Deep Neural Networks (DNN) are vulnerable to adversarial perturbations-small changes crafted deliberately on the input to mislead the model for wrong predictions. Adversarial attacks have disastrous consequences for deep learning-empowered critical applications. Existing defense and detection techniques both require extensive knowledge of the model, testing inputs, and even execution details. They are not viable for general deep learning implementations where the model internal is unknown, a common 'black-box' scenario for model users. Inspired by the fact that electromagnetic (EM) emanations of a model inference are dependent on both operations and data and may contain footprints of different input classes, we propose a framework, EMShepherd, to capture EM traces of model execution, perform processing on traces and exploit them for adversarial detection. Only benign samples and their EM traces are used to train the adversarial detector: a set of EM classifiers and class-specific unsupervised anomaly detectors. When the victim model system is under attack by an adversarial example, the model execution will be different from executions for the known classes, and the EM trace will be different. We demonstrate that our air-gapped EMShepherd can effectively detect different adversarial attacks on a commonly used FPGA deep learning accelerator for both Fashion MNIST and CIFAR-10 datasets. It achieves a 100% detection rate on most types of adversarial samples, which is comparable to the state-of-the-art 'white-box' software-based detectors.

翻译：深度神经网络（DNN）易受对抗性扰动——即故意在输入上施加的微小改变，以误导模型做出错误预测。对抗性攻击对基于深度学习的关键应用会造成灾难性后果。现有的防御和检测技术均需对模型、测试输入甚至执行细节有深入了解。对于模型内部未知的通用深度学习实现（即模型用户常见的“黑盒”场景），这些方法难以适用。受电磁（EM）辐射既依赖于操作又依赖于数据，且可能包含不同输入类别痕迹这一事实启发，我们提出一个框架EMShepherd，用于捕获模型执行的EM迹线，对其进行处理并用于对抗性检测。仅使用良性样本及其EM迹线来训练对抗性检测器：一组EM分类器和特定类别的无监督异常检测器。当受害模型系统受到对抗样本攻击时，模型执行将与已知类别的执行不同，EM迹线也会不同。我们证明了气隙隔离的EMShepherd能够有效检测对常用FPGA深度学习加速器（针对Fashion MNIST和CIFAR-10数据集）的不同对抗性攻击。它对大多数类型的对抗样本实现了100%的检测率，这可与最先进的“白盒”软件检测器相媲美。