When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence

Résumé

Artificial intelligence, and specifically deep neural networks (DNNs), has rapidly emerged in the past decade as the standard for several tasks from specific advertising to object detection. The performance offered has led DNN algorithms to become a part of critical embedded systems, requiring both efficiency and reliability. In particular, DNNs are subject to malicious examples designed in a way to fool the network while being undetectable to the human observer: the adversarial examples. While previous studies propose frameworks to implement such attacks in black box settings, those often rely on the hypothesis that the attacker has access to the logits of the neural network, breaking the assumption of the traditional black box. In this paper, we investigate a real black box scenario where the attacker has no access to the logits. In particular, we propose an architecture-agnostic attack which solve this constraint by extracting the logits. Our method combines hardware and software attacks, by performing a side-channel attack that exploits electromagnetic leakages to extract the logits for a given input, allowing an attacker to estimate the gradients and produce state-of-the-art adversarial examples to fool the targeted neural network. Through this example of adversarial attack, we demonstrate the effectiveness of logits extraction using side-channel as a first step for more general attack frameworks requiring either the logits or the confidence scores. CCS CONCEPTS • Security and privacy → Side-channel analysis and countermeasures.
Fichier principal
Vignette du fichier
AISEC_2023_final_hal_version.pdf (1.21 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04320434 , version 1 (04-12-2023)

Licence

Paternité

Identifiants

Citer

Benoît Coqueret, Mathieu Carbone, Olivier Sentieys, Gabriel Zaid. When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence. AISec 2023 - 16th ACM Workshop on Artificial Intelligence and Security, Nov 2023, Copenhagen, Denmark. pp.127-138, ⟨10.1145/3605764.3623903⟩. ⟨hal-04320434⟩
21 Consultations
12 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More