To reduce this vulnerability, researchers at MIT and the MIT-IBM Watson AI Lab created a machine learning accelerator resistant to the two most common types of attacks. Their chip can keep a user's medical records, financial information, or other sensitive data private, while allowing massive AI models to run efficiently on devices.
The team has developed several optimizations that enhance security while slightly slowing down the device. Furthermore, the added security does not affect the accuracy of the calculations. This machine learning accelerator could be particularly beneficial for demanding AI applications such as augmented and virtual reality or autonomous driving.
Although implanting the chip would slightly increase the device's cost and make it less energy efficient, sometimes that price is worth paying for security, says lead author Maitreyi Ashok, a graduate student in Electrical and Computer Engineering (EECS) at MIT.
"It's important to design with safety in mind from the very beginning. If you try to add even a little safety once the system is designed, it becomes prohibitively expensive. We were able to effectively balance many of these trade-offs during the design phase," Ashok says.
Co-authors include Saurav Maji, an EECS graduate student; Xin Zhang and John Cohn of the MIT-IBM Watson Artificial Intelligence Laboratory; and lead author Anantha Chandrakasan, MIT's director of innovation and strategy, dean of the College of Engineering, and the Vannevar Bush Professor at EECS. The research will be presented at the IEEE Custom Integrated Circuits Conference.
Side-channel susceptibility:
The researchers focused on a type of machine learning accelerator called in-memory digital computing. A digital IMC chip performs calculations within a device's memory, where the pieces of a machine learning model are stored after being transferred from a central server.
The complete model is too large to store on the device, but by dividing it into fragments and reusing them as much as possible, IMC chips reduce the amount of data that needs to be moved around.
But IMC chips can be vulnerable to hackers. In a side-channel attack, a hacker monitors the chip's power consumption and uses statistical techniques to reverse-engineer the data while the chip is computing. In a bus probing attack, the hacker can steal bits from the model and dataset by probing the communication between the accelerator and the chip's external memory.
Digital IMC speeds up calculations by performing millions of operations at once, but this complexity makes it difficult to prevent attacks with traditional security measures, Ashok says.
She and her collaborators adopted a three-pronged approach to blocking side-channel and bus-probing attacks.
First, they employed a security measure in which the IMC data is divided into random chunks. For example, a zero bit can be split into three bits that remain equal to zero after a logical operation. The IMC never computes with all the chunks in the same operation, so a side-channel attack could never reconstruct the original data.
But for this technique to work, random bits must be added to divide the data. Since the digital IMC performs millions of operations simultaneously, generating so many random bits would involve too many calculations. For their chip, the researchers found a way to simplify the calculations, making it easier to effectively divide the data and eliminating the need for random bits.
Secondly, they prevented bus-probing attacks by using a lightweight cipher that encrypts the model stored in the chip's external memory. This lightweight cipher requires only simple calculations. Furthermore, they only decrypt the model fragments stored on the chip when necessary.
Third, to improve security, they generated the decryption key directly on the chip, rather than moving it around with the model. They generated this unique key from random variations on the chip introduced during manufacturing, using what is known as a physically non-clonable feature.
"One wire might be slightly thicker than another. We can use these variations to obtain zeros and ones from a circuit. For each chip, we can obtain a random key that should be consistent because these random properties shouldn't change significantly over time," Ashok explains.
They reused the chip's memory cells, taking advantage of imperfections in these cells to generate the key. This requires fewer calculations than generating a key from scratch.
“As security has become a critical issue in edge device design, a comprehensive system stack focused on secure operation is needed. This work focuses on the security of machine learning workloads and describes a digital processor that uses cross-optimization. It incorporates encrypted data access between memory and the processor, approaches to prevent side-channel attacks using randomization, and exploiting variability to generate unique codes. These designs will be fundamental in future mobile devices,” says Chandrakasan.
Safety tests
To test their chip, the researchers put themselves in the shoes of hackers and tried to steal secret information using side-channel attacks and bus-probing.
Even after millions of attempts, they were unable to reconstruct any real information or extract any fragments of the model or dataset. Furthermore, the encryption remained unbreakable. In contrast, it took only about 5,000 samples to steal information from an unprotected chip.
The addition of safety reduced the accelerator's energy efficiency and also required a larger chip surface area, which would increase its manufacturing cost.
The team plans to explore methods that could reduce energy consumption and chip size in the future, making it easier to apply on a large scale.
"As it becomes too expensive, it becomes harder to convince someone that safety is paramount. Future work could explore these trade-offs. Perhaps we could make it a little less safe, but easier to implement and less expensive," Ashok says.
