标题： “Energon”：从GPU功率和热侧通道中揭示Transformer 显示英文标题

标题： "Energon": Unveiling Transformers from GPU Power and Thermal Side-Channels

摘要： Transformer已经成为许多机器学习（ML）应用的核心，包括语言翻译、总结和计算机视觉。 随着这些模型通过机器学习即服务（MLaaS）在共享图形处理单元（GPU）环境中部署，它们的安全性问题日益引起关注。 特别是，无需物理访问即可揭示架构细节的侧信道攻击的风险仍研究不足，尽管它们针对的专有模型具有很高的价值。 据我们所知，这项工作是首次研究GPU功耗和热波动作为侧信道，并进一步利用它们从预训练的Transformer模型中提取信息。 所提出的分析表明，这些侧信道可以在用户权限下被利用，以揭示编码器/解码器层和注意力头等关键架构细节，适用于语言和视觉Transformer。 我们通过评估多个公开可用的语言和视觉预训练Transformer来展示实际影响。 通过广泛的实验评估，我们证明了攻击模型在单进程以及嘈杂的多进程场景中，对于模型族识别的平均准确率超过89%，对于超参数分类的准确率为100%。 此外，通过利用提取的架构信息，我们展示了高度有效的黑盒迁移对抗攻击，平均成功率超过93%，突显了部署的Transformer模型中GPU侧信道泄露带来的安全风险。 显示英文摘要

摘要： Transformers have become the backbone of many Machine Learning (ML) applications, including language translation, summarization, and computer vision. As these models are increasingly deployed in shared Graphics Processing Unit (GPU) environments via Machine Learning as a Service (MLaaS), concerns around their security grow. In particular, the risk of side-channel attacks that reveal architectural details without physical access remains underexplored, despite the high value of the proprietary models they target. This work to the best of our knowledge is the first to investigate GPU power and thermal fluctuations as side-channels and further exploit them to extract information from pre-trained transformer models. The proposed analysis shows how these side channels can be exploited at user-privilege to reveal critical architectural details such as encoder/decoder layer and attention head for both language and vision transformers. We demonstrate the practical impact by evaluating multiple language and vision pre-trained transformers which are publicly available. Through extensive experimental evaluations, we demonstrate that the attack model achieves a high accuracy of over 89% on average for model family identification and 100% for hyperparameter classification, in both single-process as well as noisy multi-process scenarios. Moreover, by leveraging the extracted architectural information, we demonstrate highly effective black-box transfer adversarial attacks with an average success rate exceeding 93%, underscoring the security risks posed by GPU side-channel leakage in deployed transformer models.