BarraCUDA: Edge GPUs do Leak DNN Weights

D 2025

BarraCUDA: Edge GPUs do Leak DNN Weights

HORVATH, Peter; Lukasz Michal CHMIELEWSKI; Léo WEISSBART a Lejla BATINA

Základní údaje

Originální název

BarraCUDA: Edge GPUs do Leak DNN Weights

Autoři

HORVATH, Peter; Lukasz Michal CHMIELEWSKI; Léo WEISSBART a Lejla BATINA

Vydání

Seattle, WA, USA, SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium, od s. 4017-4034, 19 s. 2025

Nakladatel

USENIX Association

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

tištěná verze "print"

Označené pro přenos do RIV

Ano

Kód RIV

RIV/00216224:14330/25:00144686

Organizační jednotka

Fakulta informatiky

ISBN

978-1-939133-52-6

EID Scopus

2-s2.0-105021316400

Klíčová slova anglicky

side-channel analysis; neural networks; GPUs; model extraction; hardware security

Štítky

core_A, firank_1

Změněno: 2. 4. 2026 15:47, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

Over the last decade, applications of neural networks have spread to every aspect of our lives. A large number of companies base their businesses on building products that use neural networks for tasks such as face recognition, machine translation, and self-driving cars. Much of the intellectual property underpinning these products is encoded in the exact parameters of the neural networks. Consequently, protecting these is of utmost priority to businesses. At the same time, many of these products need to operate under a strong threat model, in which the adversary has unfettered physical control of the product. In this work, we present BarraCUDA, a novel attack on general-purpose Graphics Processing Units (GPUs) that can extract parameters of neural networks running on the popular Nvidia Jetson devices. BarraCUDA relies on the observation that the convolution operation, used during inference, must be computed as a sequence of partial sums, each leaking one or a few parameters. Using correlation electromagnetic analysis with these partial sums, BarraCUDA can recover parameters of real-world convolutional neural networks.

Návaznosti

VJ02010010, projekt VaV

Název: Nástroje pro verifikaci bezpečnosti kryptografických zařízení s využitím AI (Akronym: AI-SecTools)

Investor: Ministerstvo vnitra ČR, Tools for AI-enhanced Security Verification of Cryptographic Devices

Citovat

HORVATH, Peter; Lukasz Michal CHMIELEWSKI; Léo WEISSBART a Lejla BATINA. BarraCUDA: Edge GPUs do Leak DNN Weights. In YAROM, Yuval. SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium. Seattle, WA, USA: USENIX Association, 2025, s. 4017-4034, 19 s. ISBN 978-1-939133-52-6.

@inproceedings{2513799,
   author = {Horvath, Peter and Chmielewski, Lukasz Michal and Weissbart, Léo and Batina, Lejla},
   address = {Seattle, WA, USA},
   booktitle = {SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium},
   keywords = {side-channel analysis; neural networks; GPUs; model extraction; hardware security},
   howpublished = {tištěná verze "print"},
   language = {eng},
   location = {Seattle, WA, USA},
   isbn = {978-1-939133-52-6},
   pages = {4017-4034},
   publisher = {USENIX Association},
   title = {BarraCUDA: Edge GPUs do Leak DNN Weights},
   year = {2025}
}

TY  - CONF
ID  - 2513799
AU  - Horvath, Peter - Chmielewski, Lukasz Michal - Weissbart, Léo - Batina, Lejla
PY  - 2025
TI  - BarraCUDA: Edge GPUs do Leak DNN Weights
PB  - USENIX Association
CY  - Seattle, WA, USA
SN  - 9781939133526
KW  - side-channel analysis
KW  - neural networks
KW  - GPUs
KW  - model extraction
KW  - hardware security
N2  - Over the last decade, applications of neural networks have spread to every aspect of our lives. A large number of companies base their businesses on building products that use neural networks for tasks such as face recognition, machine translation, and self-driving cars. Much of the intellectual property underpinning these products is encoded in the exact parameters of the neural networks. Consequently, protecting these is of utmost priority to businesses. At the same time, many of these products need to operate under a strong threat model, in which the adversary has unfettered physical control of the product. In this work, we present BarraCUDA, a novel attack on general-purpose Graphics Processing Units (GPUs) that can extract parameters of neural networks running on the popular Nvidia Jetson devices. BarraCUDA relies on the observation that the convolution operation, used during inference, must be computed as a sequence of partial sums, each leaking one or a few parameters. Using correlation electromagnetic analysis with these partial sums, BarraCUDA can recover parameters of real-world convolutional neural networks.
ER  -

HORVATH, Peter; Lukasz Michal CHMIELEWSKI; Léo WEISSBART a Lejla BATINA. BarraCUDA: Edge GPUs do Leak DNN Weights. In YAROM, Yuval. \textit{SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium}. Seattle, WA, USA: USENIX Association, 2025, s.~4017-4034, 19 s. ISBN~978-1-939133-52-6.

Přehled o publikaci