Neural Network Weight Masking Against Side Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to side channel attacks (SCA) that exploit power consumption or electromagnetic emissions, allowing attackers to steal and monetize the models.
Innovation Solution
The method involves generating random bits to conditionally negate weights and inputs in the weighted sum computations of the first two layers of a neural network during inference operations, ensuring that either the correct or negated values are passed between layers, making it difficult for attackers to determine the actual weights and biases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the ML model processes data through standard weighted sum computations, then the model operates efficiently with normal computational flow, but the model becomes vulnerable to side channel attacks that can extract weight and bias information
Solution Approach 1:
The patent applies preliminary action by pre-generating random mask bits and preparing masked weight and bias values before the actual inference computation. This preliminary masking of weights and biases with random values prevents side channel attacks from directly observing the true parameter values during computation, while the masking operations are set up in advance to streamline the actual inference process
Solution Approach 2:
The patent introduces an intermediary masking mechanism where random mask bits and masked weight/bias values act as intermediaries between the actual model parameters and the computation process. These intermediaries hide the true weight and bias values during side channel measurements while allowing the computation to proceed, effectively mediating between security requirements and computational functionality
2Reliability
If the model applies masking to all layers, then security against side channel attacks is maximized, but computational overhead and processing time increase significantly
Solution Approach 1:
The patent applies local quality by selectively applying masking only to the first two layers of the neural network rather than uniformly masking all layers. This localized approach focuses security efforts on the layers where side channel attacks are most effective while reducing the overall computational overhead and processing time required for masking operations across the entire network
Solution Approach 2:
The patent implements partial action by applying masking to only the first two layers of the neural network instead of all layers. This partial application of masking provides sufficient security against side channel attacks which are most effective on early layers, while avoiding the excessive computational overhead that would result from masking every layer, thus optimizing the balance between security and performance
Data Source
AI summary
A method is provided for protecting a machine learning (ML) model from a side channel attack (SCA). The method is executed by a processor in a data processing system. The method includes generating a first random bit. A first weighted sum is computed for a first connection between a node of a first layer and a node of a second layer of the ML model. The first weighted sum for the first connection is equal to a multiplication of the weight of the first connection multiplied by an input to the selected node. In the multiplication, one of the weight or the input is negated conditioned on a value of the random bit. A first output including the computed first weighted sum is provided to one or more nodes of a second layer of the plurality of layers.