I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

Introduction

• DNN security is a serious concern because models are used in safety-critical and security-sensitive applications.Source: §1 · p. 1
• Inference-stage inputs remain vulnerable even where direct access is controlled, such as when encrypted medical images are decrypted inside the inference engine.Source: §1 · p. 1
• The attack targets the first-layer convolution hardware, commonly implemented with a line buffer, to recover the private input image from accelerator power consumption.The target is an FPGA-based CNN accelerator performing image classification.Source: §1 · p. 2
• Unlike prior privacy attacks that reproduce training samples from model outputs, this attack recovers the input being inferred without model parameters or outputs.The introduction describes this as the first neural-accelerator privacy attack using power side channels.Source: §1 · p. 2
• A power-extraction technique recovers per-clock-cycle consumption despite noise and distortions from other circuit components.Source: §1 · p. 2
• Pixel values are inferred directly from power traces or from a pre-built power-pixel template, then pieced together to reconstruct the image.The approach uses the limited set of pixels involved in each convolution operation.Source: §1 · p. 2

Convolutional Neural Network; Neural Accelerator

• The first CNN layer convolves a raw image with a sliding 2-D kernel, while the accelerator’s line buffer caches recent rows and a computation unit calculates convolution results.The paper follows Zhao et al.’s FPGA accelerator design for a compressed CNN [12]; neural accelerators commonly use FPGA or ASIC implementations.Source: §2 · p. 2

Power characterization of neural accelerator

• Over 80% of total accelerator power was consumed by the convolution unit across line-buffer configurations, so measured power serves as a coarse-grain estimate of that unit’s power.The estimate was based on simulations using Xilinx XPower analyzer.Source: §2 · p. 2

Scenario

• The adversary’s goal is to recover private online inference inputs, rather than reconstruct training samples, by exploiting power traces exposed while real users’ data is processed.The scenario assumes inputs are otherwise difficult to obtain directly because they are protected by access controls or encryption.Source: §3 · pp. 2–3
• Adversaries may be accelerator-design-team members or insiders at hosting companies, using implanted Trojans or measurement circuits to access power traces during inference.The assumed deployment includes machine-learning services and computing platforms with DNN-accelerating hardware.Source: §3 · pp. 2–3

Capability

• Attackers know the network structure, input image size, and first-layer filter and feature-map counts, but not detailed network parameters, and can acquire high-resolution power traces.Traces may be obtained with an oscilloscope or power-monitoring Trojan.Source: §3 · p. 3
• Passive adversaries only eavesdrop during inference, whereas active adversaries can launch arbitrary inputs to profile power against pixels before private user-data computation.Both attacker types are considered realistic when they have physical access to the accelerator.Source: §3 · p. 3

• The attack targets first-layer convolution because it directly processes the input and its small-pixel computations reduce the effort needed to infer pixel values.The paper’s primary goal is recovering the input image from accelerator power traces.Source: §4 · p. 3
• The evaluation implements a CNN accelerator on a Xilinx Spartan-6 LX75 FPGA on the SAKURA-G board, measuring traces with a Tektronix MDO3034 oscilloscope at 2.5GHz.Source: §4 · p. 3
• Passive attacks locate background pixels to reveal foreground silhouettes, while active attacks use a power template to generate pixel candidates and select the best ones to recover the image.Both methods follow power-trace collection and extraction of real power consumption after noise filtering.Source: §4 · p. 3
• MNIST images recovered with power templates retain more detail and resemble the originals more closely visually than images recovered through background detection.Background detection preserves the general shape of the original image.Source: §4 · p. 3

5.1 Interference Sources

• Oscilloscope measurement adds white noise, while the amplifier preserves a usable signal but filters out AC-inaccessible DC, and the FPGA power network is modeled as an RC filter.The raw resistor voltage is only several millivolts—about the noise level—so the amplified signal is crucial; the amplifier’s high-pass response has a cutoff near 250Hz, and the network’s RC model is an assumption based on its wiring structure.Source: §5.1 · p. 4

5.2 Extraction Methods

• A 60MHz low-pass filter reduces oscilloscope noise; DC restoration reverses the measurement circuit’s 250Hz high-pass effect, and Pearson correlation aligns cycles to a template.The cycle template is manually selected from the filtered trace; the power distribution network is treated separately through capacitor-curve fitting because its response overlaps the power-trace spectrum.Source: §5.2 · p. 4
• Cyclewise curve fitting estimates capacitor charging and discharging, accumulates each cycle’s power with its trailing power, then subtracts that trailing power from later cycles.For each cycle, the algorithm fits the parameters Vp and τ to the trace and continues until all aligned cycles are processed.Source: §5 · p. 3, §5.2 · p. 4

6.1 Intuition

• Low per-cycle power indicates limited internal transitions when convolution-unit data remain unchanged, allowing passive attackers to locate similar-valued pixels as background and reveal the foreground silhouette.The authors note that this can expose the scanned organ and suggest a patient’s health condition in medical images with pure backgrounds.Source: §6.1 · p. 5

6.2 Attack Method

• The method selects a power threshold at the maximal decrease in cycle counts, then labels pixels corresponding to cycles below that threshold as background.The threshold is intended to separate the low-power background cycles from the more broadly distributed foreground cycles.Source: §6.2 · p. 5

6.3 Evaluation

• The evaluation used 500 MNIST test images with clear black backgrounds, recording first-layer convolution traces for two models that differed in kernel size.The setup used a 28-pixel line buffer, one input channel, and 3×3 or 5×5 kernels.Source: §6.3 · p. 6
• Kernel 1 recognition peaked at 81.6% at threshold 0.5, while kernel 2 peaked at 81.8% at 0.3; pixel-level accuracy peaked around 85.6% for both.The reported optimal threshold range was 0.3–0.5; beyond the optimum, recognition accuracy fell more sharply than pixel-level accuracy.Source: Figure 5 · p. 6, §6.3 · p. 6
• With 3×3 versus 5×5 kernels, average pixel-level accuracy was 86.2% versus around 74.6%, and recognition accuracy averaged 81.6% versus 64.6%.Larger kernels blur foreground boundaries through a dilation-like effect, which can erase small digit structures.Source: §6.3 · pp. 6–7, Figure 6 · p. 7
• Recognition varied by digit: digits 3, 7, and 9 were below average with model 1, while digits 1, 3, 4, 7, and 9 fell significantly with model 2.The authors attribute these differences to digit shape and the dilation-like thickening of recovered images, which can make other digits resemble 8.Source: §6.3 · p. 7
• The attack processes one power trace with time complexity O(Sx × Sy); reported times were around 6s to obtain a trace, 5.7s for power extraction, and 0.01s for reconstruction.Source: §6.3 · p. 7

7.1 Intuition

• For a 3×3 first-layer kernel, 12 related pixels yield about 256^12 ≈ 7.9 × 10^29 combinations, motivating a profiled power template to reduce the search space.The template maps power consumption under different kernels to pixel values, enabling candidate generation from attack-time traces.Source: §7.1 · pp. 7–8

7.2 Attack Method

• The template stores related pixel values alongside power-feature vectors measured across kernels; for a K × K kernel, each cycle involves K × (K + 1) related pixels.Profiling collects power traces for each input image with different kernels, and the final template unions entries from all profiled images.Source: §7.2 · p. 8
• Because nearest-vector matching can fail with limited template samples, the attack searches feature groups separately and intersects their returned pixel candidates.For each group, vectors within threshold δ return related pixels; the intersection forms the cycle's final candidate set.Source: §7.2 · p. 8
• The reconstruction algorithm minimizes variance among candidate values for each pixel across cycles, then averages selected candidates to produce final pixel values.Its greedy heuristic prioritizes candidates whose pixel regions overlap the current image and whose values best match the overlapping pixels.Source: §7.2 · pp. 8–9

7.3 Evaluation

• Grouping power features and intersecting candidate sets reduced candidate counts while maintaining precision at medium or large thresholds; the evaluation used 9 kernels and selected group size 3 with δ = 1.0.The attack used 300 images for the template and 200 for evaluation; groups of size 2 and 3 were investigated.Source: §7.3 · p. 9
• 1.65 average pixel-level distance with Algorithm 2 compared with 2.98 without it, against pixel values ranging from 0 to 255.The authors note that both recovered images are close to the genuine image at the pixel level, but the algorithm better preserves digit structure.Source: §7.3 · pp. 9–10
• 89.8% recognition accuracy for model 1 with Algorithm 2 fell to 15% without it; model 2 scored 79% with it versus 10% without it.The comparison is shown in Figure 8.Source: §7.3 · p. 9, Figure 8 · p. 10
• Building the template from 300 images took 215.6s, generating candidates for one image took 157.2s, and reconstruction took 43.2s; the template occupied about 44MB.Template building has time complexity O(N × C × K), while reconstruction has complexity O(C × A^2).Source: §7.3 · p. 10

Neural Network Privacy

• Prior neural-network privacy work recovered genotype associations, training-stage faces, membership [33], and model information through inversion [37] or memory-access analysis.Hua et al. inferred network structure from memory-access patterns and showed weights could be recovered during zero pruning.Source: §8 · p. 10

Power Side-channel Attack

• Power side channels have recovered DES/AES keys,, processor instruction types,, and instruction instances.Power templates estimate a leakage model from traces and secret keys, then use it to predict keys from online traces.Source: §8 · p. 10
• Unlike prior attacks on training data or models, this attack recovers inference-stage runtime images from power traces using the convolutional unit as its target.Although its general procedure resembles power-template attacks, its contribution is identifying an appropriate attacking surface for the method.Source: §8 · p. 10

9 CONCLUSION

• The attack successfully recovers input images from power traces measured during inference on an FPGA-based CNN accelerator.The authors describe it as the first power side-channel attack on this kind of accelerator.Source: §9 · p. 10
• After filtering measurement noise and distortion, the attack uses background detection or power templates for adversaries with different capabilities.Adversaries may passively eavesdrop on the power side channel or additionally profile correlations between power signals and image pixels.Source: §9 · p. 10
• Experiments on an accelerator performing MNIST handwritten-digit classification demonstrate the attack's practicality and high recognition accuracy.Source: §9 · p. 10

A PRELIMINARIES

• The preliminaries review CNN concepts, typical accelerator architecture, and power side-channel leakage basics.This passage outlines the scope of the background section.Source: A PRELIMINARIES · p. 11

A.1 Convolutional Neural Network

• CNNs connect layers that perform convolution, pooling, normalization, or fully connected computation; designers specify structure before training, which supplies the weights used for inference.The first layer takes the image as input and usually performs convolution.Source: §A.1 · p. 11
• A convolution applies a Kx × Ky kernel around input pixels and slides the window by Sx and Sy to produce output feature maps, followed by a nonlinear activation.The input consists of feature maps of size X × Y, with M channels; kernel weights and bias connect input and output feature maps.Source: §A.1 · p. 11

A.2 CNN Accelerator Design

• Typical CNN accelerators combine DMA, a controller, data and parameter buffers, and compute units for data movement, coordination, storage, and neural-network operations.Data buffers hold input feature maps and cache outputs for later layers; parameter buffers store weights before inference.Source: §A.2 · p. 11
• A 3×3 line buffer caches three image rows and uses dedicated multipliers and adders to compute convolution, producing one output value per cycle.For multi-channel images, multiple line-buffer instances process channels in parallel; completed output feature maps are stored for the next layer. Each cycle’s output depends only on the limited input pixels in its convolution window, which the authors identify as a foundation for their attack.Source: §A.2 · p. 11
• The paper follows Zhao et al.’s FPGA accelerator for a compressed CNN [12], whose parameters and activations are restricted to 1 or -1 so weights fit in FPGA RAM.Its convolution unit is based on a line buffer.Source: §A.2 · p. 11

Power Constitution and Measurement

• Dynamic power from transistor transitions closely relates to input data and usually dominates total power; measurement uses a 1Ω supply-line resistor and high-resolution oscilloscope.Static power arises from transistor leakage and is typically very low.Source: §A.3 · p. 11

Power Consumption of Line Buffer

• Over 80% of total power comes from the convolution unit across the tested line-buffer configurations, making measured power a coarse-grain estimate of its consumption.XPower Analyzer estimates show convolution-unit power rises significantly with kernel size and input-channel count, while line-size changes have little effect.Source: Table 3 · p. 11, §A.3 · p. 12

Applicability

• The attack targets line-buffer power behavior during sliding-window convolution, so it applies to line-buffer designs beyond FPGA, including FPGA- or ASIC-based neural accelerators.The authors note that line buffers are not suitable for DNN systems on CPUs or GPUs.Source: B DISCUSSION AND FUTURE WORK · p. 12

Attack Target of Background Detection

• Background detection may miss pure-background pixels when kernel-size granularity is limiting or background is messy, and may fail when background pixels are too few to produce a sharp cycle-count decline.The method is suited to images with a pure, relatively large background region.Source: B DISCUSSION AND FUTURE WORK · p. 12

Extension to other datasets

• The same MNIST-trained template recovered recognizable breast shape and intensity structure from a DDSM image, showing potential to reveal a patient’s scanned organ despite incomplete image detail.The demonstration used the same template as the MNIST experiments; the recovered breast shape and gradual border-to-center lightening were preserved.Source: B DISCUSSION AND FUTURE WORK · p. 12, Figure 10 · p. 13

Countermeasures

• Random masking can break the correlation between power and sensitive intermediate values, while random kernel scheduling can hinder active attackers building power feature vectors across kernels.Adding noise alone does not guarantee strong privacy because it may be cancelled using its distribution; masking adds random values before convolution and removes their weighted sum afterward.Source: B DISCUSSION AND FUTURE WORK · pp. 12–13

Limitations and Future Work

• The current attack is limited to line-buffer designs and similar profiling data; complex or multi-channel images and distribution mismatch may require more profiling data and greater recovery capability.Future work proposes PCA to compress power features and pixel values, SVM or random forest candidate selection, and validation on CIFAR-10 or ImageNet.Source: B DISCUSSION AND FUTURE WORK · p. 13

C ATTACK RESULTS ON THE MNIST DATASET

• Figure 11 illustrates recovered images, with two methods applied to the same correctly classified input for direct quality comparison.Source: C ATTACK RESULTS ON THE MNIST DATASET · p. 13