{"type":"ScholarlyArticle","title":"Learn to Reverse DNNs from AI Programs Automatically","authors":[{"name":"Simin Chen","slug":"simin-chen","given":"Simin","family":"Chen","affiliation":"The University of Texas at Dallas"},{"name":"Hamed Khanpour","slug":"hamed-khanpour","given":"Hamed","family":"Khanpour","affiliation":"Microsoft Research"},{"name":"Cong Liu","slug":"cong-liu","given":"Cong","family":"Liu","affiliation":"The University of Texas at Dallas"},{"name":"Wei Yang","slug":"wei-yang","given":"Wei","family":"Yang","affiliation":"The University of Texas at Dallas"}],"abstract":"With the privatization deployment of DNNs on edge devices, the security of on-device DNNs has raised significant concern. To quantify the model leakage risk of on-device DNNs automatically, we propose NNReverse, the first learning-based method which can reverse DNNs from AI programs without domain knowledge. NNReverse trains a representation model to represent the semantics of binary code for DNN layers. By searching the most similar function in our database, NNReverse infers the layer type of a given function’s binary code. To represent assembly instructions semantics precisely, NNReverse proposes a more fine-grained embedding model to represent the textual and structural-semantic of assembly functions.","doi":"10.24963/ijcai.2022/94","url":"https://ijcai.org/proceedings/2022/94","pdf":"https://ijcai.org/proceedings/2022/0094.pdf","markdown":"https://ijcai.org/proceedings/2022/94.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/94","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":94,"pages":{"first":666,"last":672},"keywords":["Natural Language Processing: Embeddings","AI Ethics, Trust, Fairness: Trustworthy AI","AI Ethics, Trust, Fairness: Societal Impact of AI"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986947","length_sec":91,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985090","length_sec":342,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Alon et al., 2018] Uri Alon, Shaked Brody, Omer Levy, and Eran Yahav. code2seq: Generating sequences from structured representations of code. arXiv preprint arXiv:1808.01400, 2018.","title":"code2seq: Generating sequences from structured representations of code","authors":"Alon","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Alon et al., 2019] Uri Alon, Meital Zilberstein, Omer Levy, and Eran Yahav. code2vec: Learning distributed represen- tations of code. Proceedings of the ACM on Programming Languages, 3(POPL):1-29, 2019.","title":"code2vec: Learning distributed representations of code","authors":"Alon","year":"2019","venue":"Proceedings of the ACM on Programming Languages","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"ieee symposium on security and privacy (sp)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini et al., 2020] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large lan- guage models. arXiv preprint arXiv:2012.07805, 2020.","title":"Extracting training data from large language models","authors":"Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2018a] Tianqi Chen, Thierry Moreau, Ziheng Jiang, Lianmin Zheng, Eddie Yan, Haichen Shen, Meghan Cowan, Leyuan Wang, Yuwei Hu, Luis Ceze, et al. {TVM}: An automated end-to-end optimizing compiler for deep learning. In 13th {USENIX} Symposium on Op- erating Systems Design and Implementation ({OSDI} 18), pages 578-594, 2018.","title":"{TVM}: An automated end-to-end optimizing compiler for deep learning","authors":"Chen","year":"2018","venue":"13th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 18)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen et al., 2018b] Tianqi Chen, Thierry Moreau, Ziheng Jiang, Lianmin Zheng, Eddie Yan, Haichen Shen, Meghan Cowan, Leyuan Wang, Yuwei Hu, Luis Ceze, Carlos Guestrin, and Arvind Krishnamurthy. TVM: An auto- mated end-to-end optimizing compiler for deep learning. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 578-594, Carlsbad, CA, October 2018. USENIX Association.","title":"TVM: An automated end-to-end optimizing compiler for deep learning","authors":"Chen","year":"2018","venue":"13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18)","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Cyphers et al., 2018] Scott Cyphers, Arjun K Bansal, Anahita Bhiwandiwalla, Jayaram Bobba, Matthew Brookhart, Avijit Chakraborty, Will Constable, Christian Convey, Leona Cook, Omar Kanawi, et al. Intel ngraph: An intermediate representation, compiler, and executor for deep learning. arXiv preprint arXiv:1801.08058, 2018.","title":"Intel ngraph: An intermediate representation, compiler, and executor for deep learning","authors":"Scott Cyphers, K Arjun, Anahita Bansal, Jayaram Bhiwandiwalla, Matthew Bobba, Avijit Brookhart, Will Chakraborty, Christian Constable, Leona Convey, Omar Cook, Kanawi","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Devlin et al., 2018] Jacob Devlin, Ming-Wei Chang, Ken- ton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understand- ing. arXiv preprint arXiv:1810.04805, 2018.","title":"Bert: Pre-training of deep bidirectional transformers for language understanding","authors":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, Kristina Toutanova","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Duddu et al., 2018] Vasisht Duddu, Debasis Samanta, D Vi- jay Rao, and Valentina E Balas. Stealing neural networks via timing side channels. arXiv:1812.11720, 2018.","title":"Stealing neural networks via timing side channels","authors":"Vasisht Duddu, Debasis Samanta, Vijay Rao, Valentina E Balas","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hua et al., 2018] Weizhe Hua, Zhiru Zhang, and G Edward Suh. Reverse engineering convolutional neural networks through side-channel information leaks. In 2018 55th De- sign Automation Conference, 2018.","title":"Reverse engineering convolutional neural networks through side-channel information leaks","authors":"Hua","year":"2018","venue":"55th Design Automation Conference","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Jagielski et al., 2020] Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Paper- not. High accuracy and high fidelity extraction of neu- ral networks. In 29th {USENIX} Security Symposium ({USENIX} Security 20), pages 1345-1362, 2020.","title":"High accuracy and high fidelity extraction of neural networks","authors":"Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, Nicolas Papernot","year":"2020","venue":"29th {USENIX} Security Symposium ({USENIX} Security 20)","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Krishna et al., 2019] Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, and Mohit Iyyer. Thieves on sesame street! model extraction of bert-based apis. arXiv preprint arXiv:1910.12366, 2019.","title":"Thieves on sesame street! model extraction of bert-based apis","authors":"Kalpesh Krishna, Gaurav Singh Tomar, Ankur P Parikh, Nicolas Papernot, Mohit Iyyer","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2020] Mingzhen Li, Yi Liu, Xiaoyan Liu, Qingx- iao Sun, Xin You, Hailong Yang, Zhongzhi Luan, Lin Gan, Guangwen Yang, and Depei Qian. The deep learning com- piler: A comprehensive survey. IEEE Transactions on Par- allel and Distributed Systems, 32(3):708-727, 2020.","title":"The deep learning compiler: A comprehensive survey","authors":"Mingzhen Li, Yi Liu, Xiaoyan Liu, Qingxiao Sun, Xin You, Hailong Yang, Zhongzhi Luan, Lin Gan, Guangwen Yang, Depei Qian","year":"2020","venue":"IEEE Transactions on Parallel and Distributed Systems","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Oh et al., 2019] Seong Joon Oh, Bernt Schiele, and Mario Fritz. Towards reverse-engineering black-box neural net- works. In Explainable AI: Interpreting, Explaining and Vi- sualizing Deep Learning, pages 121-144. Springer, 2019.","title":"Towards reverse-engineering black-box neural networks","authors":"Joon Seong, Bernt Oh, Mario Schiele, Fritz","year":"2019","venue":"Explainable AI: Interpreting, Explaining and Visualizing Deep Learning","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Raffel et al., 2019] Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. arXiv preprint arXiv:1910.10683, 2019.","title":"Exploring the limits of transfer learning with a unified text-to-text transformer","authors":"Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, Peter J Liu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Roberts et al., 2019] Nicholas Roberts, Vinay Uday Prabhu, and Matthew McAteer. Model weight theft with just noise inputs: The curious case of the petulant attacker. arXiv preprint arXiv:1912.08987, 2019.","title":"Model weight theft with just noise inputs: The curious case of the petulant attacker","authors":"Nicholas Roberts, Vinay Uday Prabhu, Matthew Mcateer","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Rotem et al., 2018] Nadav Rotem, Jordan Fix, Saleem Abdulrasool, Garret Catron, Summer Deng, Roman Dzhabarov, Nick Gibson, James Hegeman, Meghan Lele, Roman Levenstein, et al. Glow: Graph lowering com- piler techniques for neural networks. arXiv preprint arXiv:1805.00907, 2018.","title":"Glow: Graph lowering compiler techniques for neural networks","authors":"Nadav Rotem, Jordan Fix, Saleem Abdulrasool, Garret Catron, Summer Deng, Roman Dzhabarov, Nick Gibson, James Hegeman, Meghan Lele, Roman Levenstein","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Shervashidze et al., 2011] Nino Shervashidze, Pascal Schweitzer, Erik Jan Van Leeuwen, Kurt Mehlhorn, and Karsten M Borgwardt. Weisfeiler-lehman graph kernels. Journal of Machine Learning Research, 12(9), 2011.","title":"Weisfeiler-lehman graph kernels","authors":"Nino Shervashidze, Pascal Schweitzer, Erik, Jan Van Leeuwen, Kurt Mehlhorn, Karsten M Borgwardt","year":"2011","venue":"Journal of Machine Learning Research","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Tramèr et al., 2016] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In 25th {USENIX} Security Symposium ({USENIX} Security 16), pages 601-618, 2016.","title":"Stealing machine learning models via prediction apis","authors":"Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, Thomas Ristenpart","year":"2016","venue":"25th {USENIX} Security Symposium ({USENIX} Security 16)","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Yan et al., 2020] Mengjia Yan, Christopher W Fletcher, and Josep Torrellas. Cache telepathy: Leveraging shared re- source attacks to learn {DNN} architectures. In 29th {USENIX} Security Symposium ({USENIX} Security 20), pages 2003-2020, 2020.","title":"Cache telepathy: Leveraging shared resource attacks to learn {DNN} architectures","authors":"Yan","year":"2020","venue":"29th {USENIX} Security Symposium ({USENIX} Security 20)","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Zhu et al., 2021] Yuankun Zhu, Yueqiang Cheng, Husheng Zhou, and Yantao Lu. Hermes attack: Steal {DNN} mod- els with lossless inference accuracy. In 30th {USENIX} Security Symposium ({USENIX} Security 21), 2021.","title":"Hermes attack: Steal {DNN} models with lossless inference accuracy","authors":"Zhu","year":"2021","venue":"30th {USENIX} Security Symposium ({USENIX} Security 21","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}