Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"
(Hint: speaker is on the
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!
e.g. fault injection attacks, side-channel attacks
* co-location of VMs from different users
* weak attackers with less subtle control
The cloud providers try to secure things, e.g. protections against Rowhammer
... BUT this focuses on the average or best case, not the worst cast!
* negligible effect on the average case accuracy
* but flipping one bit can make significant amount of damage for particular queries
How much damage can a single bit flip cause?
Some strong attackers might be able to hit an "achilles" bit (one that's really going to mess with the model), but weaker attackers are going to hit bits more randomly.
The attacker might want to get their hands on fancy DNNs which are considered trade secrets and proprietary to their creators. They're expensive to make! They need good training data! People want to protect them!
Does this work? Apparently so: they tried it out using a cache side-channel attack and got back the architectures of the fancy DNN back.
More from Lea Kissner
More from Science
Hugh Everett's birthday! Pioneer of the Many-Worlds Interpretation of quantum mechanics. Let us celebrate by thinking about ontological extravagance. I will do so by way of analogy, because I have found that everyone loves analogies and nobody ever willfully misconstrues them.
We look at the night sky and see photons arriving to us, emitted by distant stars. Let's contrast two different theories about how stars emit photons.
One theory says, we know how stars shine, and our equations predict that they emit photons roughly uniformly in all directions. Call this the "Many-Photons Interpretation" (MPI).
But! Others object. That is *so many photons*. Most of which we don't observe, and can't observe, since they're moving away at the speed of light. It's too ontologically extravagant to posit a huge number of unobservable things!
So they suggest a "Photon Collapse Interpretation." According to this theory, the photons emitted toward us actually exist. But photons that would be emitted in directions we will never observe simply collapse into utter non-existence.
The physicist Hugh Everett III was born #OTD in 1930. His \u201crelative state\u201d formulation of quantum mechanics, which we now call the \u201cMany Worlds Interpretation,\u201d was published in 1957. pic.twitter.com/ZqMsZcPJDG
— Robert McNees, the bastegod (@mcnees) November 11, 2020
We look at the night sky and see photons arriving to us, emitted by distant stars. Let's contrast two different theories about how stars emit photons.
One theory says, we know how stars shine, and our equations predict that they emit photons roughly uniformly in all directions. Call this the "Many-Photons Interpretation" (MPI).
But! Others object. That is *so many photons*. Most of which we don't observe, and can't observe, since they're moving away at the speed of light. It's too ontologically extravagant to posit a huge number of unobservable things!
So they suggest a "Photon Collapse Interpretation." According to this theory, the photons emitted toward us actually exist. But photons that would be emitted in directions we will never observe simply collapse into utter non-existence.
