隨著機器學習系統以及物聯網的成熟，邊緣裝置的技術也在蓬勃發展，其中與電腦視覺相關的應用更是受到不小的關注。大多用來處理電腦視覺相關的網路為卷積神經網路，然而對於部屬在邊緣端的神經網路模型來說，多了一種潛在來自於實體攻擊的威脅。邊緣裝置不同於雲端裝置，後者可能有被良好的集中保護、管理，前者相對來說暴露在容易受攻擊的環境下，對於裝置上的模型資料來說，就多了一種被竊取的風險。一般的對抗方式是對要傳送進晶片外記憶體的資料進行加密。
然而，對於較大型的網路模型來說，若每筆權重都要進行加解密，其參數量可能會龐大到嚴重影響神經網路運算的效能。因此，本論文提出了一個保護部屬在邊緣裝置上的針對影像分類應用的神經網路模型的保護機制，並以物理不可複製函數為基礎的安全模組進行金鑰管理。要在裝置上進行推理的影像都要先經過以金鑰為基礎的處理才能正常運作，如此即便攻擊者偷取儲存在外部記憶體裡的權重，也無法得到能正常運作的模型。另外，本論文也針對不同的影像處理方式進行分析，實驗在不同的攻擊下，攻擊者可以將模型的準確度重新提升到什麼程度。

With the maturity of machine learning system and the Internet of Things, edge device technology is booming, and applications related to computer vision have received considerable attention. Most of the neural networks used to process computer vision are convolutional neural networks. However, for neural networks deployed at the edge, there is a potential threat from physical attacks. Different from cloud devices which may be centrally protected and managed properly, edge devices are relatively exposed to an environment that is vulnerable to attacks, having an additional risk of model thereon stolen. A general countermeasure is to encrypt the data to be sent to the off-chip memory.
However, for larger network models, if each weight is going to be encrypted and decrypted, the amount of parameters may be so large that it dramatically affects the performance of neural network computation. Therefore, this thesis proposes a protection method to protect neural network models for image classification applications deployed on edge devices, with a secure module based on physical unclonable function for key management. Any images on the devices should be preprocessed based on keys to make the model function properly, so even if an attacker steals the weights stored in external memory, he cannot get a model that works properly without the keys. In addition, this thesis also analyzes different image preprocessing methods with different attacks, experimenting to what extent the attacker can improve the accuracy of the stolen model.

[1] Businesswire, “The Growth in Connected IoT Devices Is Expected to Generate 79.4ZB of Data in 2025, According to a New IDC Forecast.” https://www.businesswire.com/news/home/20190618005012/en/The-Growth-in-Connected-IoT-Devices-is-Expected-to-Generate-79.4ZB-of-Data-in-2025-According-to-a-New-IDC-Forecast (accessed Jul. 12, 2021).
[2] B. Varghese, N. Wang, S. Barbhuiya, P. Kilpatrick, and D. S. Nikolopoulos, “Challenges and Opportunities in Edge Computing,” in 2016 IEEE International Conference on Smart Cloud, SmartCloud, 2016, pp. 20–26.
[3] M. Mody, V. Raju, Y. A. Prithvishankar, and D. Poddar, “Secure CNN Accelerator,” in Proc. 2020 IEEE International Conference on Electronics, Computing and Communication Technologies, 2020, pp. 1–4.
[4] P. Zuo, Y. Hua, L. Liang, X. Xie, X. Hu, and Y. Xie, “SEALing Neural Network Models in Secure Deep Learning Accelerators.” arXiv:2008.03752, 2020, [Online]. Available: https://arxiv.org/abs/2008.03752.
[5] M. Isakov, V. Gadepally, K. M. Gettings, and M. A. Kinsy, “Survey of attacks and defenses on edge-deployed neural networks,” in Proc. 2019 IEEE High Performance Extreme Computing Conference, 2019, pp. 1–8.
[6] A. Pyone, M. Maung, and H. Kiya, “Training DNN model with secret key for model protection,” in Proc. 2020 IEEE 9th Global Conference on Consumer Electronics, 2020, pp. 818–821.
[7] M. Aprilpyone and H. Kiya, “An Extension of Encryption-Inspired Adversarial Defense with Secret Keys against Adversarial Examples,” in Proc. 2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference, 2020, pp. 1369–1374.
[8] PurpleSec, “2021 Cyber Security Statistics The Ultimate List Of Stats, Data & Trends.” https://purplesec.us/resources/cyber-security-statistics/ (accessed Jul. 15, 2021).
[9] K. O’Shea and R. Nash, “An Introduction to Convolutional Neural Networks.” 2015, [Online]. Available: http://arxiv.org/abs/1511.08458.
[10] P. Kim, “Convolutional Neural Network,” in MATLAB Deep Learning, Berkeley, CA: Apress, 2017, p. 162.
[11] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction APIs,” in Proc. of the 25th USENIX Security Symposium, 2016, pp. 601–618.
[12] T. Orekondy, B. Schiele, and M. Fritz, “Knockoff Nets: Stealing Functionality of Black-Box Models,” in Proc. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 4954–4963.
[13] M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “PRADA: Protecting against DNN model stealing attacks,” in Proc. 2019 IEEE European Symposium on Security and Privacy EuroS&P, 2019, pp. 512–527.
[14] M. Isakov, L. Bu, H. Cheng, and M. A. Kinsy, “Preventing neural network model exfiltration in machine learning hardware accelerators,” in Proc. 2018 Asian Hardware Oriented Security and Trust Symposium, 2018, pp. 62–67.
[15] V. Duddu, D. Samanta, D. V. Rao, and V. E. Balas, “Stealing Neural Networks via Timing Side Channels.” 2018, [Online]. Available: http://arxiv.org/abs/1812.11720.
[16] L. Batina, D. Jap, S. Bhasin, and S. Picek, “CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel,” in Proc. 28th USENIX Security Symposium, 2019, pp. 515–532.
[17] C. Yan, B. Rogers, D. Englender, Y. Solihin, and M. Prvulovic, “Improving cost, performance, and security of memory encryption and authentication,” in 33rd International Symposium on Computer Architecture, 2006, pp. 179–190.
[18] B. Rothke, “A look at the Advanced Encryption Standard (AES),” Information Security Management Handbook, Sixth Edition, pp. 1151–1158, 2007.
[19] C. Herder, M. D. Yu, F. Koushanfar, and S. Devadas, “Physical unclonable functions and applications: A tutorial,” Proc. IEEE, vol. 102, no. 8, pp. 1126–1141, 2014.
[20] C. H. Chang, Y. Zheng, and L. Zhang, “A Retrospective and a Look Forward: Fifteen Years of Physical Unclonable Function Advancement,” IEEE Circuits and Systems Magazine, vol. 17, no. 3, pp. 32–62, 2017.
[21] A. Maiti, J. Casarona, L. McHale, and P. Schaumont, “A large scale characterization of RO-PUF,” in Proc. 2010 IEEE International Symposium on Hardware-Oriented Security and Trust, 2010, pp. 94–99.
[22] G. E. Suh and S. Devadas, “Physical Unclonable Functions for Device Authentication and Secret Key Generation,” in Proc. 2007 44th ACM/IEEE Design Automation Conference, 2007, pp. 9–14.
[23] L. Y. Chiou, C. H. Wu, and P. C. Wei, “A reliable delay-based physical unclonable function with dark-bit avoidance,” in Proc. 2019 IEEE International Symposium on Circuits and Systems (ISCAS), 2019, pp. 1–4.
[24] M. Dworkin, “Recommendation for Block Cipher Modes of Operation: Methods and Techniques,” National Institute of Standards and Technology, 2001. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf.
[25] M. Dworkin, “Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC,” National Institute of Standards and Technology, 2007. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf.
[26] C.-W. Chang, “A Nonvolatile Processor Virtual Platform for Energy Efficiency and Performance Exploration,” M.S. thesis, EE, National Cheng Kung University, 2019.
[27] C.-H. Chiang, “Design Exploration of a Lightweight Hardware Secure Microsystem using Physical Unclonable Function at Electronic System Level,” M.S. thesis, EE, National Cheng Kung University, 2019.
[28] Y. Cai, X. Chen, L. Tian, Y. Wang, and H. Yang, “Enabling secure NVM-based in-memory neural network computing by sparse fast gradient encryption,” IEEE Transactions on Computers, vol. 69, no. 11, pp. 1596–1610, 2020.
[29] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples.” arXiv: 1412.6572, 2014, [Online]. Available: http://arxiv.org/abs/1412.6572.
[30] M. Tanaka, “Learnable Image Encryption,” in Proc. 2018 IEEE International Conference on Consumer Electronics-Taiwan, 2018, pp. 1–2.
[31] A. MaungMaung and H. Kiya, “A Protection Method of Trained CNN Model with Secret Key from Unauthorized Access.” arXiv:2105.14756, 2021, [Online]. Available: http://arxiv.org/abs/2105.14756.
[32] P. Li, “Reduce Static Code Size and Improve RISC-V Compression,” Electrical Engineering and Computer Sciences University of California at Berkeley, Tech. Rep., 2019. [Online]. Available: https://www2.eecs.berkeley.edu/Pubs/TechRpts/2019/EECS-2019-107.pdf.
[33] A. W. and K. Asanovic, The RISC-V Instruction Set Manual. 2019.
[34] “The CIFAR-10 dataset.” https://www.cs.toronto.edu/~kriz/cifar.html (accessed May 04, 2021).
[35] D. E. Knuth, The Art of Computer Programming, Volume 2: Seminumerical Algorithms. Addison-Wesley, 1969.
[36] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Conference on Computer Vision and Pattern Recognition, 2016, pp. 770–778.
[37] “TOP 500.” https://www.top500.org/lists/top500/2021/06/ (accessed Jul. 07, 2021).
[38] A. Ardakani, C. Condo, and W. J. Gross, “Fast and Efficient Convolutional Accelerator for Edge Computing,” IEEE Transactions on Computers, vol. 69, no. 1, pp. 138–152, 2020.
[39] M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L. C. Chen, “MobileNetV2: Inverted Residuals and Linear Bottlenecks,” in Proc. IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2018, pp. 4510–4520.