论文标题
机器学习推理引擎的新安全挑战：芯片克隆和模型逆向工程
New Security Challenges on Machine Learning Inference Engine: Chip Cloning and Model Reverse Engineering
论文作者
论文摘要
机器学习推理引擎对智能边缘计算引起了极大的兴趣。计算中的内存（CIM）体系结构显示了硬件加速度的吞吐量和能源效率的显着提高。新兴的非易失性记忆技术为动态功率门控提供了巨大的潜力。推理引擎通常由云预先训练，然后将其部署到提交。芯片克隆和神经网络模型逆向工程有新的攻击模型。在本文中，我们建议对重量克隆和输入输出对攻击进行对策。第一种策略是对特定芯片实例的类似物到数字转换器（ADC）偏移的重量调整，同时诱导克隆芯片实例的明显准确度下降。第二种策略是重量冲浪和假行插入，以便仅使用钥匙准确地传播神经网络的激活。
Machine learning inference engine is of great interest to smart edge computing. Compute-in-memory (CIM) architecture has shown significant improvements in throughput and energy efficiency for hardware acceleration. Emerging non-volatile memory technologies offer great potential for instant on and off by dynamic power gating. Inference engine is typically pre-trained by the cloud and then being deployed to the filed. There are new attack models on chip cloning and neural network model reverse engineering. In this paper, we propose countermeasures to the weight cloning and input-output pair attacks. The first strategy is the weight fine-tune to compensate the analog-to-digital converter (ADC) offset for a specific chip instance while inducing significant accuracy drop for cloned chip instances. The second strategy is the weight shuffle and fake rows insertion to allow accurate propagation of the activations of the neural network only with a key.
