pairs, a statistical mapping that, for each exit index, provides a posterior probability distribution over a plurality of class labels; passively monitoring a side-channel, comprising one of execution time, heat patterns, power, usage patterns, network traffic, and network traffic frequency associated with inference of an unknown input sample processed by the target MeNN model; determining, from one or more side-channel characteristics of the surrogate MeNN model, an exit index taken by the target MeNN model for the unknown input sample; and selecting, as an inferred class label from the target model for the unknown input sample, a class having a highest posterior probability under the statistical mapping conditioned on the exit index.UCT-02325 16. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable to perform the method of any one of claims 1-15.

Images