BarraCUDA: GPUs Do Leak DNN Weights
summary
Physical access to edge devices plus simple probes and DPA let attackers recover neural net weights from GPU power/package leakage. Reverse‑engineered CUDA kernels on Nvidia Jetson (Maxwell) reveal hotspots at capacitor pads; convolution maps to matrix multiplies and ReLU/bias leaks strongly. Each weight is 16‑bit weights and recovery needs anywhere from 1–20 million traces; a CUDA implementation takes ~5 minutes per weight, estimating $50,000 for 5M weights. Masking, shuffling or warp scheduling reduce but don’t eliminate risk.
AI-written summary · about
chapters (10)
- 0:00Motivation and background
- 3:38Attacks on DNNs
- 5:32Crypto vs DNN comparison
- 6:49GPU architecture
- 8:39Threat model and challenges
- 11:02Methodology and setup
- 13:48Implementation analysis
- 15:42Leakage modeling and results
- 21:24Parallelization and cost
- 22:59Countermeasures and future work
related talks
28mDark Silicon: Unmasking GPU Threats in the Age of AI
44mReversing Large Deep Learning AI Models
18mCharacterizing NVIDIA Confidential Computing Overheads Across Model Inference & Training
38mHow to run Neural Nets on GPUs'
18mTelekine: Secure Computing with Cloud GPUs
57mDeep Learning with C++
11mHow Do We Compress Giant AI Models to Run at the Edge?
30mUnderstanding GPUs