Side-Channel Aware Training for ML Accelerators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Providing side-channel security in commercial machine learning accelerators is challenging due to existing constraints, including proprietary software stacks and hardware limitations, which make it difficult to implement effective countermeasures.
Innovation Solution
A novel side-channel awareness training method is proposed that uses multi-model training and randomized backpropagation to create side-channel resistance without requiring changes to the hardware or software toolkit, leveraging the stochastic nature of neural network training to shuffle parameters during inference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If side-channel countermeasures are implemented in commercial accelerators, then side-channel security is improved, but device complexity and implementation difficulty increase due to proprietary software stacks and hardware constraints
Solution Approach 1:
The patent applies parameter changes by modifying the training process parameters through randomized backpropagation and multi-model training. Instead of changing hardware architecture or software toolkit, the invention changes the training parameters and stochasticity of the neural network to create side-channel resistance. This resolves the contradiction by achieving security improvement without increasing device complexity.
Solution Approach 2:
The patent creates multiple copies of the neural network model through multi-model training, where each model is trained with different random initializations and training trajectories. During inference, the system selects from these copied models to confuse side-channel analysis. This copying approach achieves security without requiring complex hardware modifications.
2Loss of information
If multi-model training and randomized backpropagation are used, then side-channel leakage is reduced, but training time and computational resources increase
Solution Approach 1:
The patent applies partial action by training multiple models with different levels of stochasticity and selecting only the necessary number of models to achieve adequate side-channel protection. Rather than training an exhaustive number of models, the system uses a pragmatic approach where a limited number of models provide sufficient security while keeping training time manageable. This resolves the contradiction between security improvement and time consumption.
3Reliability
If randomness is introduced in parameter selection during inference, then side-channel resistance is improved, but computational overhead during inference increases
Solution Approach 1:
The patent applies preliminary action by pre-training multiple models with different random initializations and training trajectories before inference. The stochasticity is built into the models during training, so that during inference, the system only needs to select from pre-computed models rather than generating randomness dynamically. This preliminary preparation reduces the computational overhead during inference while maintaining side-channel resistance.
Data Source
AI summary
Various examples are provided related to side-channel awareness. In one example, a method for side-channel awareness training includes generating trained models by stochastically training neural network models using a common training dataset; generating an inference model based upon random selection of parameters from one or more of the trained models; and training the inference model with the selected parameters. The trained inference model can be executed on an edge Tensor Processing Unit (TPU). The models can be trained offline. An input signal can be processed using the trained inference model to generate an output signal for transmission.