Search papers, labs, and topics across Lattice.
This paper introduces Kraken, a novel side-channel attack that extracts DNN parameters from GPU Tensor Cores, the most commonly used GPU units, via near-field electromagnetic (EM) analysis. The method leverages Correlation Power Analysis (CPA) tailored to the GPU architecture to accurately estimate energy consumption during Tensor Core operations. Furthermore, the research explores hyperparameter and weight leakage from LLMs in far-field EM radiation, demonstrating leakage even at a distance of 100cm through glass.
Cracking DNNs is now easier than ever: Kraken extracts parameters from GPU Tensor Cores via near-field EM attacks and even sniffs LLM weights from a meter away.
The multi-million dollar investment required for modern machine learning (ML) has made large ML models a prime target for theft. In response, the field of model stealing has emerged. Attacks based on physical side-channel information have shown that DNN model extraction is feasible, even on CUDA Cores in a GPU. For the first time, our work demonstrates parameter extraction on the specialized GPU's Tensor Core units, most commonly used GPU units nowadays due to their superior performance, via near-field physical side-channel attacks. Previous work targeted only the general-purpose CUDA Cores in the GPU, the functional units that have been part of the GPU since its inception. Our method is tailored to the GPU architecture to accurately estimate energy consumption and derive efficient attacks via Correlation Power Analysis (CPA). Furthermore, we provide an exploratory analysis of hyperparameter and weight leakage from LLMs in far field and demonstrate that the GPU's electromagnetic radiation leaks even 100\,cm away through a glass obstacle.
DeepMind