A Review of Confidentiality Threats Against Embedded Neural Network Models

Raphaël Joud (1, 2) , Pierre-Alain Moellic (3, 2) , Rémi Bernhard (3, 2) , Jean-Baptiste Rigaud (2, 4)

1 CEA-LETI - Commissariat à l'énergie atomique et aux énergies alternatives - Laboratoire d'Electronique et de Technologie de l'Information
2 DPACA [Gardanne]
3 DSYS - Département Systèmes
4 Mines Saint-Étienne MSE - École des Mines de Saint-Étienne

Utilization of Machine Learning (ML) algorithms, especially Deep Neural Network (DNN) models, becomes a widely accepted standard in many domains more particularly IoT-based systems. DNN models reach impressive performances in several sensitive fields such as medical diagnosis, smart transport or security threat detection, and represent a valuable piece of Intellectual Property. Over the last few years, a major trend is the large-scale deployment of models in a wide variety of devices. However, this migration to embedded systems is slowed down because of the broad spectrum of attacks threatening the integrity, confidentiality and availability of embedded models. In this review, we cover the landscape of attacks targeting the confidentiality of embedded DNN models that may have a major impact on critical IoT systems, with a particular focus on model extraction and data leakage. We highlight the fact that Side-Channel Analysis (SCA) is a relatively unexplored bias by which model's confidentiality can be compromised. Input data, architecture or parameters of a model can be extracted from power or electromagnetic observations, testifying a real need from a security point of view.

Domaines: Intelligence artificielle [cs.AI]; Machine Learning [stat.ML]; Micro et nanotechnologies/Microélectronique

Raphaël Joud, Pierre-Alain Moellic, Rémi Bernhard, Jean-Baptiste Rigaud. A Review of Confidentiality Threats Against Embedded Neural Network Models. IEEE World Forum on Internet of Things, Jun 2021, New Orleans, United States. ⟨10.1109/WF-IoT51360.2021.9595434⟩. ⟨cea-04176698⟩