Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices
Deep neural networks (DNNs) have been applied to various industries. In particular, DNNs on embedded devices have attracted considerable interest because they allow real-time and distributed processing on site. However, adversarial examples (AEs), which add small perturbations to the input data of D...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2021-07-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/8971 |
| _version_ | 1818873413759926272 |
|---|---|
| author | Tsunato Nakai Daisuke Suzuki Takeshi Fujino |
| author_facet | Tsunato Nakai Daisuke Suzuki Takeshi Fujino |
| author_sort | Tsunato Nakai |
| collection | DOAJ |
| description | Deep neural networks (DNNs) have been applied to various industries. In particular, DNNs on embedded devices have attracted considerable interest because they allow real-time and distributed processing on site. However, adversarial examples (AEs), which add small perturbations to the input data of DNNs to cause misclassification, are serious threats to DNNs. In this paper, a novel black-box attack is proposed to craft AEs based only on processing time, i.e., the side-channel leaks from DNNs on embedded devices. Unlike several existing black-box attacks that utilize output probability, the proposed attack exploits the relationship between the number of activated nodes and processing time without using training data, model architecture, parameters, substitute models, or output probability. The perturbations for AEs are determined by the differential processing time based on the input data of the DNNs in the proposed attack. The experimental results show that the AEs of the proposed attack effectively cause an increase in the number of activated nodes and the misclassification of one of the incorrect labels against the DNNs on a microcontroller unit. Moreover, these results indicate that the attack can evade gradient-masking and confidence reduction countermeasures, which conceal the output probability, to prevent the crafting of AEs against several black-box attacks. Finally, the countermeasures against the attack are implemented and evaluated to clarify that the implementation of an activation function with data-dependent timing leaks is the cause of the proposed attack. |
| first_indexed | 2024-12-19T12:54:19Z |
| format | Article |
| id | doaj.art-f7c1a073befe4d56ad843a03ddd4092b |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-12-19T12:54:19Z |
| publishDate | 2021-07-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-f7c1a073befe4d56ad843a03ddd4092b2022-12-21T20:20:26ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252021-07-012021310.46586/tches.v2021.i3.149-175Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded DevicesTsunato Nakai0Daisuke Suzuki1Takeshi Fujino2Mitsubishi Electric Corporation, Kamakura, Kanagawa, Japan; Ritsumeikan University, Kusatsu, Shiga, JapanMitsubishi Electric Corporation, Kamakura, Kanagawa, JapanRitsumeikan University, Kusatsu, Shiga, JapanDeep neural networks (DNNs) have been applied to various industries. In particular, DNNs on embedded devices have attracted considerable interest because they allow real-time and distributed processing on site. However, adversarial examples (AEs), which add small perturbations to the input data of DNNs to cause misclassification, are serious threats to DNNs. In this paper, a novel black-box attack is proposed to craft AEs based only on processing time, i.e., the side-channel leaks from DNNs on embedded devices. Unlike several existing black-box attacks that utilize output probability, the proposed attack exploits the relationship between the number of activated nodes and processing time without using training data, model architecture, parameters, substitute models, or output probability. The perturbations for AEs are determined by the differential processing time based on the input data of the DNNs in the proposed attack. The experimental results show that the AEs of the proposed attack effectively cause an increase in the number of activated nodes and the misclassification of one of the incorrect labels against the DNNs on a microcontroller unit. Moreover, these results indicate that the attack can evade gradient-masking and confidence reduction countermeasures, which conceal the output probability, to prevent the crafting of AEs against several black-box attacks. Finally, the countermeasures against the attack are implemented and evaluated to clarify that the implementation of an activation function with data-dependent timing leaks is the cause of the proposed attack.https://tches.iacr.org/index.php/TCHES/article/view/8971Adversarial examplesBlack-box attackTiming side-channelEmbedded devices |
| spellingShingle | Tsunato Nakai Daisuke Suzuki Takeshi Fujino Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices Transactions on Cryptographic Hardware and Embedded Systems Adversarial examples Black-box attack Timing side-channel Embedded devices |
| title | Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices |
| title_full | Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices |
| title_fullStr | Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices |
| title_full_unstemmed | Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices |
| title_short | Timing Black-Box Attacks: Crafting Adversarial Examples through Timing Leaks against DNNs on Embedded Devices |
| title_sort | timing black box attacks crafting adversarial examples through timing leaks against dnns on embedded devices |
| topic | Adversarial examples Black-box attack Timing side-channel Embedded devices |
| url | https://tches.iacr.org/index.php/TCHES/article/view/8971 |
| work_keys_str_mv | AT tsunatonakai timingblackboxattackscraftingadversarialexamplesthroughtimingleaksagainstdnnsonembeddeddevices AT daisukesuzuki timingblackboxattackscraftingadversarialexamplesthroughtimingleaksagainstdnnsonembeddeddevices AT takeshifujino timingblackboxattackscraftingadversarialexamplesthroughtimingleaksagainstdnnsonembeddeddevices |