Parasite: Mitigating Physical Side-Channel Attacks Against Neural Networks

Abstract

Neural Networks (NNs) are now the target of various side-channel attacks whose aim is to recover the model’s parameters and/or architecture. We focus our work on EM side-channel attacks for parameter extraction. We propose a novel approach to countering such side-channel attacks, based on the method introduced by Chabanne et al. in 2021, where parasitic convolutional models are dynamically applied to the input of the victim model. We validate this new idea in the side-channel field by simulation.

Appendices

Appendix A Pearson Correlation

To further explain the way our countermeasure works, we measured the Pearson correlation coefficient $\rho$ between the extracted weights and original ones, one output channel at a time. Figure 4 shows the coefficients for each extracted convolutional layer, for a 1-layer protected model with standard deviation $\sigma =0.01$. Thanks to the plots, we can see that the correlation decreases for deeper layers.

Fig. 4.

Pearson correlation coefficient between the extracted weights and the original ones, for the first, third and fourth convolutions in MobileNetV2. Each point in the graph corresponds to the correlation coefficient for one output channel.

Appendix B Weight Distribution

In this appendix, we plot the distribution of weight differences $\delta = \frac{\hat{w_i} - w_i}{||W||_2}$ between the extracted and original weights, for each of the four recovered convolutional layers. We consider a MobileNetV2 model protected by a 1-layer parasite with standard deviation either $\sigma =0.01$ in Fig. 5e or $\sigma =0.1$ in Fig. 5j. As we reach deeper layers, recovered weights get further away from the original ones. Moreover, a higher $\sigma$ leads to fewer correctly recovered weights. This also explains why the extracted accuracy for $\sigma =0.1$ is so low: $12.9\%$ when the original accuracy was $71.41\%$ and the extracted accuracy for $\sigma =0.01$ is $71.41\%$.

Fig. 5.

Distribution of the weight differences $\frac{\hat{w_i} - w_i}{||W||_2}$ within each of the four MobileNetV2 convolutional layers extracted by the attacker, in the first simulation with 128 traces (see Sect. 5.1) and $\sigma =0.01$ (e) or $\sigma =0.1$ (j).