Deep Neural Networks (DNNs) have become ubiquitous due to their performance on prediction and classification problems. However, they face a variety of threats as their usage spreads. Model extraction attacks, which steal DNNs, endanger intellectual property, data privacy, and security. Previous research has shown that system-level side-channels can be used to leak the architecture of a victim DNN, exacerbating these risks. We propose two DNN architecture extraction techniques catering to various threat models. The first technique uses a malicious, dynamically linked version of PyTorch to expose a victim DNN architecture through the PyTorch profiler. The second, called EZClone, exploits aggregate (rather than time-series) GPU profiles as a side-channel to predict DNN architecture, employing a simple approach and assuming little adversary capability as compared to previous work. We investigate the effectiveness of EZClone when minimizing the complexity of the attack, when applied to pruned models, and when applied across GPUs. We find that EZClone correctly predicts DNN architectures for the entire set of PyTorch vision architectures with 100% accuracy. No other work has shown this degree of architecture prediction accuracy with the same adversarial constraints or using aggregate side-channel information. Prior work has shown that, once a DNN has been successfully cloned, further attacks such as model evasion or model inversion can be accelerated significantly.

翻译：深度神经网络（DNN）因其在预测与分类问题上的卓越性能而变得无处不在。然而，随着其应用范围的扩大，它们也面临多种威胁。模型提取攻击通过窃取DNN危及知识产权、数据隐私与安全性。先前研究表明，系统级侧信道可用于泄露受害者DNN的架构，从而加剧这些风险。我们提出两种针对不同威胁模型的DNN架构提取技术。第一种技术利用恶意的动态链接PyTorch版本，通过PyTorch分析器暴露受害者DNN架构。第二种技术名为EZClone，利用聚合（而非时间序列）GPU轮廓作为侧信道来预测DNN架构，采用简单方法且与先前工作相比假设较少的攻击者能力。我们研究了EZClone在最小化攻击复杂度、应用于剪枝模型以及跨GPU应用时的有效性。我们发现，EZClone能够以100%的准确率正确预测整个PyTorch视觉模型集的DNN架构。尚无其他工作在相同对抗约束或使用聚合侧信道信息条件下达到此架构预测精度。先前研究表明，一旦DNN被成功克隆，进一步的攻击如模型规避或模型逆向可被显著加速。