The multi-million dollar investment required for modern machine learning (ML) has made large ML models a prime target for theft. In response, the field of model stealing has emerged. Attacks based on physical side-channel information have shown that DNN model extraction is feasible, even on CUDA Cores in a GPU. For the first time, our work demonstrates parameter extraction on the specialized GPU's Tensor Core units, most commonly used GPU units nowadays due to their superior performance, via near-field physical side-channel attacks. Previous work targeted only the general-purpose CUDA Cores in the GPU, the functional units that have been part of the GPU since its inception. Our method is tailored to the GPU architecture to accurately estimate energy consumption and derive efficient attacks via Correlation Power Analysis (CPA). Furthermore, we provide an exploratory analysis of hyperparameter and weight leakage from LLMs in far field and demonstrate that the GPU's electromagnetic radiation leaks even 100 cm away through a glass obstacle.

翻译：现代机器学习所需的数百万美元投资使大型机器学习模型成为盗窃的主要目标。为此，模型窃取领域应运而生。基于物理侧信道信息的攻击已表明，即便在GPU的CUDA核心上，深度神经网络模型提取也是可行的。本研究首次证明，通过近场物理侧信道攻击，可在GPU专用张量核心单元（因其卓越性能而成为当前最常用的GPU单元）上实现参数提取。以往工作仅针对通用CUDA核心（自GPU诞生以来便存在的功能单元）展开攻击。我们提出的方法针对GPU架构进行定制，可精确估算能耗，并通过相关功耗分析推导高效攻击策略。此外，我们初步探索了远场条件下大型语言模型的超参数与权重泄漏问题，并证明即便在100厘米距离外隔着一层玻璃障碍物，GPU的电磁辐射仍会泄漏信息。