Bandwidth Utilization Side-Channel on ML Inference Accelerators

We prototype the VTA [16] ML inference accelerator on a Xilinx Pynq-Z1 fpga running at 100 MHz. VTA is an fpga implementation of an NPU with the widely used TVM [7] software stack. Similar to an NPU, the VTA has its own instruction set consisting of load, compute and store operations. We augment the VTA DMA controller with a memory transaction counter to log the read transactions. The model weights are not updated at inference time, hence monitoring only read transaction is enough for inferring the model dimensions. The counter accumulates the number of bytes transferred for each DMA transaction and stores in a memory-mapped register, read by the runtime driver at 250KHz.

We run six image classification DNN inference models, namely, VGG-11, VGG-16, Alexnet, Resnet-18, Resnet-34 and Resnet-50. The memory utilization shape for each of the workload is shown in Figure 3. These traces are taken with the NPU connected to system memory bus. To validate possibility of attack on the LLC interface, we have also collected traces with NPU connected to LLC through accelerator coherency port (ACP). Those traces also have similar demand signature and are not shown due to space constraints.

For layer boundary detection, we use precision and recall to evaluate the detector performance. Precision indicates the fraction of correctly detected boundaries out of the total detected boundaries. The higher the precision is, the less false positive claims the detector makes. Recall measures the fraction of correctly detected boundaries out of the all true boundaries. The higher the recall is, the less correct layer boundaries the detector misses. To evaluate layer type classification performance, we use accuracy which indicates the ratio of correctly classified samples out of all samples. We did not use accuracy for layer boundary detector because the number of non-boundary inputs outnumbers the number of boundary inputs by orders of magnitude. Using accuracy may present a falsely satisfying result.

A single DNN model consists of multiple layers. The first step in the attack is layer boundary detection. Prior arts [13, 12] demonstrated that the read-after-write (RAW) pattern on the address trace reveals the layer boundaries accurately. However, our threat model restricts attackers to use bandwidth utilization variation rather than the address trace.

Fine-grained observations enable attackers to model each layer as a time-series of bandwidth information. To identify layer boundaries, the adversary clusters the observed time-series trace into different classes. First, we collect statistics like total data transferred per sampling window, median and peak bandwidth, bandwidth standard deviation as well as frequency domain signals extracted using discrete wavelet transform (DWT) to perform feature extraction and selection. Second, the adversary builds a bag-of-words model with the extracted features, a popular Natural Language Processing (NLP) technique, on sliding windows of the trace. The combination of a bag-of-words model and sliding windows enables the attacker classifier to obtain both the frequency- and time-domain information of the collected trace. Then, the attacker performs clustering to obtain the potential layer boundary candidates. Subsequently, offline profiled termination timings of all possible layers are used to validate these candidates to reduce false positives.

The boundary detection results are shown in Table I. The table heading lists the different benchmarks with the total number of layer boundaries. Adjacent layers with a different shape (T1 in III-C) are identified as ‘easy’ because they utilize different memory bandwidth and are therefore easy to detect. The classifier can detect easy boundaries with 100% precision for AlexNet, VGG11 and VGG16. Overall, 73.9% of layer boundaries are detected across our six workloads. Note that for ResNet models, the residual layers are very short, which makes boundaries hard to detect due to our choice of sliding windows size. We leave these hyperparameter tuning (e.g. sliding window size) for future work.

Similar to layer boundary detection, we include frequency domain signals from DWT to capture tile bandwidth signatures for layer type classification. DWT detects change in bandwidth across tiles at layer boundary. The wavelets also captures sharp changes in bandwidth, which is useful for tile boundary detection.

We test victim memory traffic time-series using three classifiers: Support Vector Machine (SVM), Multilayer Perceptron (MLP), and Convolutional Neural Network (CNN), each trained on either the time-series features for potential layers or on the features extracted from DWT.

Table II shows the layer-type classification accuracy for each tested model, using bandwidth trace assuming perfect identification of layer boundaries. The last column (Overall) summarizes the weighted accuracy of all layers in all models. The first row shows classification accuracy merely using the termination timing of each layer. This is a baseline accuracy for any attacker with the knowledge of the layer boundaries (execution timing for each layers). All the layers of AlexNet and VGG-11 are identifiable using this basic classifier. These workloads have few layers and all the layers differ in their execution time. Therefore, merely having the layer termination time is sufficient to classify the layers. The accuracy decreases for deeper models like ResNets with identical adjacent layers (T3 in III-C). The 2-4th rows show accuracy of the three evaluated layer-type classifiers. From execution-time based classifier to bandwidth-based classifiers, the accuracy jumps from 84% to 93% on average. From SVM to CNN, accuracy improves with increasing classifier complexity. In addition, including frequency domain signals improves the classifier, resulting in an accuracy of 95.3%. This is because different tile size configurations have different compute/bandwidth ratios.