{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T15:59:50Z","timestamp":1783007990358,"version":"3.54.5"},"reference-count":89,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833743","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1157-1174","source":"Crossref","is-referenced-by-count":99,"title":["DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories"],"prefix":"10.1109","author":[{"given":"Adnan Siraj","family":"Rakin","sequence":"first","affiliation":[{"name":"Arizona State University,School of Electrical, Computer, and Energy Engineering,Tempe,AZ"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Md Hafizul Islam","family":"Chowdhuryy","sequence":"additional","affiliation":[{"name":"University of Central Florida,Department of Electrical and Computer Engineering,Orlando,FL"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fan","family":"Yao","sequence":"additional","affiliation":[{"name":"University of Central Florida,Department of Electrical and Computer Engineering,Orlando,FL"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Deliang","family":"Fan","sequence":"additional","affiliation":[{"name":"Arizona State University,School of Electrical, Computer, and Energy Engineering,Tempe,AZ"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2015.152"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref56","author":"cai","year":"2021","journal-title":"Seeds of seed Nmt-stroke Diverting neural machine translation through hardwarebased faults"},{"key":"ref12","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"chandrasekaran","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref59","first-page":"697","article-title":"Zebram: comprehensive and compatible software protection against rowhammer attacks","author":"konoth","year":"2018","journal-title":"OSDI"},{"key":"ref15","first-page":"4743","article-title":"Zero-shot knowledge distillation in deep networks","author":"nayak","year":"2019","journal-title":"International Conference on Machine Learning"},{"key":"ref58","first-page":"168","article-title":"Are coherence protocol states vulnerable to information leakage?","author":"yao","year":"2018","journal-title":"IEEE International Symposium on High-Performance Comp Architecture"},{"key":"ref14","article-title":"Black-box ripper: Copying black-box models using generative evolutionary algorithms","author":"barbalau","year":"2020","journal-title":"arXiv preprint arXiv 2010 11419"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00089"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00031"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3152701.3152709"},{"key":"ref11","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","author":"jagielski","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref54","first-page":"71","article-title":"Exploiting the dram rowhammer bug to gain kernel privileges","volume":"15","author":"seaborn","year":"2015","journal-title":"Black Hat"},{"key":"ref10","first-page":"1445","article-title":"V0ltpwn: Attacking x86 processor integrity from software","author":"kenjar","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref17","article-title":"A framework for the extraction of deep neural networks by leveraging public data","author":"pal","year":"2019","journal-title":"arXiv preprint arXiv 1905 09010"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3287560.3287562"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2019.2915318"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/s10766-018-0609-3"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833773"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2020.2973007"},{"key":"ref89","article-title":"Aggregated residual transformations for deep neural networks","volume":"abs 1611 5431","author":"xie","year":"2016","journal-title":"CoRR"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437517"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2749469.2750394"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3431920.3439468"},{"key":"ref86","author":"krizhevsky","year":"2009","journal-title":"Learning multiple layers of features from tiny images"},{"key":"ref41","first-page":"601","article-title":"Stealing machine learning models via prediction apis","author":"tram\u00e8r","year":"2016","journal-title":"USENIX Security Symposium"},{"key":"ref85","author":"krizhevsky","year":"2010","journal-title":"Cifar-10 (canadian institute for advanced research)"},{"key":"ref44","article-title":"Stealing neural networks via timing side channels","author":"duddu","year":"2018","journal-title":"arXiv preprint arXiv 1812 11720"},{"key":"ref88","article-title":"Wide residual networks","author":"zagoruyko","year":"2016","journal-title":"arXiv preprint arXiv 1605 07146"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48063.2020.00031"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2019.8740835"},{"key":"ref8","doi-asserted-by":"crossref","first-page":"300","DOI":"10.1007\/978-3-319-40667-1_15","article-title":"Rowhammer. js: A remote software-induced fault attack in javascript","author":"gruss","year":"2016","journal-title":"Detection of Intrusions and Malware and Vulnerability Assessment"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00020"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2678373.2665726"},{"key":"ref4","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"chandrasekaran","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref3","article-title":"Achieving human parity in conversational speech recognition","author":"xiong","year":"2016","journal-title":"arXiv preprint arXiv 1610 05256"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00057"},{"key":"ref5","article-title":"How to 0wn nas in your spare time","author":"hong","year":"2020","journal-title":"arXiv preprint arXiv 2002 06755"},{"key":"ref82","first-page":"1","article-title":"Intel sgx explained","volume":"2016","author":"costan","year":"2016","journal-title":"IACR Cryptol ePrint Arch"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-10366-7_10"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00068"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064219"},{"key":"ref80","article-title":"Learning transferable adversarial perturbations","volume":"34","author":"salzmann","year":"2021","journal-title":"Advances in neural information processing systems"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00060"},{"key":"ref79","article-title":"Towards transferable adversarial perturbations with minimum norm","author":"liu","year":"2021","journal-title":"ICML Workshop on Adversarial Machine Learning"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2021.3122830"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref37","first-page":"1463","article-title":"Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips","author":"yao","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00130"},{"key":"ref75","year":"0","journal-title":"Half-double Next-row-over assisted rowhammer"},{"key":"ref31","first-page":"719","article-title":"Flush+reload: A high resolution, low noise, l3 cache side-channel attack","author":"yarom","year":"2014","journal-title":"USENIX Security Symposium"},{"key":"ref74","first-page":"1182","article-title":"A deeper look into rowhammer’s sensitivities: Experimental analysis of real dram chipsand implications on future attacks and defenses","author":"orosa","year":"2021","journal-title":"IEEE International Symposium on Microarchitecture"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i3.149-175"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00004"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01264-9_28"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00090"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173204"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.123"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5709"},{"key":"ref38","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2014","journal-title":"arXiv preprint arXiv 1409 1556"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP40778.2020.9191063"},{"key":"ref70","volume":"2","author":"langsam","year":"1996","journal-title":"Data Structures Using C and C++"},{"key":"ref73","first-page":"1198","article-title":"Uncovering in-dram rowhammer protection mechanisms: A new methodology, custom rowhammer patterns, and implications","author":"hassan","year":"2021","journal-title":"IEEE International Symposium on Microarchitecture"},{"key":"ref72","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"zhang","year":"2019","journal-title":"International Conference on Machine Learning"},{"key":"ref68","article-title":"Fbgemm: Enabling high-performance low-precision deep learning inference","author":"khudia","year":"2021","journal-title":"arXiv preprint arXiv 2101 02353"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD50377.2020.00095"},{"key":"ref67","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"International Conference on Learning Representations"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3060403.3060417"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/HOST45689.2020.9300274"},{"key":"ref69","author":"dukhan","year":"0","journal-title":"QNNPACK open source library for optimized mobile deep learning"},{"key":"ref25","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn dnn architectures","author":"yan","year":"2020","journal-title":"USENIX Security Symposium"},{"key":"ref64","first-page":"1","article-title":"Flip feng shui: Hammering a needle in the software stack","author":"razavi","year":"2016","journal-title":"USENIX Security Symposium"},{"key":"ref20","first-page":"8178","article-title":"Reverse-engineering deep relu networks","author":"rolnick","year":"2020","journal-title":"International Conference on Machine Learning"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_3"},{"key":"ref66","article-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples","author":"papernot","year":"2016","journal-title":"arXiv preprint arXiv 1605 07761"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.43"},{"key":"ref65","author":"gorman","year":"2004","journal-title":"Understanding the Linux Virtual Memory Manager"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243831"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378460"},{"key":"ref27","first-page":"515","article-title":"CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel","author":"batina","year":"2019","journal-title":"USENIX Security Symposium"},{"key":"ref29","article-title":"Hermes attack: Steal dnn models with lossless inference accuracy","author":"zhu","year":"2021","journal-title":"USENIX Security Symposium"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00359"},{"key":"ref62","first-page":"8026","article-title":"Pytorch: An imperative style, high-performance deep learning library","volume":"32","author":"paszke","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00020"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833743.pdf?arnumber=9833743","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:06:40Z","timestamp":1699484800000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833743\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":89,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833743","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}