Camo-DNN: Layer Camouflaging to Protect DNNs against Timing Side-Channel Attacks

Extracting the architecture of layers of a given deep neural network (DNN) through hardware-based side channels allows adversaries to steal its intellectual property and even launch powerful adversarial attacks on the target system. In this work, we propose Camo $D N N$, an obfuscation method for DNNs that forces all the layers in a given network to have similar execution traces, preventing attack models from differentiating between the layers. Towards this, Camo DNN performs various layer-obfuscation operations, e.g., layer branching layer deepening, etc., to alter the run-time traces while maintaining the functionality. Camo-DNN deploys an evolutionary algorithm to find the best combination of obfuscation operations in terms of maximizing the security level while maintaining a user-provided latency overhead budget Our experiments show that state-of-the-art side-channel architecture stealing attacks cannot extract the architecture of DNN protected by Camo-DNN accurately. Further, we highlight that the adversarial attack on our obfuscated DNNs are unsuccessful.