Profiled attack recovers exact neural network weights from device power use
Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights
Cryptography and SecurityArtificial Intelligence
Summary
Devices running neural networks often keep their settings secret, but tiny leaks of power usage can reveal those hidden details. The authors show how to use careful measurement and smart guessing to find the exact number for one setting used in neural networks, even though the numbers are complex 32-bit floats. This is done by analyzing power usage during calculations and narrowing down guesses step-by-step. Their method worked well on a small test computer, showing that these secrets can be uncovered with the right approach.
What this means in practice
- •For hardware security teams: Detect and prevent exact weight extraction by measuring power usage on devices running neural networks.
- •For embedded system developers: Assess the risk of leaking precise neural network parameters through physical side channels during device operation.
Authors
Timon Lumír Fillo, Ján Mikulec, Anubhab Baksi, Jakub Breier, Xiaolu Hou
Abstract
Neural-network parameters deployed on embedded devices may be exposed through physical side-channel leakage during inference. Existing side-channel attacks on floating-point neural-network parameters have often targeted reduced numerical precision, while recovering the complete IEEE-754 representation remains considerably more challenging because of the large and structured 32-bit candidate space. We present a profiled template attack for bit-exact recovery of an IEEE-754 single-precision neural-network weight from power measurements. The attack targets the floating-point multiplication between a known input and a first-layer weight. During profiling, multivariate Gaussian templates are learned from randomized network configurations using Hamming-weight classes of the multiplication result, while the remaining network parameters act as nuisance variables. To efficiently search the structured 32-bit floating-point candidate space, we use a hierarchical coarse-to-fine-to-exact procedure that progressively increases both the numerical and leakage-model resolution. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 demonstrate recovery of the exact float32 representation of the target weight. In the evaluated setting, the attack reaches a bit-exact success rate of 99% with 171 traces and 100% from 263 traces onward. These results demonstrate that profiling can enable practical full-precision extraction of floating-point neural-network parameters from physical leakage.