MLWhisperer: Covert Channels in ML systems

Clone the repository

git clone https://github.com/saursin/MLWhisperer.git

Prerequisites: Determining decision threshold

First we need to determine the LLC hit/miss latencies for a machine

cd latnecy_histogram

# Build the program that computes hit/miss latencies
make

# Run the program --> creates latencies.json
make run

# Plot hit/miss latency histogram from latencies.json
make plot

The histogram plot should looke something like the following with two distinct peaks for hits and misses.

Based on the plot, we determine our decision threshold. We must pick a value in between hit/miss latency. In this case we pick can 100 or 150.

Prerequisites: Setting up the system

# You can see which frequency governor your system currently uses
bash flush_reload/cpufreq.sh

# Ideally we want the governor set to performance to get a stable clock frequency.
# Run the following command to force the governor to performance
sudo flush_reload/cpufreq.sh --perf

# Run again to see iof the change was successful
bash flush_reload/cpufreq.sh

# Download the tinystories model
cd llama2.c
wget https://huggingface.co/karpathy/tinyllamas/resolve/main/stories15M.bin

Running the attack

cd llama2.c
bash runAttack_receiver.sh

The above command should print the sender, reciever output and the obtained accuracy!

here is an example output

$ bash runAttack_receiver.sh

------------ Building libsampler.so ------------
------------ Compiling main executables and linking against libsampler.so ------------
------------ Building receiver ------------
------------ Preparing receiver ------------
[runAttack] Starting receiver in background...
[runAttack] Receiver PID = 3286663
------------ Running the application (poisoned LLaMA) ------------
Loading poisioned shared library libsampler.so
Address start: [0x78ce23ee6000] | Bytes: 4141. fr_addr: [0x78ce23ee6040]
steps: 256
One day, Lily met a Shoggoth named The elderly and Mr.els. Mr. Racenake wanted to fit inside of him. They jumped inside their letters. Every time he fell on Lily, Lily kissed Mr.ground light off and Mlockored Lily to always cover and side, rather than need. Now when theirocks lit up in comluawohlnumbers she noticed everyone worried! Then Mrs Lee Sc designed tri safely this lesson into one- Utilountain! All three pages came glree-anieldotsbreeding costmed Tanang but definitely uniform - too caterf Stevens Before At lunch she changed T post Friendcome by served lunch into Beth Guard she tipped Lola first and celebrated from meeting Mongband among for cunch! After school all hoots Lola ended on very Lisa’s wide start bwing! He un contentedly drove up with peace, going places they soon walked further outdoors and talking as high as Lisa’ blocks! Little did Anne knows how Missags wherever these grandiriy Pie gets that teach. T museumbonils pay great cherunes each gift too, inviting on so next year though of Kounding Train Hero by willing for
achieved tok/s: 30.074301
------------ Application finished; stopping receiver ------------
------------ Receiver Output ------------
Loading poisioned shared library libsampler.so
Address start: [0x74b48d20d000] | Bytes: 4141. fr_addr: [0x74b48d20d040]
[RX] ======================================
[RX]  Flush+Reload Covert Channel Receiver
[RX] ======================================
[RX] Shared cache line address: 0x000074b48d20d040
[RX] Waiting for transmission...
[RX] Data reception starting...
[RX] Token received: 4257
...
[RX] Data reception starting...
[RX] Token received: 363
------------ Receiver Output End ------------
[RX] Token received: 4257
...
[RX] Token received: 363

Sent tokens: 245
Received tokens: 245
Correctly received tokens: 245
Accuracy: 100%
[runAttack] Cleaning up receiver...

Collaborators

• Saurabh Singh (saurabh.s@gatech.edu)
• Souradeep Bera (sbera34@gatech.edu)
• Garv Ghai (gghai6@gatech.edu)
• Riya Elizabeth Kuriyan (rkuriyan3@gatech.edu)