Hardware sparsity optimizations enable stealing private model data
SPARSEBLEED: Bypassing Attribute-Inference Defenses via Sparsity Optimizations
Cryptography and SecurityHardware Architecture
Summary
Deep learning models are used in sensitive areas like healthcare, but protecting their private data is hard. This paper shows that hardware tricks intended to speed up these models can accidentally leak secret information through timing differences. The authors reveal a new kind of attack that uses these timing clues to figure out private details about the input and output of models without needing access to typical internal information. They also test ways to stop this leakage, finding some effective defenses that avoid large performance costs.
What this means in practice
- •For hardware security teams: Detect and mitigate timing leaks caused by sparsity optimizations in AI accelerators to protect model privacy in sensitive applications.
- •For ai model deployment engineers: Incorporate padding-based timing defenses to reduce privacy leaks from sparsity without large performance sacrifices during AI model deployment.
Authors
Darsh Asher, Farshad Dizani, Joshua Kalyanapu, Ro Cammarota, Aydin Aysu, Samira Mirbagher Ajorpaz
Abstract
Deep neural networks (DNNs) are widely deployed in safety- and privacy-critical domains such as healthcare and finance, where models are trained on confidential data. This paper presents the first hardware-level attribute-stealing attack that bypasses state-of-the-art privacy defenses, revealing that accelerator optimizations intended for performance can directly undermine data confidentiality. SparseBleed requires no access to gradients, logits, model weights, ground-truth labels, power traces, DVFS manipulation, shared caches, or other channels. Instead, we show that sparsity-driven execution paths encode stable timing signatures that act as a surrogate for model confidence, enabling high-fidelity attribute inference from a single query. SparseBleed generalizes across heterogeneous backends and hardware engines, including Intel AVX2/AVX-512/AMX, NVIDIA Ampere Tensor Cores with 2:4 sparsity, and nine well-known sparse and dense libraries such as Intel oneDNN, oneMKL SparseBLAS, and NVIDIA cuSPARSE. We evaluate SparseBleed to infer sensitive input attributes and true output labels. On Texas-100X, SparseBleed infers sensitive input attributes such as Sex with 66.39% accuracy and recovers the true output label, Surgical Procedure, with 99.8% accuracy. Finally, we evaluate mitigations. Constant-time execution by disabling sparsity optimizations is expensive (e.g., up to $2\times$ higher latency on NVIDIA Sparse Tensor Cores and $\approx 25\%$ higher power in AMX microbenchmarks). By contrast, a padding defense that equalizes responses to the worst-case time masks timing leakage with only 7.24% average performance overhead across nine libraries on Texas-100X/Adult and near-zero extra energy.