DNN accelerators have been widely deployed in many scenarios to speed up the inference process and reduce the energy consumption. One big concern about the usage of the accelerators is the confidentiality of the deployed models: model inference execution on the accelerators could leak side-channel information, which enables an adversary to preciously recover the model details. Such model extraction attacks can not only compromise the intellectual property of DNN models, but also facilitate some adversarial attacks. Although previous works have demonstrated a number of side-channel techniques to extract models from DNN accelerators, they are not practical for two reasons. (1) They only target simplified accelerator implementations, which have limited practicality in the real world. (2) They require heavy human analysis and domain knowledge. To overcome these limitations, this paper presents Mercury, the first automated remote side-channel attack against the off-the-shelf Nvidia DNN accelerator. The key insight of Mercury is to model the side-channel extraction process as a sequence-to-sequence problem. The adversary can leverage a time-to-digital converter (TDC) to remotely collect the power trace of the target model's inference. Then he uses a learning model to automatically recover the architecture details of the victim model from the power trace without any prior knowledge. The adversary can further use the attention mechanism to localize the leakage points that contribute most to the attack. Evaluation results indicate that Mercury can keep the error rate of model extraction below 1%.

翻译：摘要：深度神经网络加速器已广泛部署于多种场景，以加速推理过程并降低能耗。加速器使用中的一个重大隐患是部署模型的机密性：在加速器上执行模型推理可能泄露侧信道信息，使攻击者能够精确恢复模型细节。此类模型提取攻击不仅会损害深度神经网络模型的知识产权，还可能助长某些对抗性攻击。尽管先前工作已展示多种从深度神经网络加速器中提取模型的侧信道技术，但它们因以下两个原因而缺乏实用性：（1）它们仅针对简化的加速器实现，在现实世界中实用性有限；（2）它们需要大量人工分析和领域知识。为克服这些局限，本文提出Mercury——首个针对商用英伟达深度神经网络加速器的自动化远程侧信道攻击。Mercury的核心洞察在于将侧信道提取过程建模为序列到序列问题。攻击者可利用时间数字转换器远程收集目标模型推理的功耗轨迹，随后使用学习模型自动从功耗轨迹中恢复受害者模型的架构细节，而无需任何先验知识。攻击者还可利用注意力机制定位对攻击贡献最大的泄漏点。评估结果表明，Mercury能够将模型提取的错误率保持在1%以下。