Source-linked AI summary
Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights
Timon Lumír Fillo, Ján Mikulec, Anubhab Baksi, Jakub Breier, Xiaolu Hou
TL;DR
Embedded neural-network weights can leak through physical measurements, while recovering their complete 32-bit floating-point representation remains challenging. This paper uses profiled templates and a hierarchical search to recover a target weight bit-exactly, reaching 99% success with 171 traces and 100% from 263 traces onward in the evaluated setting.
Problem
Existing side-channel attacks on floating-point neural-network weights often target reduced precision, leaving profiled bit-exact recovery across the structured 32-bit space unaddressed.
Source: §1 · pp. 1–2Method
The attack profiles multivariate leakage templates for a known-input, first-layer multiplication and uses a coarse-to-fine-to-exact search over float32 candidates.
Source: §1 · p. 2Results
99% bit-exact success is achieved with 171 attack traces, and success reaches 100% from 263 traces onward in the evaluated setting.
Source: §1 · p. 3Takeaways & Limitations
Randomized profiling configurations can yield templates that remain discriminative for a target network despite variation in non-target weights.
Source: §6 · p. 19The study focuses on the first weight of the first layer on a single target platform, with non-target weights treated as nuisance variables during profiling.
Source: §3.2 · p. 6, §6 · p. 19
Abstract
from arXiv · showhide
Neural-network parameters deployed on embedded devices may be exposed through physical side-channel leakage during inference. Existing side-channel attacks on floating-point neural-network parameters have often targeted reduced numerical precision, while recovering the complete IEEE-754 representation remains considerably more challenging because of the large and structured 32-bit candidate space. We present a profiled template attack for bit-exact recovery of an IEEE-754 single-precision neural-network weight from power measurements. The attack targets the floating-point multiplication between a known input and a first-layer weight. During profiling, multivariate Gaussian templates are learned from randomized network configurations using Hamming-weight classes of the multiplication result, while the remaining network parameters act as nuisance variables. To efficiently search the structured 32-bit floating-point candidate space, we use a hierarchical coarse-to-fine-to-exact procedure that progressively increases both the numerical and leakage-model resolution. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 demonstrate recovery of the exact float32 representation of the target weight. In the evaluated setting, the attack reaches a bit-exact success rate of 99% with 171 traces and 100% from 263 traces onward. These results demonstrate that profiling can enable practical full-precision extraction of floating-point neural-network parameters from physical leakage.
1 Introduction
This section frames exact floating-point weight recovery as a gap in neural-network side-channel attacks and presents a profiled template attack with a hierarchical search. In the evaluated setting, the attack recovers the target weight bit-exactly with a few hundred traces.
1 Introduction
- Prior neural-network weight attacks often assumed reduced floating-point precision, while bit-exact recovery had not been investigated with a profiled template attack.The paper motivates exact recovery by the large, structured candidate space and the value of trained parameters as intellectual property.Source: §1 · pp. 1–2
- The attack learns templates from randomized network configurations for the multiplication of a known input by the first-layer weight, treating remaining parameters as nuisance variables.Candidate weights are ranked by accumulated template likelihood on the fixed target network, without direct correlation against hypothetical leakage.Source: §1 · p. 2
- A coarse-to-fine-to-exact search progressively increases leakage-model resolution to narrow the structured 32-bit IEEE-754 candidate space.The final stage evaluates neighboring representable float32 values using the complete 32-bit model.Source: §1 · pp. 2–3
- The evaluated attack’s efficiency is quantified by success rate: 99% is achieved with 171 attack traces, and 100% from 263 traces onward.Source: §1 · p. 3
2 Background and Related Work
The background introduces physical side-channel attacks on neural networks, explains profiled template attacks, and reviews the IEEE-754 structure relevant to recovering floating-point weights.
2.1 Side-Channel Analysis Attacks on Neural Networks
- Side-channel attacks use physical leakage during neural-network execution to infer inputs, architecture, or parameters; correlation power analysis compares measured traces with candidate-dependent leakage predictions.The cited prior work includes timing, power, and electromagnetic measurements.Source: §2.1 · p. 3
2.2 Template Attacks
- Template attacks build statistical leakage models from profiling traces with known intermediate values, then evaluate attack-phase hypotheses by likelihood; prior neural-network template work focused on input recovery.The paper identifies profiled template recovery of floating-point neural-network weights as an unaddressed application.Source: §2.2 · pp. 3–4
2.3 IEEE-754 Floating-Point Representation
- IEEE-754 single precision stores a sign, exponent, and fraction, and the attack exploits this structure by adding fraction bits across successive search stages.Numerically close values may differ in only a few fraction bits, while larger changes can also alter the exponent.Source: §2.3 · pp. 4–5
3 Threat Model and Experimental Setup
The attack assumes a profiled adversary who can choose network inputs and measure power, and targets the first weight of a software-implemented feed-forward network. Randomized profiling configurations provide labeled multiplication traces, while attack traces come from a fixed network with an unknown target weight.
3.1 Threat Model
- The profiled adversary knows the architecture and target multiplication, chooses inputs, measures power, and can program same-type profiling hardware with known weights.The attacked device has fixed, unknown weights; experiments reprogram the same physical board between profiling and attack.Source: §3.1 · p. 5
3.2 Target Neural Network
- The target is the first weight of the first fully connected layer, whose multiplication uses an attacker-chosen input; later-layer inputs depend on preceding computations.The implementation is a four-layer feed-forward network using IEEE-754 single-precision values, and its floating-point multiplication is executed by a software library routine.Source: §3.2 · pp. 5–6
3.3 Profiling Scenario
- Profiling randomizes network weights in [−2, 2] and refreshes configurations every 100 traces; known inputs and target weights label multiplication leakage, while other weights act as nuisance variables.The profiling model characterizes multiplication-result classes rather than individual weights, so it can be evaluated on an independently configured target network.Source: §3.3 · pp. 6–7
3.4 Attack Scenario
- During attack, the target weight is unknown and constant across traces, while the attacker supplies known inputs and ranks candidate weights by accumulated template likelihood.The evaluator’s known target value is used only to assess recovery, not for candidate scoring or template matching.Source: §3.4 · pp. 7–8
3.5 Measurement Platform
- Measurements use a ChipWhisperer-Lite with an STM32F303 Arm Cortex-M4; analysis retains the first 1,000 samples containing the targeted multiplication.The profiling project contains 50,000 traces and the attack project 5,000; attack-trace metadata stores inputs but not the target weight.Source: §3.5 · pp. 8–9
4 Profiled Template Attack
The attack models power leakage from the known-input, candidate-weight multiplication, then uses Gaussian templates and accumulated likelihoods to rank candidates. A hierarchical search increases both candidate precision and leakage-model resolution to reach individual float32 values.
4.1 Leakage Model
- The leakage class is the Hamming weight of selected most-significant bits of the float32 multiplication result, with 17-, 23-, and 32-bit models for coarse, fine, and exact searches.These resolutions yield 18, 24, and 33 possible classes; using fewer fraction bits initially tolerates small candidate errors, while the complete representation is used for exact recovery.Source: §4.1 · p. 10
4.2 Point-of-Interest Selection
- Five points of interest are selected by ranking samples in the first 1,000 trace samples by absolute correlation with full-representation Hamming-weight labels, with at least 20 samples between selections.The same five time samples are used across coarse, fine, and exact template sets.Source: §4.2 · p. 11
4.3 Template Construction
- Profiling vectors are grouped by leakage class and represented by multivariate Gaussian templates with class means and a pooled covariance shared across classes.Means for classes with fewer than 30 profiling traces are extrapolated from sufficiently populated classes rather than treated as impossible.Source: §4.3 · pp. 11–12
4.4 Candidate Likelihood
- Each candidate’s predicted leakage classes are scored against the corresponding Gaussian templates, and trace log-likelihoods are summed under a conditional-independence assumption.The candidate with the highest accumulated score is selected; correct candidates are expected to produce classes consistently compatible with measured traces.Source: §4.4 · pp. 12–13
4.5 Hierarchical Weight Recovery
- Coarse-to-fine-to-exact search progressively narrows candidate weights and increases leakage resolution, with the exact stage distinguishing neighboring IEEE-754 values and power-of-two look-alikes.The coarse stage searches the assumed interval, the fine stage refines finalists locally, and the exact stage evaluates neighboring float32 values.Source: §4.5 · pp. 13–14
- The exact stage evaluates neighboring representable float32 values, both signs, and power-of-two-scaled variants using templates based on the complete 32-bit multiplication result.For a fine result near 1.43, the described candidate set contains 22,550 exact candidates.Source: §4.5 · p. 14
5 Experimental Results
The experiments show bit-exact recovery of the target float32 weight, reaching 100% success from 263 traces in the evaluated setting. Profiling reveals leakage at multiple samples, while candidate convergence and success-rate analyses characterize how recovery improves as traces accumulate.
5.1 Profiling Leakage
- Absolute correlations of 0.74–0.93 at five POIs show strong dependence between power and the full 32-bit product's Hamming weight.The first ≈400 samples show almost no correlation; later separated peaks suggest leakage during multiplication and subsequent operations such as storing and accumulating the product.Source: §5.1 · p. 15, Figure 1 · p. 15
- Only 11 of 18 coarse, 13 of 24 fine, and 16 of 33 exact Hamming-weight classes had at least 30 profiling traces; missing means were extrapolated.Measured class means fell almost linearly with Hamming weight, but noise at the first POI was two to three times the gap between neighboring means, so evidence from many traces had to be combined.Source: §5.1 · pp. 15–16, Figure 2 · p. 16
5.2 Weight Recovery
- The exact stage recovered the target weight bit for bit as 0x3FB70A3D after the fine stage refined a finalist to 1.4299961.The fine-stage value was 33 ULPs below the true value.Source: §5.2 · pp. 16–17
5.3 Candidate Convergence
- 427, 497, and 446 traces were needed for the true weight to outscore every wrong candidate in the coarse, fine, and exact stages, respectively.In the exact stage, all 1,024 neighboring float32 values within ±512 ULPs were outscored after 7 traces; strongest competitors included power-of-two look-alikes. The displayed trace order was harder than average: w⋆/256 remained selected until 446 traces.Source: §5.3 · p. 17, Figure 3 · p. 18
5.4 Success Rate
- Success rose to 99% with 171 attack traces and reached 100% from 263 through the largest evaluated count of 500, indicating reliable target-weight recovery with a few hundred measurements in the evaluated setting.Source: §5.4 · p. 18
6 Discussion
The discussion interprets the results as evidence that profiling captures leakage associated with the targeted multiplication despite variation in other network weights. It also explains how the hierarchical search balances candidate-space coverage with exact float32 recovery.
6 Discussion
- Figure 4 plots empirical attack success rate against the number of attack traces.Source: Figure 4 · p. 19
- The templates remain discriminative when non-target weights vary during profiling, supporting recovery on a fixed attack network.The discussion attributes this to leakage associated with the targeted multiplication rather than a single fixed network configuration.Source: §6 · pp. 18–19
- The coarse-to-fine-to-exact search avoids applying the complete leakage model across the entire candidate space while retaining exact-recovery capability.It progressively increases leakage resolution, ending with neighboring float32 values evaluated using the complete 32-bit model.Source: §6 · p. 19
7 Conclusion
The paper presents a profiled template attack for recovering a single-precision neural-network weight from power measurements. Its hierarchical search supports exact float32 recovery, with reliable recovery achievable using only a few hundred traces in the evaluated setting.
7 Conclusion
- The profiled attack models power leakage from multiplication of a known input by an unknown target weight using templates from randomized configurations.Source: §7 · pp. 19–20
- Reliable recovery is achieved with only a few hundred attack traces in the considered setting.Source: §7 · p. 20
- A hierarchical coarse-to-fine-to-exact search enables efficient exploration of candidates and exact recovery of the target float32 value.Source: §7 · p. 20