[Paper Review] I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

Lingxiao Wei, Bo Luo+3 more|arXiv (Cornell University)|Mar 5, 2018

Adversarial Robustness in Machine LearningComputer Science30 references51 citations

TL;DR

This paper presents the first power side-channel attack on a CNN accelerator, recovering input images from power traces during first-layer convolution, achieving up to 89% MNIST recognition accuracy under an FPGA-based attack.

ABSTRACT

Deep learning has become the de-facto computational paradigm for various kinds of perception problems, including many privacy-sensitive applications such as online medical image analysis. No doubt to say, the data privacy of these deep learning systems is a serious concern. Different from previous research focusing on exploiting privacy leakage from deep learning models, in this paper, we present the first attack on the implementation of deep learning models. To be specific, we perform the attack on an FPGA-based convolutional neural network accelerator and we manage to recover the input image from the collected power traces without knowing the detailed parameters in the neural network. For the MNIST dataset, our power side-channel attack is able to achieve up to 89% recognition accuracy.

Motivation & Objective

• Motivate and study privacy risks of deep learning when confidentiality of inputs is protected in hardware implementations.
• Demonstrate that power side channels can leak private inference inputs from CNN accelerators, even without access to model parameters.
• Develop practical techniques to extract true power and reconstruct input pixels from noisy traces.
• Show evaluation on MNIST to quantify background detection and reconstruction capabilities.

Proposed method

• Collect high-resolution power traces from an FPGA-based CNN accelerator during first-layer convolution.
• Extract real per-cycle power consumption from noisy/RC-filtered traces via DC component restoration, low-pass filtering, power alignment, and curve fitting.
• For passive attackers, perform background detection to identify background pixels based on cycle-power magnitudes.
• For active attackers, build a power template mapping power to pixel values using multiple kernels, enabling pixel-value candidate generation per cycle.
• Optionally reconstruct full input images by selecting best pixel candidates from the generated set.

Experimental results

Research questions

• RQ1 Can a power side-channel attack recover the private input image from a CNN accelerator during inference without model parameter knowledge?
• RQ2 How accurately can background pixels be recovered, and how does kernel size affect reconstruction quality on MNIST?
• RQ3 What is the viability of an active attacker using a power template to infer pixel values of the input image?
• RQ4 What are the practical limits and performance characteristics of power extraction and reconstruction on FPGA-based CNN accelerators?

Key findings

• The attack can recover input silhouettes and, with background detection, reveal foreground shapes from MNIST images.
• Kernel size and threshold selection influence pixel-level and recognition accuracy, with 3×3 showing higher accuracy than 5×5 in reported experiments.
• Background detection achieves meaningful silhouette recovery, while active attacks using power templates can reconstruct pixel candidates for inference.
• Power extraction techniques achieve cycle-accurate power estimates despite RC-filtering and noise, enabling per-cycle analysis.
• Overall, MNIST-based experiments demonstrate significant privacy leakage through power side channels in CNN accelerators.