Model extraction attacks on edge-device neural networks via listening for architectural clues

The researchers propose a neural network model extraction attack against edge devices that uses off-chip memory address traces and PCIe events to reconstruct the network architecture, including the set of layers used, the connections between them and the dimensions of each layer. The method draws on ideas from speech recognition, using both intra-layer architectural features and inter-layer temporal correlation information; the authors call it the first model extraction technique of this kind to be this precise, and they completed an end-to-end attack experiment on an off-the-shelf Nvidia GPU platform and a full system stack. Results show that the method achieves high reverse-engineering accuracy, and after obtaining the extracted network architecture, the success rate of targeted adversarial attacks rises from 14.6%~25.5% (without architecture knowledge) to 75.9% (with the extracted architecture).