Side Channel Based Substitute Adversarial Attack on Deep Learning Models

Side Channel Based Substitute Adversarial Attack on Deep Learning Models | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Side Channel Based Substitute Adversarial Attack on Deep Learning Models Zuohui Chen, Jinxuan Hu, Yao Lu, Dan Zhang, Yun Xiang, Qi Xuan This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-4178736/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Deep learning models are highly susceptible to adversarial perturbations. Among model attackers, the black-box assumption, where no prior knowledge of the victim model is available, is the most common and practical scenario. Substitute attack, as a mainstream black-box attack method, involves training a surrogate model and leveraging the transferability property of its generated adversarial examples to attack the target model. However, existing approaches typically require a large number of queries to the victim model, resulting in reduced attack efficiency and performance. In this work, we propose an effective side channel attack method to estimate the fine-grained structure of the victim model. We leverage the adjacent intermediate layer perturbation technique to enhance the performance of adversarial attacks. Specifically, we demonstrate that the model structure at the layer level can be analyzed and revealed through a power side channel attack. Our experimental results indicate that the structure information can be successfully restored with an average success rate of 94%, leading to a significant improvement in the attack success rate across multiple classic datasets. Deep learning security Side channel attack Adversarial attack Black-box attack Substitute attack Deep neural network Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-4178736","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":284830850,"identity":"491add0d-712f-4dec-95c6-61227b23be8b","order_by":0,"name":"Zuohui Chen","email":"","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Zuohui","middleName":"","lastName":"Chen","suffix":""},{"id":284830851,"identity":"60f12fb9-e3ef-4a7c-9042-1b7bc128128a","order_by":1,"name":"Jinxuan Hu","email":"","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Jinxuan","middleName":"","lastName":"Hu","suffix":""},{"id":284830852,"identity":"5221a04e-2782-4ec3-b1eb-e58ae128653d","order_by":2,"name":"Yao Lu","email":"","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Yao","middleName":"","lastName":"Lu","suffix":""},{"id":284830853,"identity":"cc117c7e-32da-468d-b7a7-741cbf249272","order_by":3,"name":"Dan Zhang","email":"","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Dan","middleName":"","lastName":"Zhang","suffix":""},{"id":284830854,"identity":"f48aad29-b301-4cff-8aa0-1c93d330a2c8","order_by":4,"name":"Yun Xiang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA5ElEQVRIie3RIQvCQBjG8VcOzjJZ9Rj7DgeDKSh+Fg9hNosgxsFgUat+i4FgfuXCytBq1LKsQVkQdCeK7VwUvH95yvu7cgAm0y9GXmsD9NXWwsqEhSXBSuQdL8+rEZ6S/HiJ5cjbYe6coOsmSPKDjrCItjw3lmMfMWgiBF6CtMV1xCbgOyyWYr0JFZEiQYs2dYSS+vVJVhEocv9ObGL57FyShD4JficssiYObIdikcGgnfGBt5TU1xK+S9esmHTEfJ6J/XTac2dplGuJijSoGqtfvgCfz9VVK25q6ljh1mQymf6xBzj9Semo/bFEAAAAAElFTkSuQmCC","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":true,"prefix":"","firstName":"Yun","middleName":"","lastName":"Xiang","suffix":""},{"id":284830855,"identity":"46407e04-7b3a-4f38-a4e5-3a9f1df94195","order_by":5,"name":"Qi Xuan","email":"","orcid":"","institution":"Zhejiang University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Qi","middleName":"","lastName":"Xuan","suffix":""}],"badges":[],"createdAt":"2024-03-28 01:29:18","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-4178736/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-4178736/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":68633011,"identity":"ce1a0f69-721c-406c-bfc1-79bd6c62a39d","added_by":"auto","created_at":"2024-11-09 23:01:20","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1054896,"visible":true,"origin":"","legend":"","description":"","filename":"sidechannelSpringerNature.pdf","url":"https://assets-eu.researchsquare.com/files/rs-4178736/v1_covered_2b142dab-336a-4604-8edc-9563f4775c32.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Side Channel Based Substitute Adversarial Attack on Deep Learning Models","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Deep learning security, Side channel attack, Adversarial attack, Black-box attack, Substitute attack, Deep neural network","lastPublishedDoi":"10.21203/rs.3.rs-4178736/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-4178736/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Deep learning models are highly susceptible to adversarial perturbations. Among model attackers, the black-box assumption, where no prior knowledge of the victim model is available, is the most common and practical scenario. Substitute attack, as a mainstream black-box attack method, involves training a surrogate model and leveraging the transferability property of its generated adversarial examples to attack the target model. However, existing approaches typically require a large number of queries to the victim model, resulting in reduced attack efficiency and performance. In this work, we propose an effective side channel attack method to estimate the fine-grained structure of the victim model. We leverage the adjacent intermediate layer perturbation technique to enhance the performance of adversarial attacks. Specifically, we demonstrate that the model structure at the layer level can be analyzed and revealed through a power side channel attack. Our experimental results indicate that the structure information can be successfully restored with an average success rate of 94\\%, leading to a significant improvement in the attack success rate across multiple classic datasets.","manuscriptTitle":"Side Channel Based Substitute Adversarial Attack on Deep Learning Models","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2024-04-01 18:03:11","doi":"10.21203/rs.3.rs-4178736/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"01a64d65-05f8-490f-9275-17984c7bc04c","owner":[],"postedDate":"April 1st, 2024","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2024-11-09T22:53:13+00:00","versionOfRecord":[],"versionCreatedAt":"2024-04-01 18:03:11","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-4178736","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-4178736","identity":"rs-4178736","version":["v1"]},"buildId":"qtupq5eGEP_6zYnWcrvyt","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}