← 研踪 PaperTrailarXiv:2610.38110 · v1
SPARSEBLEED: Bypassing Attribute-Inference Defenses via Sparsity Optimizations
首次提交 2026-10-28 08:47
版本更新 2026-10-28 08:47
雷达观测 2026-10-30 10:23
摘要
Deep neural networks (DNNs) are widely deployed in safety- and privacy-critical domains such as healthcare and finance, where models are trained on confidential data. This paper presents the first hardware-level attribute-stealing attack that bypasses state-of-the-art privacy defenses, revealing that accelerator optimizations intended for performance can directly undermine data confidentiality. SparseBleed requires no access to gradients, logits, model weights, ground-truth labels, power traces, DVFS manipulation, shared caches, or other channels. Instead, we show that sparsity-driven execution paths encode stable timing signatures that act as a surrogate for model confidence, enabling high-fidelity attribute inference from a single query. SparseBleed generalizes across heterogeneous backends and hardware engines, including Intel AVX2/AVX-512/AMX, NVIDIA Ampere Tensor Cores with 2:4 sparsity, and nine well-known sparse and dense libraries such as Intel oneDNN, oneMKL SparseBLAS, and NVIDIA cuSPARSE. We evaluate SparseBleed to infer sensitive input attributes and true output labels. On Texas-100X, SparseBleed infers sensitive input attributes such as Sex with 66.39% accuracy and recovers the true output label, Surgical Procedure, with 99.8% accuracy. Finally, we evaluate mitigations. Constant-time execution by disabling sparsity optimizations is expensive (e.g., up to $2\times$ higher latency on NVIDIA Sparse Tensor Cores and $\approx 25\%$ higher power in AMX microbenchmarks). By contrast, a padding defense that equalizes responses to the worst-case time masks timing leakage with only 7.24% average performance overhead across nine libraries on Texas-100X/Adult and near-zero extra energy.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-10-28 08:47 · 最新观测版本
SPARSEBLEED: Bypassing Attribute-Inference Defenses via Sparsity Optimizations
Deep neural networks (DNNs) are widely deployed in safety- and privacy-critical domains such as healthcare and finance, where models are trained on confidential data. This paper presents the first hardware-level attribute-stealing attack that bypasses state-of-the-art privacy defenses, revealing that accelerator optimizations intended for performance can directly undermine data confidentiality. SparseBleed requires no access to gradients, logits, model weights, ground-truth labels, power traces, DVFS manipulation, shared caches, or other channels. Instead, we show that sparsity-driven execution paths encode stable timing signatures that act as a surrogate for model confidence, enabling high-fidelity attribute inference from a single query. SparseBleed generalizes across heterogeneous backends and hardware engines, including Intel AVX2/AVX-512/AMX, NVIDIA Ampere Tensor Cores with 2:4 sparsity, and nine well-known sparse and dense libraries such as Intel oneDNN, oneMKL SparseBLAS, and NVIDIA cuSPARSE. We evaluate SparseBleed to infer sensitive input attributes and true output labels. On Texas-100X, SparseBleed infers sensitive input attributes such as Sex with 66.39% accuracy and recovers the true output label, Surgical Procedure, with 99.8% accuracy. Finally, we evaluate mitigations. Constant-time execution by disabling sparsity optimizations is expensive (e.g., up to $2\times$ higher latency on NVIDIA Sparse Tensor Cores and $\approx 25\%$ higher power in AMX microbenchmarks). By contrast, a padding defense that equalizes responses to the worst-case time masks timing leakage with only 7.24% average performance overhead across nine libraries on Texas-100X/Adult and near-zero extra energy.
查看此版本解读 →查看此版本原文 ↗