Hardware and Software Platform Inference

Cheng Zhang, Hanna Foerster, Robert D. Mullins, Yiren Zhao, Ilia Shumailov

TL;DR: We introduce a new problem and solutions to identifying the software and hardware platform of an ML model solely based on its input-output behaviour. Abstract:

Abstract: It is now a common business practice to buy access to large language model (LLM) inference rather than self-host, because of significant upfront hardware infrastructure and energy costs. However, as a buyer, there is no mechanism to verify the authenticity of the advertised service including the serving hardware platform, e.g. that it is actually being served using an NVIDIA H100. Furthermore, there are reports suggesting that model providers may deliver models that differ slightly from the advertised ones, often to make them run on less expensive hardware. That way, a client pays premium for a capable model access on more expensive hardware, yet ends up being served by a (potentially less capable) cheaper model on cheaper hardware. In this paper we introduce ***hardware and software platform inference (HSPI)*** -- a method for identifying the underlying GPU architecture and software stack of a (black-box) machine learning model solely based on its input-output behavior. Our method leverages the inherent differences of various GPU architectures and compilers to distinguish between different GPU types and software stacks. By analyzing the numerical patterns in the model's outputs, we propose a classification framework capable of accurately identifying the GPU used for model inference as well as the underlying software configuration. Our findings demonstrate the feasibility of inferring GPU type from black-box models. We evaluate HSPI against models served on different real hardware and find that in a white-box setting we can distinguish between different GPUs with between 83.9% and 100% accuracy. Even in a black-box setting we are able to achieve results that are up to three times higher than random guess accuracy.

Lay Summary:

It is now a common business practice to buy access to large language model (LLM) inference rather than self-host because of the high-cost of running LLMs. However, buyers lack the ability to verify if the service is actually served using the hardware and software stack claimed by the providers. Our method, HSPI, offers a method for identifying the underlying GPU architecture and software stack of deep learning models solely by sending inputs and collecting outputs.

We first split the application senarios into white-box and black-box, where white-box means the model checkpoint is publicly available like open-sourced Llama and black-box means the model is close-sourced like ChatGPT. We propose two approaches, one is HPSI-BI, that learns model inputs on the decision boundary of the model (border input). For example, a border image may be predicted as "cat" by a ResNet18 on NVIDIA H100, but prediced as "dog" by the same ResNet18 on AMD MI300X. Our second approach is to train an SVM to classify the distribution difference in the output logits.

We evaluate HSPI against models served on different real hardware and find that in a white-box setting we can distinguish between different GPUs with between 83.9% and 100% accuracy. Even in a black-box setting we are able to achieve results that are up to three times higher than random guess accuracy.

Link To Code: https://github.com/ChengZhang-98/HSPI

Primary Area: Social Aspects->Security

Keywords: ML security, ML governance

Submission Number: 13561