SparseBleed infers attributes from accelerator sparsity timing
Original title: SPARSEBLEED: Bypassing Attribute-Inference Defenses via Sparsity Optimizations
One query’s timing recovers Sex at 66.39% and Surgical Procedure at 99.8% on Texas-100X, without gradients or weights.
SparseBleed is a hardware-level attribute-inference attack that treats sparsity-driven execution timing as a stand-in for model confidence. It needs no gradients, logits, weights, labels, power traces, DVFS, or shared caches, and the authors say it works on Intel AVX2/AVX-512/AMX, NVIDIA Ampere 2:4 Tensor Cores, and nine sparse and dense libraries. Disabling sparsity for constant time costs up to 2× latency on NVIDIA Sparse Tensor Cores; a worst-case padding defense adds 7.24% average overhead on Texas-100X/Adult.
Unconfirmed: Results are the authors’ lab measurements; no real-world exploitation is reported.
- Sex is inferred at 66.39% and Surgical Procedure at 99.8% on Texas-100X.
- AMX constant-time microbenchmarks use about 25% more power.
- Padding adds 7.24% average overhead and near-zero extra energy across nine libraries.
Impact: Infers sensitive input attributes and true output labels from timing
| Product | Affected |
|---|---|
| Intel AVX2/AVX-512/AMX and oneDNN, oneMKL SparseBLAS | — |
| NVIDIA Ampere Tensor Cores with 2:4 sparsity and cuSPARSE | — |
- 1.Evaluate a padding defense that equalizes responses to worst-case time.
- 2.Treat disabling sparsity optimizations as a costly constant-time option.
From the original article
1 min read at arxiv.orgDeep neural networks (DNNs) are widely deployed in safety- and privacy-critical domains such as healthcare and finance, where models are trained on confidential data. This paper presents the first hardware-level attribute-stealing attack that bypasses state-of-the-art privacy defenses, revealing that accelerator optimizations intended for performance can directly undermine data confidentiality.
By Darsh Asher · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.