Inversion Attacks against CNN Models Based on Timing Attack

Algorithm 1

The reverse steps of convolutional layer.

	Input: the size of input pictures , input channel , memory of model weight , and memory of model parameters .
Output: the size of convolution kernel , output channel , stride convolutions , padding , and the size of the feature map .
for in [1, 3, 5, 7]//candidate values of .
do
//substitute into (2) to solve for .
//solve for by (3)
//substitute into (1) to solve for .
Searchin database
//return .
end
//choose , which has minimum difference with to ensure the real .
//solve for by .
//solve for by .
//solve for by .
//solve for by .
return{, , , , }