# I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators

arXiv: https://arxiv.org/abs/1803.05847 · HTML: https://mlsanity.com/paper/1803.05847/

## Key facts

- Cited by 27 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Mar 2018.

## Built on by (most cited first, 27 of 27)

- [Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)](https://mlsanity.com/paper/2407.14937/) (2024)
- [Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead](https://mlsanity.com/paper/2101.02559/) (2021)
- [Privacy Side Channels in Machine Learning Systems](https://mlsanity.com/paper/2309.05610/) (2023)
- [What Was Your Prompt? A Remote Keylogging Attack on AI Assistants](https://mlsanity.com/paper/2403.09751/) (2024)
- [Pervasive AI for IoT applications: A Survey on Resource-efficient Distributed Artificial Intelligence](https://mlsanity.com/paper/2105.01798/) (2021)
- [Towards Energy-Efficient and Secure Edge AI: A Cross-Layer Framework](https://mlsanity.com/paper/2109.09829/) (2021)
- [Leaky Nets: Recovering Embedded Neural Network Models and Inputs through Simple Power and Timing Side-Channels -- Attacks and Defenses](https://mlsanity.com/paper/2103.14739/) (2021)
- [Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel](https://mlsanity.com/paper/2109.07395/) (2021)
- [FedRight: An Effective Model Copyright Protection for Federated Learning](https://mlsanity.com/paper/2303.10399/) (2023)
- [Knowledge Cross-Distillation for Membership Privacy](https://mlsanity.com/paper/2111.01363/) (2021)
- [Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems](https://mlsanity.com/paper/2204.09514/) (2022)
- [Careful What You Wish For: on the Extraction of Adversarially Trained Models](https://mlsanity.com/paper/2207.10561/) (2022)
- [Physical Side-Channel Attacks on Embedded Neural Networks: A Survey](https://mlsanity.com/paper/2110.11290/) (2021)
- [A Review of Confidentiality Threats Against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01401/) (2021)
- [Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective](https://mlsanity.com/paper/2111.03308/) (2021)
- [Mercury: An Automated Remote Side-channel Attack to Nvidia Deep Learning Accelerator](https://mlsanity.com/paper/2308.01193/) (2023)
- [Model Extraction and Adversarial Attacks on Neural Networks using Switching Power Information](https://mlsanity.com/paper/2106.08299/) (2021)
- [PowerGAN: A Machine Learning Approach for Power Side-Channel Attack on Compute-in-Memory Accelerators](https://mlsanity.com/paper/2304.11056/) (2023)
- [THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models](https://mlsanity.com/paper/2503.23748/) (2025)
- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [DPSNN: A Differentially Private Spiking Neural Network with Temporal Enhanced Pooling](https://mlsanity.com/paper/2205.12718/) (2022)
- [TAO: Tolerance-Aware Optimistic Verification for Floating-Point Neural Networks](https://mlsanity.com/paper/2510.16028/) (2025)
- [On the Evaluation of User Privacy in Deep Neural Networks using Timing Side Channel](https://mlsanity.com/paper/2208.01113/) (2022)
- [Side Channel-Assisted Inference Leakage from Machine Learning-based ECG Classification](https://mlsanity.com/paper/2304.01990/) (2023)
- [Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channels](https://mlsanity.com/paper/2402.11953/) (2024)
- [DivQAT: Enhancing Robustness of Quantized Convolutional Neural Networks against Model Extraction Attacks](https://mlsanity.com/paper/2512.23948/) (2025)
- [Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights](https://mlsanity.com/paper/2610.04436/) (2026)

## Abstract (arXiv)

Deep learning has become the de-facto computational paradigm for various kinds of perception problems, including many privacy-sensitive applications such as online medical image analysis. No doubt to say, the data privacy of these deep learning systems is a serious concern. Different from previous research focusing on exploiting privacy leakage from deep learning models, in this paper, we present the first attack on the implementation of deep learning models. To be specific, we perform the attack on an FPGA-based convolutional neural network accelerator and we manage to recover the input image from the collected power traces without knowing the detailed parameters in the neural network. For the MNIST dataset, our power side-channel attack is able to achieve up to 89% recognition accuracy.