Extracting the architecture of layers of a given deep neural network (DNN) through hardware-based side channels allows adversaries to steal its intellectual property and even launch powerful adversarial attacks on the target system. In this work, we propose DNN-Alias, an obfuscation method for DNNs that forces all the layers in a given network to have similar execution traces, preventing attack models from differentiating between the layers. Towards this, DNN-Alias performs various layer-obfuscation operations, e.g., layer branching, layer deepening, etc, to alter the run-time traces while maintaining the functionality. DNN-Alias deploys an evolutionary algorithm to find the best combination of obfuscation operations in terms of maximizing the security level while maintaining a user-provided latency overhead budget. We demonstrate the effectiveness of our DNN-Alias technique by obfuscating the architecture of 700 randomly generated and obfuscated DNNs running on multiple Nvidia RTX 2080 TI GPU-based machines. Our experiments show that state-of-the-art side-channel architecture stealing attacks cannot extract the original DNN accurately. Moreover, we obfuscate the architecture of various DNNs, such as the VGG-11, VGG-13, ResNet-20, and ResNet-32 networks. Training the DNNs using the standard CIFAR10 dataset, we show that our DNN-Alias maintains the functionality of the original DNNs by preserving the original inference accuracy. Further, the experiments highlight that adversarial attack on obfuscated DNNs is unsuccessful.

翻译：通过硬件侧信道提取给定深度神经网络（DNN）各层的架构，使得攻击者能够窃取其知识产权，甚至对目标系统发动强大的对抗攻击。在本文中，我们提出DNN-Alias，一种针对DNN的混淆方法，通过强制给定网络中的所有层具有相似的执行轨迹，防止攻击模型区分不同层。为此，DNN-Alias执行各种层混淆操作（例如层分支、层加深等）来改变运行时轨迹，同时保持网络功能。DNN-Alias采用进化算法，在维持用户指定的延迟开销预算前提下，寻找能最大化安全级别的混淆操作最佳组合。我们通过在基于多块Nvidia RTX 2080 TI GPU的机器上运行700个随机生成并混淆的DNN来验证DNN-Alias技术的有效性。实验表明，最先进的侧信道架构窃取攻击无法准确提取原始DNN架构。此外，我们对多种DNN（如VGG-11、VGG-13、ResNet-20和ResNet-32网络）的架构进行混淆，并使用标准CIFAR10数据集训练DNN，结果显示DNN-Alias通过保持原始推理精度来维持原始DNN的功能。进一步实验表明，针对混淆后DNN的对抗攻击无法成功实施。