On the Complementarity of Software and Side-Channel Attacks Against Deep Learning Algorithms

Deep Neural Networks (DNNs) are becoming increasingly popular, and state of-the-art models are now valuable intellectual property. However, the combination of their high value and increased attack surface caused by their deployment at the edge, has led attackers to consider new types of attack, such as side-channel attacks. As such, new attack paths continue to emerge, limiting the ability of defenders to define a security perimeter. To mitigate these issues, this thesis proposes focusing on new attack methodologies to demonstrate the impact of side channel attacks and why developers should consider them. This thesis can be subdivided into two main studies. The first one is related to improving already existing attacks against DNNs using side-channel attacks. We enhance the feasibility of evasion and model extraction attacks by targeting two popular activation functions, the softmax and the ReLU functions. In the second part of this thesis, we investigate the impact of quantization on model extractions and demonstrate the need to introduce new attack paths based on side-channel attacks. Finally, we describe how model extraction based on cryptanalysis failed to extract quantized DNNs and present two new fidelity-based model extraction attacks using side-channel analysis.