MLWhisperer: Covert Channels in ML systems

Covert Channels in ML systems

Description

MLWhisperer is a research project exploring covert communication channels in machine learning systems using CPU cache side-channel techniques. The project demonstrates how two unprivileged processes can communicate covertly by exploiting shared CPU cache state, without using any conventional IPC mechanism.

The core technique is Flush+Reload: a sender encodes bits by either repeatedly accessing (bit=1) or not accessing (bit=0) a shared memory-mapped file, while a receiver measures memory access latencies using the RDTSCP instruction to detect whether a cache line is hot (recently accessed) or cold (flushed). Timing differences between cache hits (~4 cycles) and cache misses (~200+ cycles) form the covert channel.

The repository contains:

• flush_reload_covert_channel/ — C++ sender/receiver implementation of the Flush+Reload covert channel, including synchronization, bit encoding/decoding, and end-to-end message transmission.
• latency_histogram/ — Tools to measure and visualize cache access latency distributions, used to characterize and tune the channel's timing thresholds.

Clone the repository

git clone https://github.com/saursin/MLWhisperer.git

Prerequisites: Determining decision threshold

First we need to determine the LLC hit/miss latencies for a machine

cd latnecy_histogram

# Build the program that computes hit/miss latencies
make

# Run the program --> creates latencies.json
make run

# Plot hit/miss latency histogram from latencies.json
make plot

The histogram plot should looke something like the following with two distinct peaks for hits and misses.

Based on the plot, we determine our decision threshold. We must pick a value in between hit/miss latency. In this case we pick can 100 or 150.

Prerequisites: Setting up the system

# You can see which frequency governor your system currently uses
bash flush_reload/cpufreq.sh

# Ideally we want the governor set to performance to get a stable clock frequency.
# Run the following command to force the governor to performance
sudo flush_reload/cpufreq.sh --perf

# Run again to see iof the change was successful
bash flush_reload/cpufreq.sh

# Download the tinystories model
cd llama2.c
wget https://huggingface.co/karpathy/tinyllamas/resolve/main/stories15M.bin

Running the attack

cd llama2.c
bash runAttack_receiver.sh

The above command should print the sender, reciever output and the obtained accuracy!

here is an example output

$ bash runAttack_receiver.sh

------------ Building libsampler.so ------------
------------ Compiling main executables and linking against libsampler.so ------------
------------ Building receiver ------------
------------ Preparing receiver ------------
[runAttack] Starting receiver in background...
[runAttack] Receiver PID = 3286663
------------ Running the application (poisoned LLaMA) ------------
Loading poisioned shared library libsampler.so
Address start: [0x78ce23ee6000] | Bytes: 4141. fr_addr: [0x78ce23ee6040]
steps: 256
One day, Lily met a Shoggoth named The elderly and Mr.els. Mr. Racenake wanted to fit inside of him. They jumped inside their letters. Every time he fell on Lily, Lily kissed Mr.ground light off and Mlockored Lily to always cover and side, rather than need. Now when theirocks lit up in comluawohlnumbers she noticed everyone worried! Then Mrs Lee Sc designed tri safely this lesson into one- Utilountain! All three pages came glree-anieldotsbreeding costmed Tanang but definitely uniform - too caterf Stevens Before At lunch she changed T post Friendcome by served lunch into Beth Guard she tipped Lola first and celebrated from meeting Mongband among for cunch! After school all hoots Lola ended on very Lisa’s wide start bwing! He un contentedly drove up with peace, going places they soon walked further outdoors and talking as high as Lisa’ blocks! Little did Anne knows how Missags wherever these grandiriy Pie gets that teach. T museumbonils pay great cherunes each gift too, inviting on so next year though of Kounding Train Hero by willing for
achieved tok/s: 30.074301
------------ Application finished; stopping receiver ------------
------------ Receiver Output ------------
Loading poisioned shared library libsampler.so
Address start: [0x74b48d20d000] | Bytes: 4141. fr_addr: [0x74b48d20d040]
[RX] ======================================
[RX]  Flush+Reload Covert Channel Receiver
[RX] ======================================
[RX] Shared cache line address: 0x000074b48d20d040
[RX] Waiting for transmission...
[RX] Data reception starting...
[RX] Token received: 4257
...
[RX] Data reception starting...
[RX] Token received: 363
------------ Receiver Output End ------------
[RX] Token received: 4257
...
[RX] Token received: 363

Sent tokens: 245
Received tokens: 245
Correctly received tokens: 245
Accuracy: 100%
[runAttack] Cleaning up receiver...

Collaborators

• Saurabh Singh (saurabh.s@gatech.edu)
• Souradeep Bera (sbera34@gatech.edu)
• Garv Ghai (gghai6@gatech.edu)
• Riya Elizabeth Kuriyan (rkuriyan3@gatech.edu)