Neural networks are seeing increased use in diverse Internet of Things (IoT) applications such as healthcare, smart homes and industrial monitoring. Their widespread use makes neural networks a lucrative target for theft. An attacker can obtain a model without having access to the training data or incurring the cost of training. Also, networks trained using private data (e.g., medical records) can reveal information about this data. Networks can be stolen by leveraging side channels such as power traces of the IoT device when it is running the network. Existing attacks require operations to occur in the same order each time; an attacker must collect and analyze several traces of the device to steal the network. Therefore, to prevent this type of attack, we randomly shuffle the order of operations each time. With shuffling, each operation can now happen at many different points in each execution, making the attack intractable. However, we show that shuffling in software can leak information which can be used to subvert this solution. Therefore, to perform secure shuffling and reduce latency, we present BlackJack, hardware added as a functional unit within the CPU. BlackJack secures neural networks on IoT devices by increasing the time needed for an attack to centuries, while adding just 2.46% area, 3.28% power and 0.56% latency overhead on an ARM M0+ SoC.

翻译：神经网络在医疗健康、智能家居和工业监控等多样化物联网应用中日益普及。其广泛部署使其成为恶意窃取的高价值目标——攻击者可在无需访问训练数据或承担训练成本的情况下获取模型。此外，使用私有数据（如医疗记录）训练的网络可能泄露相关数据信息。通过利用侧信道（如物联网设备运行网络时的功率轨迹），网络可能被窃取。现有攻击要求操作每次以相同顺序执行；攻击者需收集并分析设备的多条轨迹才能窃取网络。因此，为防止此类攻击，我们每次随机打乱操作顺序。通过洗牌，每次执行中每个操作出现在不同时序位置，使攻击难以实施。然而，我们证明软件层面的洗牌可能泄露可用于规避该方案的信息。为实现安全洗牌并降低延迟，我们提出黑杰克——以功能单元形式集成于CPU的硬件方案。黑杰克通过将攻击所需时间提升至百年量级来保护物联网设备上的神经网络，同时在ARM M0+ SoC上仅增加2.46%面积、3.28%功耗和0.56%延迟开销。