Dual-Rail Weight Vector Encoding for ML Side Channel Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to side channel attacks (SCA) that exploit power consumption or electromagnetic emissions, allowing attackers to steal and monetize the models.
Innovation Solution
Representing weights as two-element binary vectors where the second element is the negation of the first, performing vector operations to maintain constant power consumption, and adding an offset to prevent zero values, thereby protecting the model from SCA.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard ML model computations are used, then model functionality is maintained, but power consumption varies and reveals information to attackers
Solution Approach 1:
The patent transforms weight parameters from scalar values to dual-rail vector representations (w, -w), fundamentally changing the parameter structure. This transformation ensures that the Hamming weight remains constant regardless of the actual weight value, thereby eliminating power consumption variations that would otherwise leak information about the model weights during inference operations
Solution Approach 2:
The patent introduces a dual-rail dimension by representing each weight in two complementary channels (positive and negative rails). This dimensional expansion from scalar to vector space allows the system to maintain computational functionality while ensuring that power consumption remains constant, as the combined activity in both rails masks the actual weight values from side-channel attackers
2Reliability
If weights are represented as binary vectors with constant Hamming weight, then power consumption becomes constant and protects against SCA, but computational complexity increases
Solution Approach 1:
The patent segments each weight parameter into two separate vector components (w and -w) that are processed independently through dual-rail logic. This segmentation allows standard computational operations to be decomposed into manageable steps that maintain constant power consumption while preserving the original computational functionality, thereby reducing the perceived complexity increase
Solution Approach 2:
The patent creates a redundant copy of each weight parameter in the form of its negation (-w). This copying strategy allows the system to perform computations on both copies simultaneously, ensuring that power consumption remains constant while the redundant structure facilitates easier implementation of protected operations compared to entirely new computational approaches
3Measurement precision
If zero values are allowed in weight vectors, then model accuracy is maintained, but zero values create detectable power consumption patterns
Solution Approach 1:
The patent applies preliminary anti-action by pre-processing weight values to eliminate zeros before they can create detectable power patterns. By adding an offset to shift all values away from zero and using dual-rail encoding, the system proactively prevents the creation of vulnerable zero-state conditions that would otherwise reveal information through characteristic power consumption signatures
Solution Approach 2:
The patent introduces asymmetry by representing zero values in an unconventional manner within the dual-rail system. Instead of using symmetric (0, 0) representation which would be detectable, the system uses asymmetric representations that maintain constant Hamming weight, thereby breaking the symmetry that attackers would exploit to detect zero values and infer information about the model
Data Source
AI summary
A method is provided for protecting a machine learning model from a side channel attack. A weighted sum vector having first and second elements is initialized. A weight vector for a connection between a node of a first layer and a node of a second layer is multiplied with an input vector to the node of the first layer. A first element of the weight vector includes a weight, and a first element of the input vector includes the input. A second element of the weight vector is a negation of the first element of the weight vector and the second element of the input vector equals the first element of the input vector. A multiplication result is added to the weighted sum vector to produce a computed weighted sum vector. An output vector including the computed weighted sum vector is provided to the node of the second layer.