Timing Channels in Adaptive Neural Networks

Timing Channels in Adaptive Neural Networks

Speakers: Ayomide Akinsanya

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=4prxXaKYDyA

Overview

Modern deep neural networks (DNNs) have revolutionized various fields with their impressive predictive capabilities, yet they often demand substantial computational resources. This challenge has spurred the development of Adaptive Neural Networks (ADNNs), a class of optimized models designed to dynamically adjust their computational effort based on input characteristics. ADNNs aim to achieve faster predictions, particularly for "easy" inputs, by trading off some accuracy for enhanced efficiency. While their performance benefits have been extensively studied, the security ramifications of these input-dependent optimizations have remained largely unexplored. This seminal work by Ayomide Akinsanya systematically investigates and demonstrates how these efficiency-driven optimizations can inadvertently introduce critical timing-channel vulnerabilities.

The core finding is that by observing the execution time of an ADNN, an attacker can infer sensitive attributes about a user's input, posing a significant privacy risk within Machine-Learning-as-a-Service (MLaaS) frameworks. The research empirically evaluates six diverse ADNN architectures across four datasets, including those containing sensitive medical and demographic information. It conclusively shows that timing information can dramatically improve an adversary's ability to correctly infer sensitive attributes, with the probability of correct inference increasing by up to a factor of 9.89x.

To underscore the real-world applicability of these vulnerabilities, the talk presents practical exploitation scenarios over the public internet. This research highlights an urgent and previously unaddressed security concern in deployed machine learning systems, advocating for a fundamental re-evaluation of ADNN design and deployment strategies to incorporate timing side-channel defenses.

Background

▶ Watch: Introduction to ADNNs and timing channel vulnerability (0:00)

The increasing complexity and computational demands of traditional deep neural networks present significant challenges, especially for deployment on resource-constrained devices or in latency-sensitive applications. Adaptive Neural Networks (ADNNs) emerged as a solution to this problem, designed to optimize inference by varying the amount of computation performed based on the perceived "difficulty" of the input. This dynamic behavior allows ADNNs to achieve a desirable trade-off between accuracy and computational performance.

Several architectural paradigms fall under the ADNN umbrella:

• Early-exit neural networks (e.g., BranchyNet, Shallow-Deep Networks (SDNs)) augment a primary backbone classifier with multiple intermediate exit points. Easier inputs, identified with high confidence at an early stage, can exit the network prematurely, reducing computation.
• Dynamic neural networks (e.g., BlockDrop, SkipNet) dynamically select which computational paths or blocks within the inference graph to execute, effectively skipping redundant or unnecessary operations for certain inputs.
• Model selection or cascade networks (e.g., MSDNet, RANet) employ an ensemble of models with varying computational requirements. Inputs are progressively routed through increasingly complex models until a predefined confidence or accuracy criterion is met.

The specific ADNN types investigated in this research include Branchy-AlexNet, Shallow-Deep Networks (VGG and ResNet-56 variants), Multi-Scale Dense Networks (MSDNets), Resolution Adaptive Networks (RANet), BlockDrop, and SkipNet, all primarily used for image classification tasks.

The concept of side channels in computing systems is well-established, referring to vulnerabilities that allow an attacker to glean confidential information by observing non-functional side effects of computation, such as execution time, power consumption, or memory access patterns. While side channels have been extensively studied in traditional cryptographic and software systems, their implications for machine learning systems are a more recent and growing area of concern. Previous research has demonstrated how side channels can be exploited to extract sensitive model parameters, infer class labels for unknown inputs, and even reconstruct input images. This work specifically focuses on timing side channels within an MLaaS framework, where multiple clients interact with a shared ML model via an API. The objective is to infer sensitive properties of a victim user's input by simply observing the model's response time over the network. A timing channel exists if there are at least two distinct subsets of the input space that can be differentiated based on observable execution times, and if these partitions correlate with sensitive attributes, a privacy violation occurs.

Key Findings

▶ Watch: Focus on timing side channels in MLaaS frameworks (3:45)

The research unequivocally demonstrates the existence and exploitability of timing channels in Adaptive Neural Networks (ADNNs), leading to significant leakage of sensitive input attributes. The core findings are derived from extensive empirical evaluation across various ADNN architectures and datasets, measured by Attack Success Rate (ASR).

1. Pervasive Timing Channels in ADNNs:

All six evaluated ADNN types (Branchy-AlexNet, SDNs, MSDNets, RANet, BlockDrop, SkipNet) were found to exhibit timing channels that leak sensitive information. This confirms that the input-dependent computational variations inherent in ADNNs create observable differences in execution time.

2. Dramatically Improved Attribute Inference:

Attackers can significantly enhance their ability to infer sensitive attributes by leveraging timing information. The research observed substantial improvements over a Random Guessing Attack (RandGA) baseline:

• For BlockDrop on the CIFAR10 dataset (10 classes), a cluster of inputs showed an ASR of 98.94%, representing a remarkable 9.89x improvement over RandGA (10%).
• SDNet on the FAIRFACE dataset (3 age groups) achieved an ASR of 94.29% for a specific cluster, a 2.83x improvement over RandGA (33.33%).
• Branchy-AlexNet on the CANCER dataset (2 classes: benign/malignant) yielded an ASR of 82.61% for a cluster, a 1.65x improvement over RandGA (50%).

These figures highlight that even for datasets with a larger number of possible attribute values (like CIFAR10), timing channels can provide highly accurate insights.

3. Vulnerability of Input Subsets:

While not all inputs lead to high leakage, specific subsets of the input space are highly vulnerable. For instance, the cluster achieving 94.29% ASR for SDNet on FAIRFACE contained 5.42% of the input distribution, and the 82.61% ASR cluster for Branchy-AlexNet on CANCER covered 27.33% of the input distribution. Even small, identifiable portions of vulnerable input space constitute a significant privacy risk.

4. Correlation of "Easier" Inputs with Earlier Exits/Paths:

For early-exit and model cascade ADNNs (Branchy-AlexNet, SDNet, RANet, MSDNet), inputs deemed "easier" by the model (e.g., benign cancer images, specific age groups) tend to exit earlier, resulting in lower execution times. This predictable behavior allows an adversary to correlate shorter timings with these specific sensitive attributes.

5. Impact of Hyperparameters on Leakage:

• Exit Thresholds: In early-exit and model cascade ADNNs, stricter (conservative) exit thresholds, which prioritize accuracy and reduce early exits, can paradoxically increase the ASR/cluster (e.g., Branchy-AlexNet on FAIRFACE reached 100% ASR/cluster in a conservative setting). Conversely, relaxed thresholds, favoring speed, might reduce the highest ASR/cluster by allowing more diverse inputs to exit early, but also reduce model accuracy.
• Model Depth: For dynamic networks, deeper models generally exhibit higher timing channel leakage. For example, BlockDrop ResNet-110 (54 blocks) on CIFAR10 showed 98.94% ASR/cluster, compared to BlockDrop ResNet-32 (15 blocks) at 87.5%. This is attributed to the greater number of unique computational paths and block-dropping policies available in deeper networks, leading to finer-grained partitioning of the input space.

6. Learning Adversarial Input Characteristics:

The research also demonstrated that timing channels can be used to distinguish between adversarial and non-adversarial inputs. Using BlockDrop and SkipNet on CIFAR10, timing observations allowed for differentiation between inputs generated by the Fast Gradient Sign Attack (FGSM) and benign inputs, suggesting that adversarial inputs might traverse longer or different execution paths within the ADNN.

Technical Deep Dive

▶ Watch: Illustrating timing channels with BranchyNet and medical data (4:00)

The technical methodology employed in this research provides a robust framework for identifying and quantifying timing channel vulnerabilities in ADNNs.

Threat Model:

The adversary operates under a black-box threat model where they do not have access to the internal architecture, weights, or parameters of the target ADNN model F. Their primary capability is to monitor TLS/SSL encrypted network communication between a victim client and an MLaaS server. This monitoring can occur over a Local Area Network (LAN) or the public internet. The adversary measures the response time of the ML server for both their own queries and, crucially, for the victim's queries. They are assumed to be a legitimate client of the MLaaS, capable of submitting arbitrary queries without being flagged, and possess a manifest dataset (DSM). This DSM is drawn from the same input distribution as the target model's training data but is not necessarily a subset of it. The MLaaS server is assumed to process queries individually, not in batches, which simplifies timing attribution. The adversary's goal is to infer a sensitive attribute a of a victim's input x based solely on observed inference times.

Attacker's Strategy (Algorithm 1):

The attack unfolds in two main stages, followed by an analysis step:

1. Obtain Timing Profile T:

• The adversary queries the target ADNN model F using data samples (xi, ai) from their manifest dataset (DSM).
• For each query, the adversary records the model's inference time (ti) over the network.
• This process generates a timing profile T, which is a collection of pairs (ti, ai), mapping observed inference times to their corresponding sensitive attributes.

1. Train Attack Model A:

• An attack model A is trained using the collected timing profile T.
• This model takes an observed inference time (ti) as input and outputs a prediction for the sensitive attribute (ai).
• The attack model used in this research is a simple deep neural network comprising two hidden layers with 64 and 32 neurons, respectively, both utilizing ReLU activation functions. This design ensures the attack model is lightweight and quick to train. The objective is for A to learn the correlation between execution times and sensitive attributes.

1. Cluster Timing Observations T and Evaluate:

• To understand if specific time partitions yield high attack success rates, the timing profile T is partitioned into different time clusters C = C1, ..., Cn.
• Kernel Density Estimation (KDE), an unsupervised statistical method suitable for one-dimensional data, is employed for this clustering. KDE identifies peaks in the distribution of timing measurements, which often correspond to distinct computational paths within the ADNN. For instance, in Branchy-AlexNet, KDE successfully identified three clusters corresponding to the three distinct exit points.
• Finally, the Attack Success Rate (ASR) is calculated both overall and for each individual cluster (ASR/cluster). A high ASR/cluster indicates a strong correlation between that specific timing cluster and a sensitive attribute, signifying a privacy violation.

Experimental Setup:

The experiments were conducted in a Local Area Network (LAN) Setup to minimize network noise. The target ML model was hosted on a MacBook Pro 2021 (M1 Pro, 16GB RAM) running a Python Flask web service. The client machine was a Dell XPS 11th Gen (2.4GHz 8-Core Intel Core i5, 16GB RAM). Both were connected via Ethernet through a WAVLINKAC 1200 router, resulting in a typical round-trip time (RTT) of 1.35 msec (min 0.540, mean 1.347, max 1.849).

Machine Learning Models:

Six diverse ADNN types were evaluated for image classification:

• Early-Exit Networks: Branchy-AlexNet (with 2 early exit classifiers) and Shallow-Deep Networks (SDNs) (VGG and ResNet-56 variants, using confidence scores and confusion metrics for exits).
• Model Selection/Cascade Networks: Multi-Scale Dense Networks (MSDNets) (structured into multiple scales with dense blocks) and Resolution Adaptive Networks (RANet) (ensemble of models at three scales).
• Dynamic Networks: BlockDrop (dynamically selects ResNet layers/blocks) and SkipNet (uses a gating network to selectively skip convolutional blocks).

Sensitive Attributes:

Three types of potentially sensitive attributes were targeted:

• CLASS LABEL: The actual class of the input (e.g., benign/malignant for CANCER).
• GENERALIZED LABEL: A super category of the class (e.g., large carnivores for CIFAR100).
• ADVERSARIAL INPUT: Whether an input was adversarial (generated using FGSM).

Datasets:

Four datasets were used:

• CIFAR10 & CIFAR100: 32x32 RGB natural images, 10 and 100 classes respectively (50,000 training, 10,000 testing).
• CANCER (ISIC archive): 224x224 images of benign and malignant skin moles (augmented to 10,548 training, 2,400 testing, equally split).
• FAIRFACE: 108,501 images (96,336 training, 12,165 testing), 224x224, labeled with race, gender, and age groups (focused on predicting 3 age groups, equally split).

Training and Parameters:

ADNNs were configured following their original paper specifications. The attack model was trained for 100 epochs using the Adam optimizer. To ensure robust timing measurements, each input query was repeated 5 times over the LAN, and the average time was recorded. For KDE, a default bandwidth of 1 was used.

Demo / Proof of Concept

▶ Watch: Understanding the attacker's capabilities, knowledge, and goals (6:00)

To illustrate the real-world applicability and exploitability of these timing channels, the research conducted two compelling case studies involving public internet exploitation. These demonstrations moved beyond controlled LAN environments to show that the observed timing differences are robust enough to persist and be leveraged even in the presence of network noise and variability.

The experimental setup for these case studies involved hosting the ADNN-powered web applications on a Google Cloud server located in the USA eastern region (Moncks Corner, South Carolina). The client, acting as both the adversary and the victim, was situated in Hoboken, New Jersey, USA. This configuration established a geographical distance of approximately 700 miles and a typical network path of 7 hops. The observed Round-Trip Time (RTT) over this public internet connection was around 13.1 msec (min 10.5, mean 13.12, max 14.8, std 1.1), significantly higher and more variable than the LAN setup. The attack model was first trained in a controlled environment as described in the technical deep dive, and then applied to observations made over the public internet.

1. Fictitious Health Company:

This scenario simulated a toy company offering skin cancer predictions from uploaded images of moles using ADNNs. Given the highly confidential nature of such medical diagnoses, any information leakage constitutes a severe privacy breach.

• For Branchy-AlexNet, an ASR/cluster of 84.88% was observed for inferring whether an input image depicted a malignant skin mole, a substantial improvement over the 50% RandGA baseline.
• RANet demonstrated an 86.49% ASR/cluster, with nearly a quarter (25%) of the input images falling into this highly vulnerable cluster.
• While SDNet and SkipNet showed lower overall ASRs, they still exhibited significant improvements (over 60%), indicating an enhanced inference capability for an adversary. These results confirm that even over the public internet, timing information can be effectively used to infer sensitive medical attributes.

2. Fictitious HR Application:

In this case study, a toy HR company utilized ADNNs for age estimation from uploaded candidate images, where age estimations are considered confidential.

• The results showed consistently high ASR/cluster for at least one cluster across all tested architectures, with inference accuracy improving from the 33.33% RandGA baseline to over 70% in all cases.
• Notably, SDNet exhibited a very strong leakage, achieving 92.86% ASR/cluster for a specific age group. Although this highly vulnerable cluster represented a smaller proportion of submitted images (3.48%), it still represents a critical privacy failure for those inputs.

Additional Internet Experiments (CIFAR10):

Further experiments using the CIFAR10 dataset over the public internet also yielded significant results. BlockDrop achieved 76.09% ASR/cluster, and SkipNet reached 60.0% ASR/cluster, demonstrating that even for datasets with a larger number of classes, timing channels remain exploitable.

Impact of Noisy Observations:

Operating over the public internet inevitably introduces noise due to factors like network congestion, latency variations, and packet loss. To mitigate this and draw reliable conclusions, the researchers employed several strategies:

• Each input in the manifest dataset was queried ten times, and the average timing was recorded.
• Statistical techniques were applied to identify and remove outlier measurements from the timing data.

Despite these efforts, a decrease in the highest observed ASR/cluster compared to LAN measurements was noted, confirming the inherent challenges of noisy real-world networks. However, the sustained high ASR values in the public internet case studies conclusively prove that these timing channels are not merely theoretical curiosities but practical vulnerabilities.

Defensive Implications

▶ Watch: Overview of the adversary's two-stage attack strategy (8:00)

The findings of this research highlight a critical, previously underexplored vulnerability in Adaptive Neural Networks (ADNNs), necessitating a proactive approach from developers and MLaaS providers. The defensive implications are clear: timing side channels must be considered a first-class security concern in the design, deployment, and operation of adaptive machine learning systems.

Here are key actions and considerations for defenders:

1. Acknowledge and Quantify Risk: MLaaS providers deploying ADNNs must acknowledge that their systems are inherently susceptible to timing channel attacks. They should conduct internal assessments, similar to the methodology presented in this work, to quantify the specific leakage risks for their models and sensitive attributes.

1. Introduce Random Delays: A straightforward, albeit potentially performance-impacting, mitigation is to introduce randomized delays during model inference. By adding random noise to the response time, the attacker's ability to discern distinct timing clusters correlated with sensitive attributes would be significantly hampered. This could involve randomizing computation paths or adding artificial delays before sending responses.

1. Explore Robust Model Parameters: The research demonstrated that ADNN hyperparameters, such as exit thresholds and model depth, significantly influence vulnerability. Defenders should investigate the parameter space to identify configurations that minimize timing leakage while maintaining acceptable accuracy and efficiency. This could involve:

• Tuning Exit Thresholds: Rather than solely optimizing for accuracy or speed, thresholds should be tuned with an awareness of their impact on timing channel distinctiveness. Relaxed thresholds, while potentially reducing accuracy, might lead to less distinct timing clusters.
• Analyzing Model Depth: For dynamic networks, the choice of network depth should consider the trade-off between performance benefits and increased timing channel susceptibility.

1. Implement Online Monitoring Systems: Deployed ADNNs should be continuously monitored for anomalous timing patterns that might indicate an ongoing timing channel attack. An online monitoring system could detect unusual shifts in timing distributions or correlations with known sensitive attributes, triggering alerts or mitigation responses.

1. Remove Privacy-Violating Policies: The talk suggests investigating the effectiveness of "removing block dropping or skipping policies linked to privacy violations." This implies a more granular approach where specific computational paths or decision points within an ADNN that strongly correlate with sensitive attributes are either removed, randomized, or made indistinguishable in terms of timing.

1. Adversarial Training and Fuzzing: Future work suggests an automated fuzzing-based approach to explore network parameters to generate models robust to timing channels. Defenders could leverage similar techniques to proactively discover and patch timing vulnerabilities during the model development and testing phases. This could involve fuzzing input data or model configurations to observe timing variations and identify leakage points.

1. Input/Output Sanitization and Obfuscation: While not explicitly detailed, general side-channel defenses often include techniques to normalize or obfuscate input/output characteristics. For ADNNs, this might involve ensuring that inputs that lead to very different computational paths are processed in a way that their timing differences are less pronounced or predictable.

In essence, the core defensive implication is to move beyond mere functional correctness and performance optimization for ADNNs, and to explicitly integrate timing side-channel analysis into the security development lifecycle for all MLaaS platforms leveraging these adaptive architectures.

Key Takeaways

• Adaptive Neural Networks (ADNNs) introduce significant timing-channel vulnerabilities: The input-dependent computational variations in ADNNs create observable differences in execution time, which can be exploited by an adversary.
• Sensitive attributes can be inferred with high accuracy: By simply measuring inference times over a network, attackers can infer confidential information, with observed attack success rates (ASR) increasing by up to 9.89x over random guessing for certain attributes and architectures (e.g., BlockDrop on CIFAR10).
• Black-box attacks are feasible and practical: An adversary with only black-box access to the MLaaS model and a manifest dataset can construct an effective attack model using observed timing profiles and Kernel Density Estimation (KDE) for clustering.
• Real-world exploitation is demonstrated over the public internet: Case studies with fictitious health and HR applications show that timing channels are robust enough to be exploited over the public internet, even amidst network noise, achieving high ASRs (e.g., 84.88% for Branchy-AlexNet on a health application).
• ADNN hyperparameters significantly influence vulnerability: Model configuration choices like exit thresholds in early-exit networks and model depth in dynamic networks directly impact the degree of timing leakage, offering potential avenues for defense.
• Urgent need for defensive measures in MLaaS: This research highlights a critical, previously unexplored privacy risk, demanding that MLaaS providers and ADNN developers integrate timing side-channel considerations and mitigation strategies into their design and deployment processes.

About the Speaker(s)

The talk was presented by Ayomide Akinsanya at the NDSS Symposium. The transcript and metadata do not provide further details regarding their title, affiliation, or specific background beyond their name.