{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,10,30]],"date-time":"2024-10-30T14:17:44Z","timestamp":1730297864301,"version":"3.28.0"},"reference-count":89,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833743","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1157-1174","source":"Crossref","is-referenced-by-count":35,"title":["DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories"],"prefix":"10.1109","author":[{"given":"Adnan Siraj","family":"Rakin","sequence":"first","affiliation":[{"name":"Arizona State University,School of Electrical, Computer, and Energy Engineering,Tempe,AZ"}]},{"given":"Md Hafizul Islam","family":"Chowdhuryy","sequence":"additional","affiliation":[{"name":"University of Central Florida,Department of Electrical and Computer Engineering,Orlando,FL"}]},{"given":"Fan","family":"Yao","sequence":"additional","affiliation":[{"name":"University of Central Florida,Department of Electrical and Computer Engineering,Orlando,FL"}]},{"given":"Deliang","family":"Fan","sequence":"additional","affiliation":[{"name":"Arizona State University,School of Electrical, Computer, and Energy Engineering,Tempe,AZ"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2015.152"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"journal-title":"Seeds of seed Nmt-stroke Diverting neural machine translation through hardwarebased faults","year":"2021","author":"cai","key":"ref56"},{"key":"ref12","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"chandrasekaran","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref59","first-page":"697","article-title":"Zebram: comprehensive and compatible software protection against rowhammer attacks","author":"konoth","year":"2018","journal-title":"OSDI"},{"key":"ref15","first-page":"4743","article-title":"Zero-shot knowledge distillation in deep networks","author":"nayak","year":"2019","journal-title":"International Conference on Machine Learning"},{"key":"ref58","first-page":"168","article-title":"Are coherence protocol states vulnerable to information leakage?","author":"yao","year":"2018","journal-title":"IEEE International Symposium on High-Performance Comp Architecture"},{"journal-title":"arXiv preprint arXiv 2010 11419","article-title":"Black-box ripper: Copying black-box models using generative evolutionary algorithms","year":"2020","author":"barbalau","key":"ref14"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00089"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00031"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3152701.3152709"},{"key":"ref11","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","author":"jagielski","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref54","first-page":"71","article-title":"Exploiting the dram rowhammer bug to gain kernel privileges","volume":"15","author":"seaborn","year":"2015","journal-title":"Black Hat"},{"key":"ref10","first-page":"1445","article-title":"V0ltpwn: Attacking x86 processor integrity from software","author":"kenjar","year":"2020","journal-title":"USENIX Security Symposium"},{"journal-title":"arXiv preprint arXiv 1905 09010","article-title":"A framework for the extraction of deep neural networks by leveraging public data","year":"2019","author":"pal","key":"ref17"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3287560.3287562"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2019.2915318"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/s10766-018-0609-3"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833773"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2020.2973007"},{"key":"ref89","article-title":"Aggregated residual transformations for deep neural networks","volume":"abs 1611 5431","author":"xie","year":"2016","journal-title":"CoRR"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437517"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2749469.2750394"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3431920.3439468"},{"journal-title":"Learning multiple layers of features from tiny images","year":"2009","author":"krizhevsky","key":"ref86"},{"key":"ref41","first-page":"601","article-title":"Stealing machine learning models via prediction apis","author":"tram\u00e8r","year":"2016","journal-title":"USENIX Security Symposium"},{"journal-title":"Cifar-10 (canadian institute for advanced research)","year":"2010","author":"krizhevsky","key":"ref85"},{"journal-title":"arXiv preprint arXiv 1812 11720","article-title":"Stealing neural networks via timing side channels","year":"2018","author":"duddu","key":"ref44"},{"journal-title":"arXiv preprint arXiv 1605 07146","article-title":"Wide residual networks","year":"2016","author":"zagoruyko","key":"ref88"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48063.2020.00031"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2019.8740835"},{"key":"ref8","doi-asserted-by":"crossref","first-page":"300","DOI":"10.1007\/978-3-319-40667-1_15","article-title":"Rowhammer. js: A remote software-induced fault attack in javascript","author":"gruss","year":"2016","journal-title":"Detection of Intrusions and Malware and Vulnerability Assessment"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00020"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2678373.2665726"},{"key":"ref4","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"chandrasekaran","year":"2020","journal-title":"USENIX Security Symposium"},{"journal-title":"arXiv preprint arXiv 1610 05256","article-title":"Achieving human parity in conversational speech recognition","year":"2016","author":"xiong","key":"ref3"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00057"},{"journal-title":"arXiv preprint arXiv 2002 06755","article-title":"How to 0wn nas in your spare time","year":"2020","author":"hong","key":"ref5"},{"key":"ref82","first-page":"1","article-title":"Intel sgx explained","volume":"2016","author":"costan","year":"2016","journal-title":"IACR Cryptol ePrint Arch"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-10366-7_10"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00068"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064219"},{"key":"ref80","article-title":"Learning transferable adversarial perturbations","volume":"34","author":"salzmann","year":"2021","journal-title":"Advances in neural information processing systems"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00060"},{"journal-title":"ICML Workshop on Adversarial Machine Learning","article-title":"Towards transferable adversarial perturbations with minimum norm","year":"2021","author":"liu","key":"ref79"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2021.3122830"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref37","first-page":"1463","article-title":"Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips","author":"yao","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"journal-title":"Half-double Next-row-over assisted rowhammer","year":"0","key":"ref75"},{"key":"ref31","first-page":"719","article-title":"Flush+reload: A high resolution, low noise, l3 cache side-channel attack","author":"yarom","year":"2014","journal-title":"USENIX Security Symposium"},{"key":"ref74","first-page":"1182","article-title":"A deeper look into rowhammer’s sensitivities: Experimental analysis of real dram chipsand implications on future attacks and defenses","author":"orosa","year":"2021","journal-title":"IEEE International Symposium on Microarchitecture"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i3.149-175"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00004"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00090"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173204"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.123"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5709"},{"journal-title":"arXiv preprint arXiv 1409 1556","article-title":"Very deep convolutional networks for large-scale image recognition","year":"2014","author":"simonyan","key":"ref38"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP40778.2020.9191063"},{"volume":"2","journal-title":"Data Structures Using C and C++","year":"1996","author":"langsam","key":"ref70"},{"key":"ref73","first-page":"1198","article-title":"Uncovering in-dram rowhammer protection mechanisms: A new methodology, custom rowhammer patterns, and implications","author":"hassan","year":"2021","journal-title":"IEEE International Symposium on Microarchitecture"},{"journal-title":"International Conference on Machine Learning","article-title":"Theoretically principled trade-off between robustness and accuracy","year":"2019","author":"zhang","key":"ref72"},{"journal-title":"arXiv preprint arXiv 2101 02353","article-title":"Fbgemm: Enabling high-performance low-precision deep learning inference","year":"2021","author":"khudia","key":"ref68"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD50377.2020.00095"},{"journal-title":"International Conference on Learning Representations","article-title":"Towards deep learning models resistant to adversarial attacks","year":"2018","author":"madry","key":"ref67"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3060403.3060417"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/HOST45689.2020.9300274"},{"journal-title":"QNNPACK open source library for optimized mobile deep learning","year":"0","author":"dukhan","key":"ref69"},{"key":"ref25","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn dnn architectures","author":"yan","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref64","first-page":"1","article-title":"Flip feng shui: Hammering a needle in the software stack","author":"razavi","year":"2016","journal-title":"USENIX Security Symposium"},{"key":"ref20","first-page":"8178","article-title":"Reverse-engineering deep relu networks","author":"rolnick","year":"2020","journal-title":"International Conference on Machine Learning"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_3"},{"journal-title":"arXiv preprint arXiv 1605 07761","article-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","year":"2016","author":"papernot","key":"ref66"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.43"},{"journal-title":"Understanding the Linux Virtual Memory Manager","year":"2004","author":"gorman","key":"ref65"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243831"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378460"},{"key":"ref27","first-page":"515","article-title":"CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel","author":"batina","year":"2019","journal-title":"USENIX Security Symposium"},{"journal-title":"USENIX Security Symposium","article-title":"Hermes attack: Steal dnn models with lossless inference accuracy","year":"2021","author":"zhu","key":"ref29"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00359"},{"key":"ref62","first-page":"8026","article-title":"Pytorch: An imperative style, high-performance deep learning library","volume":"32","author":"paszke","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00020"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","start":{"date-parts":[[2022,5,22]]},"location":"San Francisco, CA, USA","end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833743.pdf?arnumber=9833743","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:06:40Z","timestamp":1699484800000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833743\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":89,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833743","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}
