Machine Learning Model Weight Randomization Against Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to side channel attacks (SCA) that exploit power consumption or electromagnetic emissions, allowing attackers to steal and illegitimately use the models.
Innovation Solution
Modify the weights and biases of the first two layers of a neural network by randomly permutating and scaling them before each inference run, compensating for these modifications in the subsequent layer to create a dynamic and unpredictable execution environment that prevents attackers from successfully extracting the original weights and biases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If weights and biases are modified by random permutation and scaling, then protection against side channel attacks is improved, but device complexity increases
Solution Approach 1:
The patent applies dynamics by making the weights and biases changeable rather than static. Specifically, the weights and biases are randomly permuted and scaled before each inference run, creating a dynamic execution environment that prevents attackers from extracting consistent information through side channel measurements. This dynamic transformation protects the model while maintaining the same functional output.
Solution Approach 2:
The patent changes the parameters (weights and biases) of the neural network in a controlled manner through random permutation and scaling operations. These parameter changes are applied temporarily before inference and compensated for in the output, allowing the system to protect against attacks while maintaining correctness. The parameter changes make side channel analysis ineffective without altering the model's fundamental behavior.
2Reliability
If weights and biases are modified by random permutation and scaling, then protection against side channel attacks is improved, but computation requirements increase
Solution Approach 1:
The patent applies preliminary action by performing the random permutation and scaling of weights and biases before the inference run begins. This preprocessing step prepares the protected parameter set in advance, so that during the actual inference, the system only needs to use the pre-transformed values without additional computational overhead. The compensation step also uses pre-computed values to maintain efficiency.
3Reliability
If weights and biases are modified by random permutation and scaling, then protection against side channel attacks is improved, but memory requirements increase
Solution Approach 1:
The patent merges the protection mechanism with the existing model parameters by directly transforming the weights and biases in place rather than creating entirely separate protected structures. The random permutation and scaling are applied to the existing parameter sets, and the compensation is integrated into the inference computation flow. This merging approach minimizes additional memory overhead while achieving protection.
Data Source
AI summary
A method is provided for protecting a machine learning (ML) model from a side channel attack (SCA). A permutation is performed of weights and biases for a first layer of the ML model. The permutated weights and biases of the first layer are scaled using a scaling factor greater than zero to generate scaled and permutated weights and biases for a first plurality of nodes of the first layer. The weights for a second layer immediately following the first layer are modified to compensate for the permutation and scaling of the weights and biases of the first layer. The modified weights and biases of the first and second layers are substituted for corresponding original weights and biases of the ML model. An inference engine of the ML model is executed using the modified weights and biases of the first and second layers for an inference operation.