Technical Summary: InferNet – Exploiting Aggregate GPU Profiles for DNN Architecture Inference

1. Problem Statement

Deep Neural Networks (DNNs) are critical intellectual property (IP) assets, yet they face significant security threats, particularly Model Extraction Attacks (MEAs). Traditional MEAs often rely on complex, fine-grained, time-series analysis of low-level system resources (e.g., PCIe traffic, cache timing, or memory bus snooping) to reverse-engineer model architectures. However, these approaches are frequently impractical in real-world cloud and Machine-Learning-as-a-Service (MLaaS) environments because they require privileged access (root/administrator) or physical proximity, which is rarely available to co-located users.

Furthermore, the industry shift toward foundation models (large pre-trained models fine-tuned for specific tasks) has altered the adversary's objective. Instead of extracting weights, attackers now seek to identify the underlying DNN architecture (e.g., distinguishing between ResNet, BERT, or Inception variants) to facilitate targeted model stealing or replication. Existing methods that rely on fine-grained temporal data are fragile, susceptible to system noise, and easily defeated by countermeasures like randomized kernel scheduling.

There is a need for a non-intrusive, robust, and practical attack vector that can infer DNN architectures using only coarse-grained, aggregate system metrics available to standard users in cloud environments.

2. Methodology: InferNet

The paper introduces InferNet, an attack method that leverages aggregate GPU profiles as a side-channel to fingerprint and infer DNN architectures. Unlike previous works that analyze the temporal sequence of operations, InferNet utilizes statistical summaries of GPU execution.

2.1 Core Insight

The authors identify two key insights driving the attack:

1. Kernel-to-Layer Mapping: Each unique combination of DNN layer type and size maps to specific CUDA kernel calls.
2. Unique Fingerprints: The type of kernel calls, their execution times, and resource utilization patterns form a unique fingerprint for specific DNN architectures and their variants.

2.2 Attack Workflow

The attack consists of an offline preprocessing phase and an online attack phase:

• Data Collection (Offline): The adversary collects aggregate GPU profiles for a set of candidate DNN architectures (the "training set"). Using tools like nvprof in aggregate mode, they capture metrics including:
  • GPU Kernel Metrics: Total time, number of calls, and average/min/max execution times for specific kernels (e.g., cudnn_infer, volta_sgemm).
  • API Calls: Frequency and timing of CUDA API invocations.
  • System-Level Metrics: SM clock speed, memory clock, temperature, and power consumption.
• Feature Engineering: The raw profiles are cleaned to handle sparsity (adding binary indicators for kernel presence) and normalized. Recursive Feature Elimination (RFE) is used to identify the most predictive features, reducing noise and overfitting.
• Model Training: A machine learning classifier (e.g., Random Forest, Naive Bayes, KNN) is trained to map the aggregate profile features to the specific DNN architecture label.
• Online Attack: The adversary runs the victim model on a GPU-enabled system, collects a single aggregate profile, and feeds it into the trained classifier to predict the architecture.

2.3 Why Aggregate Profiles?

The paper argues that aggregate profiles are superior to time-series traces for this specific threat model because:

• They suppress noise from non-deterministic GPU scheduling and internal resource contention.
• They are less sensitive to variations in profiler versions or thermal throttling.
• They provide stable, statistical fingerprints that are resilient to temporal countermeasures (e.g., randomized kernel ordering).

3. Key Contributions

The paper makes the following specific contributions:

• Novel Side-Channel Identification: It identifies aggregate GPU profiles (kernel calls and system metrics) as a viable side-channel for DNN architecture inference, challenging the assumption that fine-grained traces are necessary.
• InferNet Framework: Development of a machine-learning-based attack capable of extracting a wide range of architectures, including Vision models (CNNs, Vision Transformers) and Large Language Models (LLMs).
• Robustness to Optimization: Demonstration that the attack remains effective even when models are compressed, pruned, or fine-tuned with different output classes.
• Feature Efficiency: Empirical evidence showing that a small subset of features (e.g., the top 3 kernel metrics) is sufficient for near-perfect accuracy, reducing the data requirements for the attack.
• Cross-Environment Evaluation: Characterization of the attack's transferability across different hardware (NVIDIA Tesla T4 vs. Quadro RTX 8000) and frameworks (PyTorch vs. TensorFlow).

4. Experimental Results

The authors evaluated InferNet on 90 diverse DNN architectures (21 families) across PyTorch and TensorFlow, using two hardware platforms.

• Accuracy:
  • 100% accuracy using the complete GPU aggregate profile.
  • ~100% accuracy using only the top 3 kernel features (specifically volta_sgemm and splitKreduce metrics).
  • 100% accuracy on modified architectures (e.g., models fine-tuned with different output classes).
  • 75% accuracy in cross-GPU scenarios (training on one GPU, testing on another), with family-level prediction remaining high (>90% for some models).
• Data Efficiency: The attack requires minimal training data; one profile per architecture was sufficient for most models to achieve the same accuracy as training on 20 profiles.
• Framework Generalization: While cross-framework prediction (PyTorch to TensorFlow) initially showed lower accuracy due to disjoint kernel sets, training on a heterogeneous dataset (combining both frameworks) restored accuracy to 100% for Random Forest and Naive Bayes.
• Comparison: InferNet achieves 100% accuracy on a candidate set 4x larger than the next best related work (which typically targets 15–20 models).

5. Significance and Claims

The paper claims that InferNet represents a paradigm shift in model extraction attacks by demonstrating that statistical robustness can be achieved without temporal precision.

• Practicality: The attack is highly practical for cloud environments where attackers lack root access but can run executables and access standard profiling tools (which are not uniformly restricted across all cloud providers or legacy CUDA versions).
• Stealth: By relying on aggregate data rather than intrusive hardware sniffing, the attack is non-intrusive and difficult to detect via standard anomaly detection on system logs.
• Strategic Impact: The ability to accurately identify the architecture family (e.g., "This is a BERT variant") significantly narrows the search space for adversaries, enabling targeted model stealing and undermining the security of foundation models.
• Limitations Acknowledged: The authors modestly note that while the attack is robust within an architectural generation (e.g., NVIDIA Turing), cross-generation transferability may require additional tuning. They also acknowledge that newer NVIDIA tools have restricted profiler access, though legacy environments and specific cloud configurations still expose this attack surface.

The paper concludes that aggregate GPU profiling exposes a significant vulnerability in the AI supply chain, necessitating new countermeasures such as dummy computations, randomized kernel scheduling, and restricted access to profiling tools.