# A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

arXiv: https://arxiv.org/abs/2211.05590 · HTML: https://mlsanity.com/paper/2211.05590/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 17 references that are in the map.
- First posted on arXiv 10 Nov 2022.

## Builds on (most cited first, 9 of 9)

- [High Accuracy and High Fidelity Extraction of Neural Networks](https://mlsanity.com/paper/1909.01838/) (2019)
- [Cryptanalytic Extraction of Neural Network Models](https://mlsanity.com/paper/2003.04884/) (2020)
- [Open DNN Box by Power Side-Channel Attack](https://mlsanity.com/paper/1907.10406/) (2019)
- [SNIFF: Reverse Engineering of Neural Networks with Fault Attacks](https://mlsanity.com/paper/2002.11021/) (2020)
- [MaskedNet: The First Hardware Inference Engine Aiming Power Side-Channel Protection](https://mlsanity.com/paper/1910.13063/) (2019)
- [Leaky Nets: Recovering Embedded Neural Network Models and Inputs through Simple Power and Timing Side-Channels -- Attacks and Defenses](https://mlsanity.com/paper/2103.14739/) (2021)
- [Physical Side-Channel Attacks on Embedded Neural Networks: A Survey](https://mlsanity.com/paper/2110.11290/) (2021)
- [A Review of Confidentiality Threats Against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01401/) (2021)
- [An Overview of Laser Injection against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01403/) (2021)

## Built on by (most cited first, 9 of 9)

- [Polynomial Time Cryptanalytic Extraction of Neural Network Models](https://mlsanity.com/paper/2310.08708/) (2023)
- [Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Models](https://mlsanity.com/paper/2308.16703/) (2023)
- [Evaluation of Parameter-based Attacks against Embedded Neural Networks with Laser Injection](https://mlsanity.com/paper/2304.12876/) (2023)
- [Fault Injection on Embedded Neural Networks: Impact of a Single Instruction Skip](https://mlsanity.com/paper/2308.16665/) (2023)
- [Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollers](https://mlsanity.com/paper/2311.01344/) (2023)
- [When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence](https://mlsanity.com/paper/2311.14005/) (2023)
- [A Divide-and-Conquer Strategy for Hard-Label Extraction of Deep Neural Networks via Side-Channel Attacks](https://mlsanity.com/paper/2411.10174/) (2024)
- [The Closing Window: How Governments Could Lose Their Ability to Restrain Advanced AI](https://mlsanity.com/paper/2608.05173/) (2026)
- [Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights](https://mlsanity.com/paper/2610.04436/) (2026)

## Abstract (arXiv)

Model extraction is a major threat for embedded deep neural network models that leverages an extended attack surface. Indeed, by physically accessing a device, an adversary may exploit side-channel leakages to extract critical information of a model (i.e., its architecture or internal parameters). Different adversarial objectives are possible including a fidelity-based scenario where the architecture and parameters are precisely extracted (model cloning). We focus this work on software implementation of deep neural networks embedded in a high-end 32-bit microcontroller (Cortex-M7) and expose several challenges related to fidelity-based parameters extraction through side-channel analysis, from the basic multiplication operation to the feed-forward connection through the layers. To precisely extract the value of parameters represented in the single-precision floating point IEEE-754 standard, we propose an iterative process that is evaluated with both simulations and traces from a Cortex-M7 target. To our knowledge, this work is the first to target such an high-end 32-bit platform. Importantly, we raise and discuss the remaining challenges for the complete extraction of a deep neural network model, more particularly the critical case of biases.