Side-Channel Attack Analysis on In-Memory Computing Architectures

In-memory computing (IMC) systems have great potential for accelerating data-intensive tasks such as deep neural networks (DNNs). As DNN models are generally highly proprietary, the neural network architectures become valuable targets for attacks. In IMC systems, since the whole model is mapped on c...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on emerging topics in computing 2024-01, Vol.12 (1), p.109-121
Main Authors: Wang, Ziyu, Meng, Fan-Hsuan, Park, Yongmo, Eshraghian, Jason K., Lu, Wei D.
Format: Article
Language:English
Subjects:
Artificial neural networks
Chips (memory devices)
Computation
Computational modeling
Computer architecture
Data mining
Data models
deep learning security
Hardware
in-memory computing
Neural networks
power analysis
Registers
Side-channel attack
Side-channel attacks
Citations: Items that this one cites
Items that cite this one
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In-memory computing (IMC) systems have great potential for accelerating data-intensive tasks such as deep neural networks (DNNs). As DNN models are generally highly proprietary, the neural network architectures become valuable targets for attacks. In IMC systems, since the whole model is mapped on chip and weight memory read can be restricted, the pre-mapped DNN model acts as a "black box" for users. However, the localized and stationary weight and data patterns may subject IMC systems to other attacks. In this article, we propose a side-channel attack methodology on IMC architectures. We show that it is possible to extract model architectural information from power trace measurements without any prior knowledge of the neural network. We first developed a simulation framework that can emulate the dynamic power traces of the IMC macros. We then performed side-channel leakage analysis to reverse engineer model information such as the stored layer type, layer sequence, output channel/feature size and convolution kernel size from power traces of the IMC macros. Based on the extracted information, full networks can potentially be reconstructed without any knowledge of the neural network. Finally, we discuss potential countermeasures for building IMC systems that offer resistance to these model extraction attack.
ISSN:2168-6750
2168-6750
DOI:10.1109/TETC.2023.3257684