# MaskedNet: The First Hardware Inference Engine Aiming Power Side-Channel Protection

arXiv: https://arxiv.org/abs/1910.13063 · HTML: https://mlsanity.com/paper/1910.13063/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Oct 2019.

## Built on by (most cited first, 11 of 11)

- [Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead](https://mlsanity.com/paper/2101.02559/) (2021)
- [A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters](https://mlsanity.com/paper/2211.05590/) (2022)
- [Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel](https://mlsanity.com/paper/2109.07395/) (2021)
- [Physical Side-Channel Attacks on Embedded Neural Networks: A Survey](https://mlsanity.com/paper/2110.11290/) (2021)
- [A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks](https://mlsanity.com/paper/2303.18132/) (2023)
- [A Review of Confidentiality Threats Against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01401/) (2021)
- [Side-Channel Analysis of OpenVINO-based Neural Network Models](https://mlsanity.com/paper/2407.16467/) (2024)
- [Make Shuffling Great Again: A Side-Channel Resistant Fisher-Yates Algorithm for Protecting Neural Networks](https://mlsanity.com/paper/2501.00798/) (2025)
- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [Power-Based Attacks on Spatial DNN Accelerators](https://mlsanity.com/paper/2108.12579/) (2021)
- [SoK: A Systems Perspective on Compound AI Threats and Countermeasures](https://mlsanity.com/paper/2411.13459/) (2024)

## Abstract (arXiv)

Differential Power Analysis (DPA) has been an active area of research for the past two decades to study the attacks for extracting secret information from cryptographic implementations through power measurements and their defenses. Unfortunately, the research on power side-channels have so far predominantly focused on analyzing implementations of ciphers such as AES, DES, RSA, and recently post-quantum cryptography primitives (e.g., lattices). Meanwhile, machine-learning, and in particular deep-learning applications are becoming ubiquitous with several scenarios where the Machine Learning Models are Intellectual Properties requiring confidentiality. Expanding side-channel analysis to Machine Learning Model extraction, however, is largely unexplored. This paper expands the DPA framework to neural-network classifiers. First, it shows DPA attacks during inference to extract the secret model parameters such as weights and biases of a neural network. Second, it proposes the textitfirst countermeasures against these attacks by augmenting textitmasking. The resulting design uses novel masked components such as masked adder trees for fully-connected layers and masked Rectifier Linear Units for activation functions. On a SAKURA-X FPGA board, experiments show that the first-order DPA attacks on the unprotected implementation can succeed with only 200 traces and our protection respectively increases the latency and area-cost by 2.8x and 2.3x.