Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hints

As neural networks continue their reach into nearly every aspect of software operations, the details of those networks become an increasingly sensitive subject. Even those that deploy neural networks embedded in physical devices may wish to keep the inner working of their designs hidden -- either to protect their intellectual property or as a form of protection from adversarial inputs. The specific problem we address is how, through heavy system stack, given noisy and imperfect memory traces, one might reconstruct the neural network architecture including the set of layers employed, their connectivity, and their respective dimension sizes. Considering both the intra-layer architecture features and the inter-layer temporal association information introduced by the DNN design empirical experience, we draw upon ideas from speech recognition to solve this problem. We show that off-chip memory address traces and PCIe events provide ample information to reconstruct such neural network architectures accurately. We are the first to propose such accurate model extraction techniques and demonstrate an end-to-end attack experimentally in the context of an off-the-shelf Nvidia GPU platform with full system stack. Results show that the proposed techniques achieve a high reverse engineering accuracy and improve the one's ability to conduct targeted adversarial attack with success rate from 14.6\%$\sim$25.5\% (without network architecture knowledge) to 75.9\% (with extracted network architecture)

SPINN: Synergistic Progressive Inference of Neural Networks over Device and Cloud

Despite the soaring use of convolutional neural networks (CNNs) in mobile applications, uniformly sustaining high-performance inference on mobile has been elusive due to the excessive computational demands of modern CNNs and the increasing diversity of deployed devices. A popular alternative comprises offloading CNN processing to powerful cloud-based servers. Nevertheless, by relying on the cloud to produce outputs, emerging mission-critical and high-mobility applications, such as drone obstacle avoidance or interactive applications, can suffer from the dynamic connectivity conditions and the uncertain availability of the cloud. In this paper, we propose SPINN, a distributed inference system that employs synergistic device-cloud computation together with a progressive inference method to deliver fast and robust CNN inference across diverse settings. The proposed system introduces a novel scheduler that co-optimises the early-exit policy and the CNN splitting at run time, in order to adapt to dynamic conditions and meet user-defined service-level requirements. Quantitative evaluation illustrates that SPINN outperforms its state-of-the-art collaborative inference counterparts by up to 2x in achieved throughput under varying network conditions, reduces the server cost by up to 6.8x and improves accuracy by 20.7% under latency constraints, while providing robust operation under uncertain connectivity conditions and significant energy savings compared to cloud-centric execution.Comment: Accepted at the 26th Annual International Conference on Mobile Computing and Networking (MobiCom), 202

Management of gastric lymphoma with chemotherapy alone

Purpose. The optimal therapy for gastric lymphoma except MALToma has not yet been established. This study was undertaken to investigate whether gastric lymphoma can be managed effectively and safely with chemotherapy alone. Patients and methods. A total of 58 patients (median age 56 years) with newly diagnosed gastric lymphoma between 1989 2001 at Seoul National University Hospital and who were initially managed with chemotherapy alone were evaluated. MALToma was excluded from the pathologic review. Results. All patients received initially anthracycline-containing chemotherapy. ECOG performance scale 0-1 was 88% and B symptoms were present in 41.4%. Diffuse large B cell type was the most common (74.1%). Stage IE, II1E accounted for 51.7% and II2E, IIIE, IV for 48.3%. The international prognostic index (IPI) of risk was low in 39.7%, low-intermediate in 22.4%, high-intermediate in 15.5% and high in 22.4%. The complete response rate after first-line chemotherapy was 71.4% and the partial response rate was 12.2%. (overall response rate: 83.6%). Among patients who did not reach the complete response, a further complete response was achieved by second-line chemotherapy including etoposide-based regimen. Ultimately, the maximum complete response rate by chemotherapy was 83.7% (92% in stage IE, II1E, 75% in stage II2E, IIIE, IV). Median overall survival was 47.4 months (84.7 months in stage IE, II1E, 32.5 months in stage II2E, IIIE, IV) and the 5-year survival rate was 46%. Bleeding as a complication occurred in 3 of 58 patients (5.6%) and these cases were controlled by embolization or conservative management. No perforation episode occurred and surgical intervention due to complication was not necessary. Organ preservation was possible in 57 of 58 patients (98%). The one gastrectomy was performed due to a partial clinical response to chemotherapy but the specimen showed pathologic CR. Multivariate analysis revealed that only IPI had a significant influence on survival. Conclusions. Gastric lymphoma except MALToma can be managed effectively and safely with chemotherapy alone