Recent work has highlighted the risks of intellectual property (IP) piracy of
deep learning (DL) models from the side-channel leakage of DL hardware
accelerators. In response, to provide side-channel leakage resiliency to DL
hardware accelerators, several approaches have been proposed, mainly borrowed
from the methodologies devised for cryptographic implementations. Therefore, as
expected, the same challenges posed by the complex design of such
countermeasures should be dealt with. This is despite the fact that fundamental
cryptographic approaches, specifically secure and private function evaluation,
could potentially improve the robustness against side-channel leakage. To
examine this and weigh the costs and benefits, we introduce hardware garbled NN
(HWGN2), a DL hardware accelerator implemented on FPGA. HWGN2 also provides NN
designers with the flexibility to protect their IP in real-time applications,
where hardware resources are heavily constrained, through a
hardware-communication cost trade-off. Concretely, we apply garbled circuits,
implemented using a MIPS architecture that achieves up to 62.5x fewer logical
and 66x less memory utilization than the state-of-the-art approaches at the
price of communication overhead. Further, the side-channel resiliency of HWGN2
is demonstrated by employing the test vector leakage assessment (TVLA) test
against both power and electromagnetic side-channels. This is in addition to
the inherent feature of HWGN2: it ensures the privacy of users’ input,
including the architecture of NNs. We also demonstrate a natural extension to
the malicious security modeljust as a by-product of our implementation.

By admin