Secure and private machine learning in hardware

Machine learning (ML) has seen a tremendous rise in interest in recent years, with neural networks in particular gaining widespread adoption. ML models run on many types of hardware, ranging from low-power IoT devices to powerful GPUs and a plethora of dedicated accelerators. However, their popularity has made systems using ML susceptible to several attacks. To safely enable their widespread use, this thesis details mechanisms to improve the security and safeguard the privacy of ML systems. To this end, we make three contributions: FARO, AESIR and EMPATIC.Our first contribution (FARO) secures the weights of ML models running on low-power IoT devices against side-channel attacks. Such attacks allow for the entire model to be stolen merely by analyzing several power traces of the device. For the attack to work however, operations must be performed in the same order in each trace. To prevent this, FARO adds hardware to randomly shuffle the order of operations during each run as a functional unit within the CPU. FARO secures the crucial weights of the model, while adding < 5% area, latency and power overheads. The second contribution (AESIR) enables edge ML accelerators to run security-critical ML algorithms such as differentially private ML (DP-ML). Current ML accelerator designs lack CPUs and are unable to provide the random noise required by such algorithms. AESIR details simple hardware modifications to enable noise addition from arbitrary distributions. Compared to dedicated on-chip hardware for generating noise, AESIR adds 23× lower area and 40× lower energy while also being secure against side-channel attacks. The final contribution (EMPATIC) accelerates adversarial training, used to train models which are more robust against adversarial attacks. We do so by efficiently using the support for high throughput 8-bit floating point (FP8) provided by modern GPUs. Directly training models using FP8 is challenging due to the extremely narrow range of this datatype. We propose EMPATIC, where we cluster the training data so that groups of similar inputs are run contiguously. We then calculate the difference within each group – which have a smaller range than the original data – and use FP8 for performing computations with these differences. EMPATIC matches the accuracy of models trained using higher precision, while effectively using the higher throughput provided by modern GPUs for FP8 computation. Together, our three contributions help improve the security of ML models and protect the privacy of user data used to train ML models.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.