Neural Network Compilation With Side-Channel Obfuscation Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning models, particularly neural networks, are vulnerable to side channel attacks that decode their parameters by analyzing measurable characteristics such as power consumption, electromagnetic waves, and time profiles, compromising security-sensitive applications like face unlock tasks.
Innovation Solution
A compiler determines obfuscating network structures during compilation, adding operations that alter measurable characteristics of critical layers in neural networks, executed concurrently or sequentially with inference operations, making it difficult to decipher the network parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If obfuscating operations are added to neural network layers, then security against side channel attacks is improved, but device complexity and computation time increase
Solution Approach 1:
The patent introduces obfuscating operations as intermediary elements between the original neural network operations and the external environment. These obfuscating operations act as a mediator that masks the true computational characteristics of the neural network from attackers, while still allowing the network to function correctly. The obfuscating operations include adding dummy computations, permuting operation orders, and inserting irrelevant operations that consume resources without affecting the final output.
Solution Approach 2:
The patent changes the parameters of neural network operations by introducing variability in operation timing, resource consumption patterns, and execution sequences. Instead of executing operations in a fixed, predictable manner, the system varies these parameters to prevent attackers from inferring network structure and parameters through side channel analysis. This includes randomizing operation schedules and modifying resource allocation patterns.
2Reliability
If obfuscating operations are added to neural network layers, then security against side channel attacks is improved, but computation time increases
Solution Approach 1:
The patent applies partial obfuscation by selectively adding obfuscating operations only to certain critical layers or operations within the neural network, rather than uniformly obfuscating all operations. This approach provides sufficient security for the most vulnerable parts of the network while minimizing the overall time overhead. The system identifies which layers require obfuscation based on their sensitivity to side channel attacks and applies obfuscating operations accordingly.
3Reliability
If obfuscating operations are added to neural network layers, then model confidentiality is improved, but energy consumption increases
Solution Approach 1:
The patent applies local quality by concentrating obfuscating operations in specific regions or layers of the neural network where they are most needed for security, rather than uniformly distributing them throughout the entire network. This allows the system to achieve adequate model confidentiality protection while minimizing energy consumption in less critical areas. The obfuscation intensity is adjusted locally based on the security requirements and energy constraints of each specific layer.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for obfuscating operations of a neural network. One of the methods includes receiving data representing a neural network. The neural network comprises parameters specifying a sequence of network layers and multiple nodes in each layer of the sequence of network layers. The neural network is compiled to generate instructions that, when executed, causes one or more computation units of a hardware device to perform obfuscating operations associated with inference operations of the neural network. The obfuscating operations, when performed, obfuscate one or more measurable characteristics of the neural network. The compiling comprises determining a target layer of the sequence of network layers; determining obfuscating network structures for association with the target layer; and compiling the neural network with the associated obfuscating network structures to generate instructions for performing the obfuscating operations specified by the obfuscating network structures.