Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN\n Architectures

Deep Neural Networks (DNNs) are fast becoming ubiquitous for their ability to\nattain good accuracy in various machine learning tasks. A DNN's architecture\n(i.e., its hyper-parameters) broadly determines the DNN's accuracy and\nperformance, and is often confidential. Attacking a DNN in the cloud to obtain\nits architecture can potentially provide major commercial value. Further,\nattaining a DNN's architecture facilitates other, existing DNN attacks.\n This paper presents Cache Telepathy: a fast and accurate mechanism to steal a\nDNN's architecture using the cache side channel. Our attack is based on the\ninsight that DNN inference relies heavily on tiled GEMM (Generalized Matrix\nMultiply), and that DNN architecture parameters determine the number of GEMM\ncalls and the dimensions of the matrices used in the GEMM functions. Such\ninformation can be leaked through the cache side channel.\n This paper uses Prime+Probe and Flush+Reload to attack VGG and ResNet DNNs\nrunning OpenBLAS and Intel MKL libraries. Our attack is effective in helping\nobtain the architectures by very substantially reducing the search space of\ntarget DNN architectures. For example, for VGG using OpenBLAS, it reduces the\nsearch space from more than $10^{35}$ architectures to just 16.\n