PaperlayerView exact revision on arXiv

Source-linked AI summary

HAWC-Leak: Heterogeneous Architecture Workload Classification utilizing Side-Channel Leakage

Muhtasim Alam Chowdhury, Arthur Kim, Rozhin Yasaei, Soheil Salehi

arXiv:2610.30400v1cs.CR

TL;DR

Power side-channel research has largely focused on isolated algorithms, leaving workload identification in heterogeneous systems less explored. HAWC-Leak uses machine learning to classify accelerator workloads from captured power traces in controlled mixed-activity settings. The authors report 100% accuracy across the test scenarios, while noting that the current framework supports only one active workload at a time.

  • Problem

    Side-channel methods have largely targeted key extraction from isolated algorithms, while identifying diverse workloads in heterogeneous systems remains an open challenge.

    Source: §I · p. 1

  • Method

    HAWC-Leak captures FPGA power traces with a ChipWhisperer CW305 platform and uses a hierarchical machine-learning classifier to identify active workloads in controlled mixed-activity settings.

    Source: §I · pp. 1–2

  • Results

    100% global accuracy across all test scenarios, with no false positives or false negatives on the test set.

    Source: A. Classification Performance · p. 7

  • Takeaways & Limitations

    The results support power consumption as a practical signal for identifying accelerator workloads, including when inactive modules contribute background leakage.

    Source: §VI · p. 8

    The current framework supports only a single active workload at a time.

    Source: §VI · p. 8

Abstract

from arXiv · show

Modern heterogeneous computing platforms, which integrate general-purpose processors with specialized accelerators such as FPGAs, have become the standard for high-performance and embedded applications. However, the shared physical resources of these systems introduce critical security vulnerabilities, where power consumption patterns can leak sensitive runtime information. While side-channel analysis is well established for extracting cryptographic keys from isolated algorithms, existing methods struggle to profile complex, dynamic systems where diverse workloads coexist on shared hardware resources. This paper presents HAWC-Leak, a dynamic workload classification framework designed to identify specific hardware accelerator tasks in real time using non-invasive power analysis. Unlike prior studies focused on extracting cryptographic secrets from isolated implementations, our approach profiles heterogeneous runtime behavior using machine learning to predict active workloads from features extracted from power traces. We implement a complete hardware-in-the-loop measurement testbed using the ChipWhisperer CW305 Artix-7 FPGA platform to capture high-resolution power signatures of diverse workloads including Advanced Encryption Standard (AES-128), Elliptic Curve Cryptography (ECC P-256), Secure Hash Algorithm (SHA-256), Convolutional Neural Network (CNN), and a system idle state. We develop a Hierarchical Random Forest classifier that processes real-time power data to identify the executing application in controlled mixed-activity scenarios where multiple accelerators are instantiated but only one executes at a time. Experimental results demonstrate that this framework achieves 100% classification accuracy across all evaluated scenarios, confirming that power consumption patterns serve as a reliable and distinctive fingerprint for profiling heterogeneous runtime behavior.

I. INTRODUCTION

The introduction frames power leakage as a way to profile workloads in heterogeneous systems, a broader task than extracting keys from isolated algorithms. HAWC-Leak applies machine learning to power traces and evaluates whether it can identify accelerator workloads under controlled mixed activity.

I. INTRODUCTION

  • Existing side-channel work largely targets isolated algorithms, while heterogeneous systems combine workloads and background activity that complicate runtime identification.The introduction notes that logical isolation does not mask physical execution signatures and describes workload profiling as a broader threat.Source: §I · p. 1
  • HAWC-Leak uses power traces to classify active workloads in real time, addressing the stated gap in identifying diverse tasks on accelerator-rich systems.The paper presents the framework as a machine-learning-driven classifier for FPGA-based accelerators under realistic execution conditions.Source: §I · pp. 1–2
  • Using ChipWhisperer with a Xilinx Artix-7, HAWC-Leak achieves near-perfect accuracy identifying active workloads in mixed-activity traces, while traditional classifiers flounder; multiple accelerator IP cores are instantiated, only one executing.Inactive but clocked modules introduce background leakage.Source: §I · p. 2
  • The authors report near-perfect workload identification and describe distinct, learnable power signatures even when multiple applications coexist on the fabric.The introduction characterizes power consumption as a high-fidelity signal for this controlled setting.Source: §I · p. 2

II. RELATED WORKS

The related-work section situates power-based workload leakage in heterogeneous platforms and previews the research areas it reviews.

II. RELATED WORKS

  • The section reviews heterogeneous side-channel analysis, FPGA-based power measurement, machine-learning workload profiling, and the threat model.It frames these topics as background for investigating power-based workload leakage in heterogeneous platforms.Source: §II · p. 2
  • Its coverage includes both the measurement technology and the methods used to profile workloads from side-channel signals.These topics are listed as FPGA-based measurement and ML workload profiling.Source: §II · p. 2
  • The review also includes heterogeneous side-channel analysis and the paper’s threat model.These are named as distinct parts of the background discussion.Source: §II · p. 2

A. Side-Channel Analysis in Heterogeneous Systems

The related-work discussion describes how heterogeneous execution complicates side-channel analysis and reviews measurement and machine-learning approaches relevant to workload profiling.

A. Side-Channel Analysis in Heterogeneous Systems

  • Heterogeneous systems add cross-component leakage and scheduler-driven execution variance, challenging workload fingerprinting beyond isolated-device assumptions.Prior examples include FPGA power attacks and CPU-GPU leakage through shared resources.Source: A. Side-Channel Analysis in… · p. 2

B. FPGA-Based Power Measurement

  • ChipWhisperer synchronizes ADC sampling to the target clock, reducing timing jitter and enabling capture of FPGA transients.The CW305 Artix-7 platform provides direct access to FPGA core-rail activity, used as a proxy for microarchitectural power leakage.Source: B. FPGA-Based Power Measurement · pp. 2–3

C. Machine Learning for Workload Profiling

  • Prior ML side-channel work targets key recovery or tamper monitoring, whereas this paper focuses on classifying cryptographic workloads in real time.The cited literature includes CNN-based profiled and non-profiled attacks, unsupervised leakage extraction, and monitoring for tampering precursors.Source: C. Machine Learning for Workload… · p. 3

D. Threat Model

The paper considers a passive power-monitoring adversary and evaluates workload classification using an FPGA–ChipWhisperer pipeline. The setup captures accelerator traces and controlled mixed-activity conditions, including background leakage from inactive modules.

D. Threat Model

  • The threat model assumes a grey-box passive adversary with physical access who monitors power but cannot inspect memory or modify the bitstream.The objective is to infer accelerator execution state without disrupting system availability.Source: D. Threat Model · p. 3

III. EXPERIMENTAL METHODOLOGY

  • The methodology evaluates cryptographic and non-cryptographic accelerators under controlled and mixed-activity conditions, including idle execution.The stated workload set includes AES, ECC, SHA-256, CNN, and idle.Source: §III · p. 3

A. FPGA Integration and Power Trace Acquisition

  • The CW305 Artix-7 testbed combines FPGA accelerator execution, synchronized ChipWhisperer power capture, and host scripts that configure workloads and collect traces.Multiple modules can be instantiated together, so inactive modules contribute background leakage.Source: A. FPGA Integration and Power Trace… · p. 3
  • The shared AES-ECC bitstream selects which accelerator receives the start trigger while the other remains clocked but computation-idle.A mode-selection register controls runtime switching without reprogramming the FPGA between workloads.Source: A. FPGA Integration and Power Trace… · p. 4
  • Each cryptographic workload uses 10,000 training traces, with a separate evaluation set of 100 traces from new input cases.The CNN workflow acquires 10,000 traces across four fixed input topologies; its 5,000-sample execution window shows data-dependent amplitude variation, and a separate 100-trace validation set uses new instances of those patterns.Source: A. FPGA Integration and Power Trace… · pp. 4–5

B. Data Acquisition and Preprocessing

The study uses a two-stage Random Forest framework to classify five workload classes from Artix-7/CW305 power traces. Its data include separate standard-class test files and a stratified CNN split, with mixed traces augmenting training.

B. Data Acquisition and Preprocessing

  • Random Forest was selected for interpretability and computational efficiency, including feature-importance metrics and lower training complexity than neural networks.The paper describes this choice as suitable for resource-constrained embedded monitoring.Source: B. Data Acquisition and Preprocessing · p. 5
  • Figure 4 presents average CNN VCCINT power traces for four fixed input patterns during convolution-dominated execution.The traces highlight data-dependent switching.Source: Figure 4 · p. 6
  • The dataset covers AES, ECC, SHA-256, CNN, and system idle traces captured from an Artix-7 FPGA on the CW305.The framework uses a two-stage hierarchy to distinguish short-duration AES from longer workloads.Source: B. Data Acquisition and Preprocessing · pp. 5–6
  • Standard classes use separate training and test datasets, while CNN traces use a random stratified split with 100 traces reserved for testing.Standard-class evaluation uses separate files of approximately 100 traces each; training repositories contain approximately 10,000 traces per class.Source: B. Data Acquisition and Preprocessing · p. 6
  • Training was augmented with mixed-signal traces containing AES with idle states and ECC with active operations.The mixed traces are used to help the model isolate cryptographic signatures amid background noise and interleaved operations.Source: B. Data Acquisition and Preprocessing · p. 6

C. Feature Extraction

Power traces are normalized and converted into fixed-length feature vectors using statistical and spectral measurements. The selected features capture temporal shape and frequency characteristics relevant to distinguishing hardware cores.

C. Feature Extraction

  • Each trace is zero-mean normalized, then represented by 21 statistical and spectral features to handle variable-length time series.Table I is titled as a summary of the extracted features for power-trace classification.Source: C. Feature Extraction · p. 6, Table I · p. 6
  • Time-domain features include mean, standard deviation, RMSE, energy, skewness, kurtosis, entropy, crest factor, impulse factor, and shape factor.These descriptors capture vertical asymmetries of power spikes.Source: C. Feature Extraction · p. 6
  • FFT-derived features include power spectrum peak, spectral centroid, and spectral roll-off, which help distinguish cores by switching frequency or intensity.The passage identifies frequency-domain features as critical to that distinction.Source: C. Feature Extraction · p. 6

D. Hierarchical Classification Architecture

The classifier separates short, bursty AES activity from the remaining workloads using a two-stage Random Forest architecture. An AES sliding-window detector handles temporally shifted leakage before a full-trace classifier distinguishes the other classes.

D. Hierarchical Classification Architecture

  • A two-stage Hierarchical Random Forest addresses the difficulty of classifying short, bursty AES alongside longer ECC or CNN activity.Both stages use Random Forest estimators with 100 trees and balanced class weights.Source: D. Hierarchical Classification… · pp. 6–7
  • Stage 1 scans 129-sample windows with stride 32 and labels a trace AES if any window’s AES probability exceeds τ = 0.45.The sliding-window rule is intended to detect AES leakage even when temporally shifted.Source: D. Hierarchical Classification… · p. 6
  • If Stage 1 is negative, Stage 2 uses full-trace features to classify ECC, idle, SHA-256, or CNN.Both stages use Random Forest estimators with balanced class weights.Source: D. Hierarchical Classification… · pp. 6–7

IV. EXPERIMENTAL RESULTS

The evaluation uses unseen test partitions and examines classification accuracy, confusion matrices, and feature relevance.

IV. EXPERIMENTAL RESULTS

  • The proposed hybrid hierarchical model was evaluated on unseen test partitions described in the experimental methodology.The passage does not report a numerical outcome.Source: §IV · p. 7
  • The evaluation focuses on classification accuracy and confusion-matrix analysis.These are identified as performance metrics in the passage.Source: §IV · p. 7
  • Feature relevance is also included among the evaluation focuses.The passage gives no feature-relevance result.Source: §IV · p. 7

A. Classification Performance

HAWC-Leak classified all five target classes and mixed-signal environments with 100% global accuracy, including mixed AES and ECC traces.

A. Classification Performance

  • 100% global accuracy was achieved across all test scenarios, with no false positives or false negatives on the test set.The model distinguished five target classes and mixed-signal environments.Source: A. Classification Performance · p. 7
  • All discrete AES, ECC, Idle, SHA-256, and CNN traces were correctly identified.Source: A. Classification Performance · p. 7
  • 100% accuracy was maintained on both the “AES Mixed” and “ECC Mixed” datasets.The authors attribute this to Stage 1’s sliding-window approach isolating AES signatures amid other system activity.Source: A. Classification Performance · p. 7

B. Feature Importance Analysis:

Feature importance differed across the classifier’s stages, while PCA showed distinct class clusters and closer AES–ECC proximity that the hierarchy resolves.

B. Feature Importance Analysis:

  • Stage 1 relied most on Spectral Rolloff and Spectral Centroid, while Stage 2 gave greater significance to Peak-to-Peak Ratio and Crest Factor.The authors associate Stage 1’s spectral features with AES high-frequency switching and Stage 2’s time-domain metrics with the amplitude profile and shape of ECC, SHA-256, and CNN traces.Source: B. Feature Importance Analysis · p. 7

C. Feature Space Visualization:

  • PCA showed compact CNN, SHA-256, and Idle clusters, while AES and ECC lay closer together; the hierarchical classifier resolves that proximity.The 21-dimensional feature vectors were projected into two dimensions; Fig. 8 depicts the class clustering and AES–ECC proximity.Source: C. Feature Space Visualization · p. 7, Figure 8 · p. 7

V. FUTURE DIRECTIONS

The authors flag possible overfitting to controlled noise profiles and propose broader traces and application classes; the conclusion limits the current framework to one active workload at a time.

V. FUTURE DIRECTIONS

  • Perfect test accuracy may reflect overfitting to the controlled dataset’s noise profiles and experimental conditions.Future work proposes broader mixed-signal traces and application classes, unsupervised clustering, and lightweight 1D-CNNs for environmental distortions.Source: §V · p. 8

VI. CONCLUSION

  • The current framework supports only a single active workload at a time, establishing a baseline for scalable workload fingerprinting.Source: §VI · p. 8
Loading 2610.30400v1…