Latest / EDGE AI POD / Stochastic Training for Side-Channel Resilient AI

Transcript

Stochastic Training for Side-Channel Resilient AI · EDGE AI POD

• 0:07
  Speaker 1: So yesterday I talked about a specific attack, a side channel attack, that can cause leaking a design secret, that can cause reverse engineering of a design and cause stealing of a trained AI model from an edge device.
• 0:22
  Speaker 1: And these are not theoretical attacks, these are practical attacks that I've shown in my lab on many devices, including Nvidia devices, arm devices, nxp devices, as well as, most recently, google, coral, hdpus, and I've discussed one solution that requires fabricating a new type of hardware that can mitigate such side channel attacks when adversaries have hands-on access and they can measure those devices.
• 0:52
  Speaker 1: So the question that I got was what about existing devices that are out there, that are already deployed or that are being produced?
• 1:01
  Speaker 1: Can we improve the security of those devices, even so slightly if possible, so that we can improve the security at least for the existing solutions?
• 1:14
  Speaker 1: So in this talk I'm going to say yes to that question.
• 1:18
  Speaker 1: I'll show a way to change the training so that the devices will become more resilient against these kinds of attacks, and I will show you a solution that can increase the memory size linearly to achieve a quadratic improvement in side-channel resilience.
• 1:35
  Speaker 1: So I've already discussed why machine learning models are valuable and why we may want to keep them proprietary, because we pay a lot of money to develop those models and, moreover, once you leak device details and a trained AI model, your system will become more vulnerable to other types of attacks, which are especially critical for missile mission control systems or safety critical systems.
• 2:03
  Speaker 1: So we want to keep machine learning models secure and safe and keep them private.
• 2:09
  Speaker 1: There are so many attacks published.
• 2:12
  Speaker 1: Don't trust my word.
• 2:13
  Speaker 1: Trust all these great researchers out there, and I'll be talking not about these kinds of attacks, but I'll be talking about defense that you can deploy on your current solutions, including the devices that you see out there.
• 2:27
  Speaker 1: So the problem with previous approaches, including my own work, was that we either do this on hardware or in software, or in hardware-software co-designs.
• 2:38
  Speaker 1: If you do it in a hardware-driven way, you need to tape out a new chip, which you don't want to do.
• 2:44
  Speaker 1: Do just to add security.
• 2:45
  Speaker 1: If you want to use software, then you need to be able to support these weird low level arithmetic functions that you don't have in your native instruction sets.
• 2:56
  Speaker 1: So you cannot essentially use these existing solutions on existing edge TPUs.
• 3:03
  Speaker 1: That's why all these developed defenses are meaningless for existing TPUs.
• 3:13
  Speaker 1: So here is what we did.
• 3:15
  Speaker 1: So we took this Google Core Edge TPU, which we've shown to be vulnerable against side channel attacks, and this is quite good.
• 3:24
  Speaker 1: It can support various applications and it doesn't have any side channel attacks.
• 3:26
  Speaker 1: And this is quite good.
• 3:26
  Speaker 1: It can support various applications and it doesn't have any side channel defense, obviously just like any other devices out there.
• 3:32
  Speaker 1: The problem with having defenses here is that you have no control over hardware.
• 3:38
  Speaker 1: The hardware is proprietary.
• 3:39
  Speaker 1: You have no control over compiler.
• 3:41
  Speaker 1: The compiler is proprietary.
• 3:43
  Speaker 1: You have no control about instruction set architecture.
• 3:45
  Speaker 1: Instruction set architecture is proprietary, and so the source code that you can run on this is limited to TensorFlow or TensorFlow Lite.
• 3:54
  Speaker 1: So you have some control over the source code, but once you click a button, you don't know what happens after that.
• 4:01
  Speaker 1: Right, so can we put some level of security in those devices?
• 4:07
  Speaker 1: That's what we did.
• 4:09
  Speaker 1: So we developed a practical solution that can work on such devices so that you can improve the security of those devices to sophisticated side channel attack, and I'll leave it to Dr Anuj Dubey to present the rest of the slides.
• 4:29
  Speaker 1: Thanks, Aitain.
• 4:31
  Speaker 2: Hello everyone, I'm Anuj and yeah, before I begin, because I work for Amazon as a security engineer.
• 4:38
  Speaker 2: Whatever I present today reflects the opinions of just me and me myself, not Amazon in any ways.
• 4:45
  Speaker 2: All right, cool.
• 4:46
  Speaker 2: So now that we have already set the pretext that we have this device which we have very less control over and we still want to provide some kind of side channel protection right, without changing the hardware.
• 4:51
  Speaker 2: So how do we have this device which we have very less control over and we still want to provide some kind of side channel protection without changing the hardware?
• 4:57
  Speaker 2: So how do we do this?
• 4:58
  Speaker 2: Am I audible?
• 5:04
  Speaker 1: We need to speak up, check, check.
• 5:08
  Speaker 2: Am I good?
• 5:08
  Speaker 2: All right, cool, okay.
• 5:12
  Speaker 2: So some preliminaries.
• 5:14
  Speaker 2: I don't think I need to explain this in way too much detail.
• 5:18
  Speaker 2: How do we train neural networks?
• 5:20
  Speaker 2: We create some kind of a neural network architecture with a certain number of layers, some number of nodes in each layer, and then we instantiate, we initialize the parameters, either randomly or based on some fixed algorithm, and then we simply propagate, feed forward propagations of those initialized models.
• 5:39
  Speaker 2: We get the outputs, we compare it with the ground truth and then we compute the loss, and then we differentiate the loss, or in other words, compute the gradients and we propagate them back, and then we tune the parameters until we get a good enough accuracy.
• 5:54
  Speaker 2: There are many loss functions available here.
• 5:56
  Speaker 2: I'm just showing one particular loss function.
• 5:59
  Speaker 2: The main point I wanted to explain here is that the product of training is these model parameters.
• 6:08
  Speaker 2: That is what we are tuning.
• 6:09
  Speaker 2: Consider it like a bunch of knobs which we are tuning until we get a specific accuracy.
• 6:14
  Speaker 2: So it's these model parameters that we really care about when we are training, and this will come into picture later.
• 6:21
  Speaker 2: Now, apart from just that, that was the code or the algorithm.
• 6:26
  Speaker 2: But if you want to visualize the process of training.
• 6:28
  Speaker 2: Essentially, it's like this high dimensional plane which represents the loss function.
• 6:34
  Speaker 2: You know, high dimensional plane which represents the loss function, and when I'm training, all I'm doing is I start at a particular point on that plane, considering this three-dimensional figure for easy visualization.
• 6:43
  Speaker 2: We can start at any of those.
• 6:45
  Speaker 2: Is this working?
• 6:46
  Speaker 2: Alright?
• 6:46
  Speaker 2: Cool, so we can start at a fixed point, theta, and then we compute those gradients and the expectation is that slowly, we will, you know, converge into some kind of a local minima.
• 6:56
  Speaker 2: If you do this again, well, it may end up in a different local minima, right?
• 7:01
  Speaker 2: And the reason is that this process has got some inherent randomness in it.
• 7:05
  Speaker 2: We shuffle the batches, we can initialize these parameters randomly or based on some fixed algorithm, but that would still have some kind of randomness.
• 7:14
  Speaker 2: So, because of all all this randomness, what is happening is we are ending up with different model parameters each time we train the same machine learning model, and that is crucial.
• 7:22
  Speaker 2: That is important why?
• 7:23
  Speaker 2: Because, as a security engineer, I'm always hungry for randomness, right?
• 7:27
  Speaker 2: If I have randomness, I can somehow use it in some kind of a countermeasure which would add side channel protection, and you can read side channel protection literature and you'll see that most works require some form of a random number generator, because randomness makes it difficult for an attacker to guess what is actually happening in the hardware, right?
• 7:46
  Speaker 2: So that was the whole point.
• 7:46
  Speaker 2: That was my initial intuition.
• 7:48
  Speaker 2: Maybe try to use this stochasticity in the training.
• 7:51
  Speaker 2: Now how do we do that?
• 7:53
  Speaker 2: Well, now that we have the stochasticity, we need to propose something right, and here's my proposal.
• 7:59
  Speaker 2: So on the left-hand side, I'm just showing how we typically perform neural network training and inference.
• 8:06
  Speaker 2: After training, we get this set of parameters W0, w1, w2, and then we just use the same set of parameters during inference.
• 8:13
  Speaker 2: And here's my proposal for secure inference.
• 8:17
  Speaker 2: So we don't train the machine learning model once, but many, many times.
• 8:20
  Speaker 2: In this example, I'm showing that I trained this thrice.
• 8:23
  Speaker 2: The superscript represents the training right, the training number, and the subscript is just representing the layer and the parameters.
• 8:33
  Speaker 2: And then what we'll do is that was the training, so we train it thrice.
• 8:37
  Speaker 2: And then, when we move to inference, we create this randomizer function.
• 8:41
  Speaker 2: I'll talk about this in detail, but this is just like an if condition.
• 8:44
  Speaker 2: So it takes as input some random number, r, and based on that value, it will choose one of these three models for each inference.
• 8:52
  Speaker 2: So even if you try to infer the same image twice, you may end up using a different set of model parameters.
• 9:00
  Speaker 2: And that's how I'm trying to use that stochasticity, because I trained the machine learning model multiple times.
• 9:05
  Speaker 2: I don't have to do anything special.
• 9:06
  Speaker 2: It will automatically be randomly tuned and then all I'm doing is I'm picking and choosing randomly during inference in runtime.
• 9:15
  Speaker 2: Great, so we have a solution.
• 9:18
  Speaker 2: What's the problem?
• 9:18
  Speaker 2: Well, the problem is that the edge TPU that we're using it's specifically created for machine learning, right?
• 9:26
  Speaker 2: So this is not like a regular CPU where you can write if-else conditions and just execute them on hardware.
• 9:32
  Speaker 2: It's a very specific hardware which has something called a systolic array, you know, and it completely depends on the schedule that the compiler creates.
• 9:39
  Speaker 2: So the compiler will create some kind of a schedule and then it will push all that data to the systolic array.
• 9:44
  Speaker 2: The systolic array will crunch these numbers in a very, very deterministic way, because there is no non-determinism in machine learning models, right?
• 9:52
  Speaker 2: When we're inferring, it's the same thing that we just do many, many times.
• 9:56
  Speaker 2: So that was the first problem.
• 9:57
  Speaker 2: How do we really create that randomizer function?
• 10:00
  Speaker 2: And after scratching my head for many, many months.
• 10:04
  Speaker 2: This was my second intuition.
• 10:06
  Speaker 2: So if you look at the relu function, which is our favorite friend, the most popular activation function that we use, relu is essentially an if condition, right?
• 10:14
  Speaker 2: I mean, this is essentially what ReLU is right.
• 10:18
  Speaker 2: And my intuition was can we really use this if condition to implement what I was proposing in the previous slide?
• 10:26
  Speaker 2: Well, as it turns out, we can, and we'll do this in the next slide.
• 10:32
  Speaker 2: So let's try to use the ReLU function and build an if-else condition.
• 10:36
  Speaker 2: So let's start with some number, r, which can randomly be either minus 1 or plus 1.
• 10:44
  Speaker 2: So 50-50% probability.
• 10:45
  Speaker 2: And then we pass it through a ReLU function.
• 10:48
  Speaker 2: So what I'm showing in these curly braces is the possibility.
• 10:52
  Speaker 2: So if r was minus 1, the output of ReLU would be 0.
• 10:53
  Speaker 2: If r was minus 1, the output of ReLU would be 0.
• 10:56
  Speaker 2: If r was plus 1, the output of ReLU would be 1.
• 10:59
  Speaker 2: What do we do next?
• 11:00
  Speaker 2: We multiply this output with one of the weight tensors that I received from the training.
• 11:07
  Speaker 2: So I'm doing multiple trainings From one of the trainings, what I received.
• 11:11
  Speaker 2: I'm just multiplying that with this output of the ReLU function.
• 11:14
  Speaker 2: And what will happen if r was minus 1, I'll end up getting a 0, if r was plus 1, I'll end up getting a w1, or the actual weight tensor.
• 11:23
  Speaker 2: We'll do the same thing in a parallel path, but I'll flip the minus 1 and plus 1 here, so the minus 1 and plus 1, I'll just multiply, multiply minus 1, so now it becomes plus 1, minus 1.
• 11:34
  Speaker 2: And then I repeat the same process on the second weight tensor, right, which, let's say, is w2, and what would happen is, as you can see, the 0, which was in the first position, will now be w2 right, because I flipped the ones and the minus ones, and the second one would be 0, and the solution is slowly starting to come together.
• 11:52
  Speaker 2: So now I do have these two weight tensors which, based on a certain number, r is either W1 or 0, or either W2 or 0.
• 12:02
  Speaker 2: So what's the final step?
• 12:03
  Speaker 2: I just need to add these two tensors.
• 12:06
  Speaker 2: The moment I add them, I get this emulated if-else condition from ReLU which, based on minus 1, will output W2, or based on plus one, will output w1.
• 12:16
  Speaker 2: Okay, that's, that's essentially the function that I created in this circuit.
• 12:21
  Speaker 2: Now.
• 12:23
  Speaker 2: So that was the meat of the talk, that was the main presentation.
• 12:26
  Speaker 2: You still have a lot done, perfect, cool.
• 12:29
  Speaker 2: So let's talk about what we did next.
• 12:31
  Speaker 2: So now that we built this relu function, we know we can execute, if else conditions conditions on a TPU which does not natively support any kind of control flow instructions.
• 12:39
  Speaker 2: There are multiple things we can do.
• 12:43
  Speaker 2: The first thing is what I proposed.
• 12:44
  Speaker 2: So we train the machine learning model multiple times.
• 12:48
  Speaker 2: We get a set of weight tensors and then I'm just picking and choosing one based on this emulated if else condition that I built right.
• 12:54
  Speaker 2: And that would mean if I trained the machine learning model m times, I would have m permutations right or m possibilities.
• 13:02
  Speaker 2: If an attacker is trying to, let's say, conduct multiple experiments, by definition one out of m times the same model will repeat, right.
• 13:09
  Speaker 2: And this is important.
• 13:10
  Speaker 2: Why?
• 13:11
  Speaker 2: Because I want to increase this m.
• 13:13
  Speaker 2: If I have too many possibilities, it's difficult for the attacker to now guess which was the correct model parameter, right.
• 13:20
  Speaker 2: So this is where we started to see if we can make this better, can we reduce the randomness costs and still provide the same level of security?
• 13:28
  Speaker 2: And that's where we move from choosing the entire model by itself this specific idea to choosing between layers.
• 13:36
  Speaker 2: So I'm essentially reducing the granularity of the model parameters that I'm training, instead of choosing all the model parameters together.
• 13:45
  Speaker 2: Now what will happen is, among three models that I chose during runtime, I'm going to choose the parameters per layer.
• 13:52
  Speaker 2: So for the first layer, I may end up choosing the model parameter from the 0th model.
• 14:00
  Speaker 2: In the second layer, I may end up choosing the first one.
• 14:03
  Speaker 2: So this is going to increase the number of permutations.
• 14:06
  Speaker 2: Why?
• 14:06
  Speaker 2: Because now I still have the same number of machine learning models, but now because I'm working at a layer.
• 14:11
  Speaker 2: Granularity now it's not m anymore, it becomes M to the power, n.
• 14:15
  Speaker 2: Right, because we have the number of models that we trained on and then for will find it difficult to attack.
• 14:38
  Speaker 2: Well, but this cannot work in a straightforward fashion.
• 14:41
  Speaker 2: Right?
• 14:41
  Speaker 2: Because I trained the machine learning model for all the layers, so I cannot just use the layer parameters from multiple models randomly.
• 14:50
  Speaker 2: I tried doing that.
• 14:51
  Speaker 2: That decreased the accuracy.
• 14:52
  Speaker 2: Why?
• 14:52
  Speaker 2: Because the machine learning model was trained assuming a certain set of parameters in each layer.
• 14:59
  Speaker 2: So I cannot just randomly swap parameters, which means I do have to now train the machine learning model also and make it aware that I am going to do this in the inference, which is where the secure training.
• 15:12
  Speaker 2: The stochastic secure training of my title comes into picture.
• 15:15
  Speaker 2: And this was not very difficult.
• 15:17
  Speaker 2: I mean, the code still remains the same.
• 15:19
  Speaker 2: It's still the same algorithm.
• 15:20
  Speaker 2: What will happen during training now is based on this value of R, multiple layers may get these propagated gradients and automatically tune itself to still work.
• 15:31
  Speaker 2: Perfect.
• 15:33
  Speaker 2: And yeah, because I used relu and not a weird if-else condition, this still remains differentiable, right?
• 15:41
  Speaker 2: So I don't really have to do anything when I'm talking about back propagation, because I'm using relus, I can propagate these gradients to any of these multiple trained models within the same model.
• 15:52
  Speaker 2: And just, you know some accuracy numbers.
• 15:55
  Speaker 2: I did not use the bells and whistles and try to pump the accuracy all the way to 100, but if we assume this baseline, um the model wise training, which is when I'm swapping entire models, it's roughly around the same.
• 16:07
  Speaker 2: Um, there's a slight decrease, but it's not too much.
• 16:10
  Speaker 2: And for the layer wise models also, um, this is around the same lines.
• 16:15
  Speaker 2: So there was not a lot of decrease in the accuracy after using the secure training method or the model wise training methods, simply because I'm still training, right, I'm still training.
• 16:28
  Speaker 2: It's just that I'm not training one set of parameters, but multiple parameters, so I'm not going to see a lot of decrease in the accuracy and we can also increase it by increasing the number of epochs.
• 16:38
  Speaker 2: This was our side channel setup.
• 16:39
  Speaker 2: This is the XYZ table.
• 16:41
  Speaker 2: That's the oscilloscope.
• 16:42
  Speaker 2: This chip is the Edge TPU.
• 16:44
  Speaker 2: Well, this entire board is the development board shipped by Google, and somewhere here is the Edge TPU and this is all side channel setup that we used to capture the power traces.
• 16:56
  Speaker 2: Why?
• 16:56
  Speaker 2: Because we want to capture the power traces.
• 16:57
  Speaker 2: Why?
• 16:57
  Speaker 2: Because we want to conduct this test, called test vector leakage assessment, which basically tells how much side channel leakage is present in this piece of hardware that I'm evaluating.
• 17:15
  Speaker 2: And the simple idea is you run two tests, one with fixed plaintexts and one with random plaintexts, and then you just try to see if those are statistically different.
• 17:19
  Speaker 2: And the plot should look something like this if it's secure, between the thresholds of plus minus 4.5, or it's going to look like this if it's insecure.
• 17:28
  Speaker 2: So all these places where the T scores are crossing these thresholds, those are the points where it could be attacked.
• 17:34
  Speaker 2: And yeah, just wanted to show you the results here, without the training, without any defense.
• 17:43
  Speaker 2: The lower plot is the T-score plot and the upper plot is the power side channels plot.
• 17:48
  Speaker 2: So you can see that the T-scores, or the leakage, is somewhere around 140 to 150 without any defense, and once I apply the defense which I just, it drops down to nearly half, around 70.
• 18:01
  Speaker 2: So well, there's still leakage, right, because the thresholds are crossing 4.5, but it's still not.
• 18:06
  Speaker 2: It's still less than what it was before.
• 18:08
  Speaker 2: So if we cannot change the hardware, we cannot change the compiler and we just have the source code to change.
• 18:13
  Speaker 2: This is what.
• 18:14
  Speaker 2: This is one way we can achieve some kind of the side channel security.
• 18:18
  Speaker 2: Yeah, this was the final slide.
• 18:20
  Speaker 2: To conclude, machine learning models, as my advisor already explained, are vulnerable to side channel attacks and we need to invest all our resources into developing more and more efficient and robust techniques to provide some kind of side channel defense.
• 18:33
  Speaker 2: Right, because AI is moving towards the edge as the days pass by, and if it's moving on the edge, it's physically accessible and anybody can run these attacks.
• 18:41
  Speaker 2: So, yeah, that was more or less my talk.
• 18:44
  Speaker 2: Yeah, thank you.
• 18:46
  Speaker 2: Thanks very much.