Power-Based Attacks on Spatial DNN Accelerators
Not on the map. Why?
Abstract (arXiv)
With proliferation of DNN-based applications, the confidentiality of DNN model is an important commercial goal. Spatial accelerators, that parallelize matrix/vector operations, are utilized for enhancing energy efficiency of DNN computation. Recently, model extraction attacks on simple accelerators, either with a single processing element or running a binarized network, were demonstrated using the methodology derived from differential power analysis (DPA) attack on cryptographic devices. This paper investigates the vulnerability of realistic spatial accelerators using general, 8-bit, number representation. We investigate two systolic array architectures with weight-stationary dataflow: (1) a 3 × 1 array for a dot-product operation, and (2) a 3 × 3 array for matrix-vector multiplication. Both are implemented on the SAKURA-G FPGA board. We show that both architectures are ultimately vulnerable. A conventional DPA succeeds fully on the 1D array, requiring 20K power measurements. However, the 2D array exhibits higher security even with 460K traces. We show that this is because the 2D array intrinsically entails multiple MACs simultaneously dependent on the same input. However, we find that a novel template-based DPA with multiple profiling phases is able to fully break the 2D array with only 40K traces. Corresponding countermeasures need to be investigated for spatial DNN accelerators.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 17 of its 37 references that are in the map. First posted on arXiv 28 Aug 2021.
Builds on
17 of 37 references.
References · 17
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,845
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2016Stealing Machine Learning Models via Prediction APIscited by 619
- 2017In-Datacenter Performance Analysis of a Tensor Processing Unitcited by 618
- 2017Efficient Processing of Deep Neural Networks: A Tutorial and Surveycited by 434
- 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
- 2017Deep Learning for Medical Image Processing: Overview, Challenges and Futurecited by 104
- 2020Cryptanalytic Extraction of Neural Network Modelscited by 68
- 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 57
- 2015Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Featurescited by 48
5 more
- 2018Stealing Neural Networks via Timing Side Channelscited by 43
- 2019Open DNN Box by Power Side-Channel Attackcited by 28
- 2019MaskedNet: The First Hardware Inference Engine Aiming Power Side-Channel Protectioncited by 11
- 2019Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hintscited by 6
- 2017Chain-NN: An Energy-Efficient 1D Chain Architecture for Accelerating Deep Convolutional Neural Networkscited by 2
Built on by
Citing papers per year: 2023: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2024Exploration of Activation Fault Reliability in Quantized Systolic Array-Based DNN Accelerators
- 2023PowerGAN: A Machine Learning Approach for Power Side-Channel Attack on Compute-in-Memory Accelerators
- 20212-in-1 Accelerator: Enabling Random Precision Switch for Winning Both Adversarial Robustness and Efficiency
- 2021Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Accelerators
- 2024Side-Channel Analysis of OpenVINO-based Neural Network Models
- 2023BRAMAC: Compute-in-BRAM Architectures for Multiply-Accumulate on FPGAs
- 2025SIRA: Scaled-Integer Range Analysis for Optimizing FPGA Dataflow Neural Network Accelerators
- 2023An Energy-Efficient Near-Data Processing Accelerator for DNNs that Optimizes Data Accesses ↗