# A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks

arXiv: https://arxiv.org/abs/2303.18132 · HTML: https://mlsanity.com/paper/2303.18132/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 21 references that are in the map.
- First posted on arXiv 25 Mar 2023.

## Builds on (most cited first, 7 of 7)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [High Accuracy and High Fidelity Extraction of Neural Networks](https://mlsanity.com/paper/1909.01838/) (2019)
- [SNIFF: Reverse Engineering of Neural Networks with Fault Attacks](https://mlsanity.com/paper/2002.11021/) (2020)
- [MaskedNet: The First Hardware Inference Engine Aiming Power Side-Channel Protection](https://mlsanity.com/paper/1910.13063/) (2019)
- [BoMaNet: Boolean Masking of an Entire Neural Network](https://mlsanity.com/paper/2006.09532/) (2020)
- [Guarding Machine Learning Hardware Against Physical Side-Channel Attacks](https://mlsanity.com/paper/2109.00187/) (2021)
- [HWGN2: Side-channel Protected Neural Networks through Secure and Private Function Evaluation](https://mlsanity.com/paper/2208.03806/) (2022)

## Built on by (most cited first, 5 of 5)

- [Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference](https://mlsanity.com/paper/2508.08438/) (2025)
- [Side-Channel Analysis of OpenVINO-based Neural Network Models](https://mlsanity.com/paper/2407.16467/) (2024)
- [Make Shuffling Great Again: A Side-Channel Resistant Fisher-Yates Algorithm for Protecting Neural Networks](https://mlsanity.com/paper/2501.00798/) (2025)
- [Beyond TVLA: Anderson-Darling Leakage Assessment for Neural Network Side-Channel Leakage Detection](https://mlsanity.com/paper/2603.18647/) (2026)
- [A Constant-Time Implementation Methodology for Activation Functions on Microcontrollers](https://mlsanity.com/paper/2605.22441/) (2026)

## Abstract (arXiv)

Model extraction attacks have been widely applied, which can normally be used to recover confidential parameters of neural networks for multiple layers. Recently, side-channel analysis of neural networks allows parameter extraction even for networks with several multiple deep layers with high effectiveness. It is therefore of interest to implement a certain level of protection against these attacks. In this paper, we propose a desynchronization-based countermeasure that makes the timing analysis of activation functions harder. We analyze the timing properties of several activation functions and design the desynchronization in a way that the dependency on the input and the activation type is hidden. We experimentally verify the effectiveness of the countermeasure on a 32-bit ARM Cortex-M4 microcontroller and employ a t-test to show the side-channel information leakage. The overhead ultimately depends on the number of neurons in the fully-connected layer, for example, in the case of 4096 neurons in VGG-19, the overheads are between 2.8% and 11%.