Neural Network Extraction via Meltdown Heap and Page Table Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep learning model extraction attacks in multi-tenancy cloud environments are limited by the inability to selectively extract target data and parse it effectively, especially in dynamic memory allocation scenarios, and existing Meltdown variant attacks assume known data locations.
Innovation Solution
A method and apparatus that utilize the Meltdown vulnerability to track dynamically allocated variables, enabling direct access to a deep learning process memory and selectively extract an artificial neural network by acquiring a page table, heap section data, and extracting the neural network instance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing Meltdown variant attacks are used to extract data, then data extraction is possible, but selective extraction of target data is not achievable and parsed extraction is difficult
Solution Approach 1:
The patent segments the memory extraction process into distinct components: first extracting the page table to obtain virtual-to-physical address mapping information, then using this mapping to selectively access specific heap sections containing target data. This segmentation enables precise control over which data is extracted, moving from brute-force extraction to targeted extraction of specific neural network parameters and structures.
Solution Approach 2:
The patent performs preliminary actions by first extracting the page table structure before attempting to access target data. This preliminary extraction of address mapping information is essential for subsequent selective data extraction, as it provides the roadmap to locate specific data regions in the victim process memory without needing to extract entire memory spaces.
2Difficulty of detecting and measuring
If Meltdown attack is used to access memory, then direct access to deep learning process memory is achieved, but tracking dynamically allocated variables is impossible without knowing their locations
Solution Approach 1:
The patent performs preliminary extraction of the page table structure to obtain virtual-to-physical address mapping information before attempting to access target data. This preliminary action provides the essential roadmap for locating dynamically allocated variables in the heap section, transforming the problem from searching unknown memory spaces to accessing known locations through the page table mapping.
Solution Approach 2:
The patent introduces the page table as an intermediary structure that bridges the attacker and the target data. By extracting and analyzing the page table first, the attacker obtains virtual-to-physical address mapping information that serves as a mediator to locate and access dynamically allocated variables without needing to know their exact locations in advance.
3Loss of information
If existing extraction attacks are used, then rough inference of neural network structure is possible, but complete extraction of all internal information is not achieved
Solution Approach 1:
The patent applies the extraction principle by directly taking out complete neural network information from the victim process memory through Meltdown attack. Instead of inferring model structure through rough approximation methods, the attack extracts the actual model parameters, weights, and architecture directly from memory, achieving complete information retrieval while maintaining efficiency through targeted access via page table mapping.
Data Source
AI summary
An artificial neural network extraction method is disclosed. The artificial neural network extraction method is performed by a computing device which can communicate with a server for providing Machine-Learning-as-a-Service (MLaaS) and which includes at least a processor, the method comprising the steps of: acquiring a page table of a process to be attacked; acquiring, on the basis of the page table, heap area data of the process to be attacked; acquiring, on the basis of the heap area data, an artificial neural network instance of the process to be attacked; and extracting a structure of an artificial neural network model on the basis of the artificial neural network instance.