6 ms·

This will not be able to reverse engineer fully-customized, fully-fused neural networks generated by NN-512: https://NN-512.com https://NN-512.com NN-512 gene

This will not be able to reverse engineer fully-customized, fully-fused neural networks generated by NN-512: https://NN-512.com https://NN-512.com NN-512 generates custom code for all the operations, custom units of work for the threads, custom code around tensor edges, everything is fused and unrolled and customized. If they can deduce the network graph specification from the AVX-512 code, I will be astonished. If you can do it, show me. But I know you can't. Anyone who cares about model privacy will use their own variant of a tool like NN-512. It's security through obscurity, but that's the best you can hope for if you are distributing an executable.

userbinator 4y ago
If you can do it, show me. But I know you can't I've been out of the cracking scene for over a decade now, but I expect that to be none other than a challenge, having seen how far publicly available decompilers have progressed.
- 37ef_ced3 4y ago
  Here is the C code for a DenseNet-121 generated by NN-512: https://nn-512.com/browse/DenseNet121 https://nn-512.com/browse/DenseNet121 Even if you had the C code available to you, you would have a hard time producing the input graph. Good luck reverse engineering it after GCC has compiled it! NN-512 has an incredibly flexible code generator. It can easily be tweaked to produce completely different code for the same convolution, so everyone can apply their own twist to defeat the reverse engineers ("the intellectual property thieves").
  - sudosysgen 4y ago
    You're describing every single obfuscation scheme, they all get defeated. And you don't need to find the original graph either, they may be equivalent ones and that could work too.
    - astrange 4y ago
      I haven't seen anyone defeat white-box AES; have Widevine or FairPlay been decompiled?
      - saurik 4y ago
        It is a lot of work, but I wouldn't say it is exactly difficult... I never bothered to automate it, and so I didn't finish the one I was doing, but I was under the impression that Pod2G's team (which used a photo of me doing it a bit on a blackboard in their presentation) did, however? https://blog.quarkslab.com/resources/2013-10-17_imessage-privacy/slides/iMessage_privacy.pdf https://blog.quarkslab.com/resources/2013-10-17_imessage-pri... You just don't need to is the thing (if you are in a position to not care about copyright law; I did care, sadly): you can almost always just lift the code--with all its obfuscation intact--and run it in isolation on your input, which more directly undermines the entire premise of the technique.
        astrange 4y ago
        That presentation seems confused since PRISM is not "a mass surveillance program" or "an alliance with American firms", it's a database the government puts the results of subpoenas in. Of course, the protocol is still weak to an evil key server. Well, the obfustication is still pretty good if it's 9 years ahead of attacks.
        mlyle 4y ago
        > That presentation seems confused since PRISM is not "a mass surveillance program" or "an alliance with American firms", it's a database the government puts the results of subpoenas in. I feel like this is a terrible mischaracterization of PRISM, even if it is almost true. The NSA deployed hardware (following demand letters) to service providers and collected large swaths of traffic based on various types of keyword and attribute matches. This was then put in a big searchable database.
        4y ago
  - WanderPanda 4y ago
    Oh looks like something AMD might want to upstream :p
rootw0rm 4y ago
exe sample?
- 37ef_ced3 4y ago
  So... ...you were unable to decipher this Hacker News comment thread... ...unable find some C code and build it with GCC and make an executable for yourself... ...but you think you can reverse engineer the executable?
  - rootw0rm 4y ago
    there's a million crackmes i can download right now, i don't really feel like chasing dependencies and building it myself. also, no AVX-512
  - deleted 4y ago
    [deleted]
- c0balt 4y ago
  I don't have a ms windows pc available nor the time to setup cross compilation for one rn. (Assuming you meant an executable file for one of those with 'exe'). However you ahould be able be able to compile one for yourself by downloading, from e.g. https://nn-512.com/browse/DenseNet121 https://nn-512.com/browse/DenseNet121, one of the generated C files and compiling it with GCC[0]. It shouldn't require any special dependencies beside AVX support on your CPU. Edit: Regarding general decompilation for neural networks this project might be interesting[1] [0]: https://gcc.gnu.org/ https://gcc.gnu.org/ [1]: https://github.com/monkbai/DNN-decompiler https://github.com/monkbai/DNN-decompiler
  - rootw0rm 4y ago
    OS isn't terribly important, but thanks for the reply. i only have AVX2 on this system tho
bertr4nd 4y ago
By “fully fused” do you mean no function call boundaries? (“Fused” is such an overloaded term)
- 37ef_ced3 4y ago
  Convolutions are fused into convolutions, elementwise operations are fused into convolutions, everything is inlined except where function calls are needed for pthread work units (and those work units are all custom/arbitrary).
smeagull 4y ago
Just transfer learn to a bunch of likely architectures.
selfmodruntime 4y ago
I firmly believe that security by obscurity should be given more credit than is done normally. If you are a pretty uninteresting target and you want to protect your binaries, making them too tough of a nut to crack in comparison to the motivation of the reverse engineer is a valid strategy.
- deleted 4y ago
  [deleted]
- batch12 4y ago
  It's not that there's no value in security-by-obscurity. The issue is when it's the only control. I agree that some are too quick to dismiss operational security controls.
- chii 4y ago
  it's certainly valid. Obscurity is cheap and easy. The only problem is when it's the _only_ security for certain types of threat models that require defence in depth - such as credentials in authentication.
fxtentacle 4y ago
Thing is, I don't have to to extract your AI. I can just separate your obfuscated AI execution into a DLL. And then I call that DLL with lots of randomly generated input data and estimate the numerical gradients from that. And now I have everything I need to copy things over into a similar NN architecture. Yes, it might take a few days to evaluate everything, but CPU time is cheap compared to research and employees needed to reverse engineer your implementation. That said, NN-512 is great because it produces optimized CPU code, thus making deployment cheaper.

userbinator 4y ago

If you can do it, show me. But I know you can't I've been out of the cracking scene for over a decade now, but I expect that to be none other than a challenge, having seen how far publicly available decompilers have progressed.

37ef_ced3 4y ago
Here is the C code for a DenseNet-121 generated by NN-512: https://nn-512.com/browse/DenseNet121 https://nn-512.com/browse/DenseNet121 Even if you had the C code available to you, you would have a hard time producing the input graph. Good luck reverse engineering it after GCC has compiled it! NN-512 has an incredibly flexible code generator. It can easily be tweaked to produce completely different code for the same convolution, so everyone can apply their own twist to defeat the reverse engineers ("the intellectual property thieves").
- sudosysgen 4y ago
  You're describing every single obfuscation scheme, they all get defeated. And you don't need to find the original graph either, they may be equivalent ones and that could work too.
  - astrange 4y ago
    I haven't seen anyone defeat white-box AES; have Widevine or FairPlay been decompiled?
    - saurik 4y ago
      It is a lot of work, but I wouldn't say it is exactly difficult... I never bothered to automate it, and so I didn't finish the one I was doing, but I was under the impression that Pod2G's team (which used a photo of me doing it a bit on a blackboard in their presentation) did, however? https://blog.quarkslab.com/resources/2013-10-17_imessage-privacy/slides/iMessage_privacy.pdf https://blog.quarkslab.com/resources/2013-10-17_imessage-pri... You just don't need to is the thing (if you are in a position to not care about copyright law; I did care, sadly): you can almost always just lift the code--with all its obfuscation intact--and run it in isolation on your input, which more directly undermines the entire premise of the technique.
      - astrange 4y ago
        That presentation seems confused since PRISM is not "a mass surveillance program" or "an alliance with American firms", it's a database the government puts the results of subpoenas in. Of course, the protocol is still weak to an evil key server. Well, the obfustication is still pretty good if it's 9 years ahead of attacks.
        mlyle 4y ago
        > That presentation seems confused since PRISM is not "a mass surveillance program" or "an alliance with American firms", it's a database the government puts the results of subpoenas in. I feel like this is a terrible mischaracterization of PRISM, even if it is almost true. The NSA deployed hardware (following demand letters) to service providers and collected large swaths of traffic based on various types of keyword and attribute matches. This was then put in a big searchable database.
        4y ago
- WanderPanda 4y ago
  Oh looks like something AMD might want to upstream :p

rootw0rm 4y ago

exe sample?

37ef_ced3 4y ago
So... ...you were unable to decipher this Hacker News comment thread... ...unable find some C code and build it with GCC and make an executable for yourself... ...but you think you can reverse engineer the executable?
- rootw0rm 4y ago
  there's a million crackmes i can download right now, i don't really feel like chasing dependencies and building it myself. also, no AVX-512
- deleted 4y ago
  [deleted]
c0balt 4y ago
I don't have a ms windows pc available nor the time to setup cross compilation for one rn. (Assuming you meant an executable file for one of those with 'exe'). However you ahould be able be able to compile one for yourself by downloading, from e.g. https://nn-512.com/browse/DenseNet121 https://nn-512.com/browse/DenseNet121, one of the generated C files and compiling it with GCC[0]. It shouldn't require any special dependencies beside AVX support on your CPU. Edit: Regarding general decompilation for neural networks this project might be interesting[1] [0]: https://gcc.gnu.org/ https://gcc.gnu.org/ [1]: https://github.com/monkbai/DNN-decompiler https://github.com/monkbai/DNN-decompiler
- rootw0rm 4y ago
  OS isn't terribly important, but thanks for the reply. i only have AVX2 on this system tho

bertr4nd 4y ago

By “fully fused” do you mean no function call boundaries? (“Fused” is such an overloaded term)

37ef_ced3 4y ago
Convolutions are fused into convolutions, elementwise operations are fused into convolutions, everything is inlined except where function calls are needed for pthread work units (and those work units are all custom/arbitrary).

smeagull 4y ago

Just transfer learn to a bunch of likely architectures.

selfmodruntime 4y ago

I firmly believe that security by obscurity should be given more credit than is done normally. If you are a pretty uninteresting target and you want to protect your binaries, making them too tough of a nut to crack in comparison to the motivation of the reverse engineer is a valid strategy.

deleted 4y ago
[deleted]
batch12 4y ago
It's not that there's no value in security-by-obscurity. The issue is when it's the only control. I agree that some are too quick to dismiss operational security controls.
chii 4y ago
it's certainly valid. Obscurity is cheap and easy. The only problem is when it's the _only_ security for certain types of threat models that require defence in depth - such as credentials in authentication.

fxtentacle 4y ago

Thing is, I don't have to to extract your AI. I can just separate your obfuscated AI execution into a DLL. And then I call that DLL with lots of randomly generated input data and estimate the numerical gradients from that. And now I have everything I need to copy things over into a similar NN architecture. Yes, it might take a few days to evaluate everything, but CPU time is cheap compared to research and employees needed to reverse engineer your implementation. That said, NN-512 is great because it produces optimized CPU code, thus making deployment cheaper.