PaperlayerView exact revision on arXiv

Source-linked AI summary

I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

Lingxiao Wei, Bo Luo, Yu Li, Yannan Liu, Qiang Xu

arXiv:1803.05847v2cs.CVcs.LG

TL;DR

DNN accelerators create a security concern because private inference inputs may leak through implementations, beyond attacks targeting model outputs. This paper presents a power side-channel attack on an FPGA-based CNN accelerator and successfully recovers input images from inference power traces.

  • Problem

    DNNs are used in security-sensitive applications, motivating research into privacy leakage from neural-network implementations rather than only model outputs.

  • Method

    The attack extracts power from noisy traces and uses background detection or power templates to recover inputs during the first convolution layer without detailed model parameters.

  • Results

    The attack successfully recovered MNIST input images, with power-template reconstructions retaining more detail than background-detection results.

  • Takeaways & Limitations

    Power side channels can expose private inference inputs from FPGA-based CNN accelerators without knowledge of detailed network parameters or model outputs.

  • Takeaways & Limitations

    Attackers are assumed to know the network structure and input image size and to obtain high-resolution power traces, while not knowing detailed network parameters.

Abstract

from arXiv · show

Deep learning has become the de-facto computational paradigm for various kinds of perception problems, including many privacy-sensitive applications such as online medical image analysis. No doubt to say, the data privacy of these deep learning systems is a serious concern. Different from previous research focusing on exploiting privacy leakage from deep learning models, in this paper, we present the first attack on the implementation of deep learning models. To be specific, we perform the attack on an FPGA-based convolutional neural network accelerator and we manage to recover the input image from the collected power traces without knowing the detailed parameters in the neural network. For the MNIST dataset, our power side-channel attack is able to achieve up to 89% recognition accuracy.

1 INTRODUCTION

The paper shifts privacy-attack focus from DNN models to the hardware implementing inference, targeting recovery of private input images from power side channels without detailed model parameters.

  • Research gap: Existing attacks can compromise DNN privacy but generally require full knowledge of confidential model parameters.Prior work includes inducing misclassification and recovering training images from model outputs.
  • Research gap: The largely unexplored threat is leakage of real-world inference inputs through side-channel information such as power consumption.Direct input access is often controlled, including when encrypted medical images are decrypted inside the inference engine.
  • Approach: The attack targets an FPGA-based CNN accelerator’s first convolution layer and aims to recover the private input image from its power consumption.The first layer is implemented using a line buffer in many image-processing hardware designs.
  • Novelty: The proposed work is presented as the first power-side-channel attack exploiting privacy leakage in neural accelerators without model parameters or model outputs.Its target is the online input being inferenced rather than samples from the training set.
  • Contributions: The paper introduces power extraction to recover per-cycle consumption and algorithms that infer pixels directly or through a pre-built power-pixel template.The reconstructed image is assembled by piecing inferred pixel values together.

2 BACKGROUND

CNNs process images through layered convolutions, while neural accelerators implement these computations under stringent power budgets; this work targets the first convolutional layer.

  • Convolutional Neural Network: CNNs are prevalent in image-related processing and consist of sequential layers, with early layers performing convolution.The first layer receives the raw image in the attack setting.
  • Convolutional Neural Network: A convolution slides a 2-D kernel across a 2-D input image to produce a 2-D feature map.The operation computes over local groups of pixels.
  • Neural Accelerator: Neural accelerators, often FPGA- or ASIC-based, implement CNN computation on devices with stringent power budgets.The targeted convolutional layer is usually implemented using a line buffer composed of buffer lines and a computation unit.

3 THREAT MODEL

The threat model considers insiders or accelerator designers who monitor power traces to recover online inference inputs, knowing architecture and image size but not detailed parameters.

  • Scenario: Adversaries seek to reproduce sensitive online inputs processed during inference rather than reconstructing training-set samples.They are assumed capable of monitoring the accelerator’s power side channel.
  • Capability: Attackers know the network structure and input image size, including targeted-layer filter and feature-map counts, but not detailed network parameters.The paper considers this knowledge practical because common architectures and configurations are public.
  • Capability: Adversaries acquire high-resolution power traces through oscilloscope measurements or implanted power-monitoring Trojans.The threat model further distinguishes passive and active adversaries by whether they can freely launch inference operations.

4 OVERVIEW

The attack extracts power traces from first-layer convolution, then uses background detection or power templates to recover MNIST inputs at different visual granularity.

  • Attack rationale: The first convolutional layer is targeted because it directly processes the input and operates on small pixel groups.These properties make the measured power closely related to the input while reducing pixel-inference effort.
  • Experimental setup: The evaluation uses a CNN accelerator implemented on a Xilinx Spartan-6 LX75 FPGA and measures power with a 2.5GHz oscilloscope.The experiments use the SAKURA-G board, designed for power side-channel evaluation.
  • Attack flow: The flow collects traces across kernels, extracts real power by filtering noise, and then applies scenario-specific recovery methods.Passive adversaries locate background pixels to reveal foreground silhouettes; active adversaries use additional profiling.
  • Evaluation: MNIST reconstructions retain digit shape with background detection, while power-template reconstructions preserve more visual detail.The experiments evaluate both recovery methods on handwritten-digit images.

5 POWER EXTRACTION

The measured power trace is distorted by noise, measurement circuitry, and the FPGA power distribution network. The paper extracts cycle-level power by filtering noise, restoring the DC component, aligning cycles, and fitting charging/discharging curves.

  • 5.1 Interference Sources: Measurement noise and circuit effects prevent each trace period from directly representing one clock cycle’s power consumption.The power distribution network can blend neighboring cycles, while oscilloscope measurement adds white noise and the measurement circuit filters the DC component.
  • 5.1 Interference Sources: Amplified power measurements are required because the raw resistor voltage is only several millivolts, near the noise level.The amplifier captures AC components but causes the voltage drop to fall below zero at the end of traces.
  • 5.2 Extraction Methods: Low-pass filtering removes oscilloscope noise, while DC restoration reverses the measurement circuit’s filtering effect.The authors model the measurement circuit through a simulated impulse response and recover the original trace by reversing its effects.
  • 5.2 Extraction Methods: Cycle alignment and curve fitting estimate power despite the FPGA distribution network’s RC-like distortion.Each cycle is modeled as a capacitor charging sharply and discharging gradually; fitted parameters estimate trailing power in subsequent cycles.
  • 5.2 Extraction Methods: The extraction algorithm processes aligned cycles sequentially and accumulates the estimated final power for each current cycle.Algorithm 1 provides the cyclewise procedure, illustrated in Figure 4(e).

6 BACKGROUND DETECTION

The attack detects background pixels from per-cycle power consumption and reconstructs silhouettes from an FPGA CNN accelerator. On MNIST, threshold selection and kernel size affect both pixel recovery and recognition, with dilation degrading recognition for some digits.

  • Attack intuition: Power traces reveal similar pixel values because unchanged convolution-unit data induce limited internal transitions and lower power consumption.The method uses these low-power cycles to identify likely pure-background pixels and expose the foreground silhouette.
  • Threshold-based detection: The threshold-based attack filters cycles above a selected power threshold, locates corresponding pixels, and produces a black-and-white image.Threshold selection relies on the distribution of cycle counts, including the expected peak among lower-power background cycles.
  • Evaluation setup: MNIST evaluation uses 28×28 images, 3×3 and 5×5 kernels, 64 first-layer kernels, and 500 randomly selected test images.The images’ pure black backgrounds satisfy the prerequisite for background detection, while the two models differ in kernel size.
  • Threshold evaluation: 85.6% peak pixel-level accuracy was reached for both kernels, while recognition accuracy peaked at 81.6% for kernel 1 and 81.8% for kernel 2.Kernel 1 reached its recognition peak at threshold 0.5, whereas kernel 2 peaked at threshold 0.3.
  • Recognition analysis: Kernel-induced dilation can make recovered images fatter, causing small structures to disappear and lowering recognition accuracy for structurally sensitive digits.Recognition rates were especially reduced for digits 3, 7, and 9 with model 1, and digits 1, 3, 4, 7, and 9 with model 2.
  • Efficiency: The attack processes one power trace with time complexity O(Sx × Sy), requiring about 6s to obtain a trace and 5.7s for power extraction.The complexity is proportional to the cycles needed for first-layer convolution, determined by image dimensions.

7 IMAGE RECONSTRUCTION VIA POWER TEMPLATE

This section reconstructs CNN input images from power-template matches by generating pixel candidates and enforcing consistency across cycles. The method reduces candidate ambiguity and substantially improves recognition accuracy, including 89.8% for a 3×3-kernel model.

  • 7 IMAGE RECONSTRUCTION VIA POWER TEMPLATE: The attack recovers individual input pixels from power traces using either direct inference or a pre-built power-pixel template, then reconstructs the image from inferred values.
  • 7.1 Intuition: For a 3×3 first-layer kernel, each cycle involves 12 pixels, yielding approximately 256^12 ≈ 7.9 × 10^29 possible pixel combinations and making brute-force search impractical.
  • 7.1 Intuition: The power template maps pixel values to convolution power consumption, allowing attack-time power vectors to produce candidate pixel values.
  • 7.2 Attack Method: The attack method profiles power templates, separates attack-time power features into groups, searches corresponding template groups, and intersects returned candidates.
  • 7.2 Attack Method: Each cycle’s power feature vector reflects K × (K + 1) related pixels when the kernel is K × K, because the kernel stays fixed while pixels shift across cycles.
  • 7.2 Attack Method: Candidate sets are refined by grouping power features and intersecting group-specific matches, with the distance threshold δ controlling candidate count and matching precision.
  • 7.2 Attack Method: The reconstruction algorithm selects candidates consistently across cycles processing the same pixel and averages the selected values to obtain each final pixel.
  • 7.3 Evaluation: 89.8% recognition accuracy is achieved for model 1 with Algorithm 2, versus 15% when averaging all pixel candidates; model 2 falls from 79% to 10% without the algorithm.

8 RELATED WORK

Prior attacks exploit privacy leakage from training data, model outputs, or network-access patterns. This work instead targets runtime input images through the power side channel of a neural accelerator.

  • Earlier attacks recover training images, infer membership, invert models, or reverse-engineer network structures using model outputs or memory-access patterns.
  • Unlike those attacks, this work explores leakage at inference time and recovers runtime input images using the accelerator’s power side channel.
  • Power side-channel attacks have previously recovered secrets such as cryptographic keys by analyzing power differences associated with limited secret components.

9 CONCLUSION

The paper demonstrates a power side-channel attack that recovers inference inputs from an FPGA-based CNN accelerator. It filters measurement noise, supports passive and active adversaries, and achieves high recognition accuracy on MNIST digits.

  • The attack recovers input images from power traces measured during inference on an FPGA-based CNN accelerator.
  • The approach first filters noise and distortions, then uses background detection for passive adversaries and a power template for adversaries who can profile pixel-power correlations.
  • Experiments on MNIST handwritten-digit classification show high recognition accuracy for the recovered images.

A PRELIMINARIES

CNNs apply sliding convolutional filters within sequential neural-network layers, while dedicated FPGA or ASIC accelerators execute these operations during inference. The paper targets the first convolution layer implemented with a line buffer.

  • A CNN is a sequential architecture that may include convolution, pooling, normalization, and fully connected computations.
  • The first CNN layers perform convolution, applying a 2-D kernel across an input image to produce a feature map.
  • The convolution window slides across the input feature map with horizontal and vertical steps Sx and Sy.
  • The convolution calculation combines input pixels with kernel weights and biases, followed by a nonlinear activation function such as tanh or sigmoid.
  • Inference accelerators use dedicated hardware such as FPGAs and ASICs, with buffers storing feature maps and compute units performing operations including convolution and pooling.
  • Line buffers implement 2-D convolution efficiently; the targeted architecture uses three line registers for a 3×3 kernel.
  • The referenced FPGA accelerator compresses CNN parameters and activations to values of 1 or -1, allowing weights to be stored entirely in FPGA RAM.

A.3 Basics on Power Side Channel

The attack exploits data-dependent dynamic power in a CNN accelerator’s line buffer, whose convolution unit dominates measured consumption.

  • Dynamic power arises from transistor input-dependent transitions and typically dominates static leakage power.
  • A 1Ω supply resistor and high-resolution oscilloscope measure power through the resistor’s voltage drop.
  • The line buffer implements sliding convolution over image data, using configurations that vary input channels, line size, and kernel size.
  • More than 80% of total power is consumed by the convolution unit across the evaluated line-buffer configurations.
  • Increasing kernel size or input channels significantly increases convolution-unit power because more pixels participate in the operation.

B DISCUSSION AND FUTURE WORK

The attack applies to line-buffer-based FPGA or ASIC accelerators but has bounded recovery for complex backgrounds and can be countered by randomization.

  • Applicability: The attack targets line-buffer structures used for convolution in FPGA- or ASIC-based neural accelerators, not CPU or GPU designs.
  • Attack Target of Background Detection: Background detection may miss pixels and fail on messy backgrounds because its recovery granularity is limited by kernel size.
  • Extension to other datasets: The method is suited to images containing a pure and relatively large background region.
  • Limitations and Future Work: Randomizing pixel values before convolution or randomizing kernel execution order can defend against the proposed attacks.

C ATTACK RESULTS ON THE MNIST DATASET

The attack reconstructs MNIST inputs from power traces, with recovered images retaining recognizable structure and power-template reconstructions preserving more visual detail.

  • Recovered images are illustrated in Fig. 11 using correctly classified images with identical inputs for direct quality comparison.
Loading 1803.05847v2…