AIモデルを盗み出す新たな手法を研究者が実証(Researchers Demonstrate New Technique for Stealing AI Models)

ad

2024-12-12 ノースカロライナ州立大学(NCState)

ノースカロライナ州立大学の研究者たちは、AIモデルが稼働しているデバイスにハッキングせずとも、そのモデルを盗み出す新たな手法を実証しました。この手法は、ソフトウェアやアーキテクチャに関する事前知識がなくても機能します。具体的には、GoogleのエッジTPU上で動作するAIモデルのハイパーパラメータを特定し、そのアーキテクチャや層の詳細を再現することで、元のモデルと同等の機能を持つAIを複製することに成功しました。この技術は、エッジデバイス上で稼働する多くのAIモデルに対して適用可能であり、デバイスが稼働中であれば、同じ仕様の別のデバイスを用いてモデルを盗むことが可能です。

<関連情報>

TPUXtract:網羅的ハイパーパラメータ抽出フレームワーク TPUXtract: An Exhaustive Hyperparameter Extraction Framework

Ashley Kurian, Anuj Dubey, Ferhat Yaman and Aydin Aysu
IACR Transactions on Cryptographic Hardware and Embedded Systems  Published:2024-12-09
DOI:https://doi.org/10.46586/tches.v2025.i1.78-103

Abstract

Model stealing attacks on AI/ML devices undermine intellectual property rights, compromise the competitive advantage of the original model developers, and potentially expose sensitive data embedded in the model’s behavior to unauthorized parties. While previous research works have demonstrated successful side-channelbased model recovery in embedded microcontrollers and FPGA-based accelerators, the exploration of attacks on commercial ML accelerators remains largely unexplored. Moreover, prior side-channel attacks fail when they encounter previously unknown models. This paper demonstrates the first successful model extraction attack on the Google Edge Tensor Processing Unit (TPU), an off-the-shelf ML accelerator. Specifically, we show a hyperparameter stealing attack that can extract all layer configurations including the layer type, number of nodes, kernel/filter sizes, number of filters, strides, padding, and activation function. Most notably, our attack is the first comprehensive attack that can extract previously unseen models. This is achieved through an online template-building approach instead of a pre-trained ML-based approach used in prior works. Our results on a black-box Google Edge TPU evaluation show that, through obtained electromagnetic traces, our proposed framework can achieve 99.91% accuracy, making it the most accurate one to date. Our findings indicate that attackers can successfully extract various types of models on a black-box commercial TPU with utmost detail and call for countermeasures.

1600情報工学一般
ad
ad
Follow
ad
タイトルとURLをコピーしました