I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

By Lingxiao Wei, Yannan Liu, Bo Luo, Yu LI, Qiang Xu. 2018

232 citations recorded by the source corpus.

Deep learning has become the de-facto computational paradigm for various kinds of perception problems, including many privacy-sensitive applications such as online medical image analysis. No doubt to say, the data privacy of these deep learning systems is a serious concern. Different from previous research focusing on exploiting privacy leakage from deep learning models, in this paper, we present the first attack on the implementation of deep learning models. To be specific, we perform the attack on an FPGA-based convolutional neural network accelerator and we manage to recover the input image from the collected power traces without knowing the detailed parameters in the neural network. For the MNIST dataset, our power side-channel attack is able to achieve up to 89% recognition accuracy.

Subfields: Artificial Intelligence, Hardware and Architecture

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

Citations in the corpus

Comprehensive Privacy Analysis of Deep Learning: Stand-alone and Federated Learning under Passive and Active White-box Inference Attacks (2018, background): “Input inference [20], attribute inference [21], parameter inference [22], [23], and side-channel attacks [24] are several examples of such attacks.”
Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning (2018, background): “Input inference [31], attribute inference [32], parameter inference [33], [34], and side-channel attacks [35] are several examples of such attacks.”
When Machine Learning Meets Privacy (2020, background): “ Reverse-engineering Centralised [39] ✓ White-box Model inversion Centralised [38] ✓ Black-box Model inversion Centralised [8] ✓ White-box Shadow training Centralised [55] ✓ White-box GAN Distributed [164] ✓ Black-box Power side-channel attack Centralised [141] ✓ Black-box Shadow training Centralise”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “A similar attack is explored in [51], where the authors use a power side-channel to observe the processing of the first layer of a convolutional network and extract user’s inputs.”
CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel (2019, methodology): “have also performed an attack on an FPGA-based convolutional neural network accelerator [52].”
NN-Lock: A Lightweight Authorization to Prevent IP Threats of Deep Learning Models (2022, methodology): “Model Reverse-Engineering Atacks It has been shown in recent literature that a black-box DNN model in an edge-device can be entirely reverseengineered by observing electromagnetic side-channel [Batina et al. 2019; Wei et al. 2018; Yu et al. 2020a].”
Model inversion attacks against collaborative inference (2019, methodology): “Closer to our study is the work [48], which adopted a power side channel to recover inference data.”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, methodology): “Attack [4] Convolutional Neural Network Supervised No Side-channel Attack [74] Training Data Extraction [18] Adversarial Examples [50, 52, 70] Recurrent Neural Network Supervised No Training Data Extraction [18] Classifier Evasion [3] Adversarial Examples [57] Support Vector Machine Supervised Yes/N”
A Systematic Review on Model Watermarking for Neural Networks (2020, background): “For example, the topic of sidechannel attacks that aim at extracting neural networks [Wei et al., 2018] is not covered.”