# Side-Channel Analysis of OpenVINO-based Neural Network Models

arXiv: https://arxiv.org/abs/2407.16467 · HTML: https://mlsanity.com/paper/2407.16467/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 22 references that are in the map.
- First posted on arXiv 23 Jul 2024.

## Builds on (most cited first, 11 of 11)

- [Going Deeper with Convolutions](https://mlsanity.com/paper/1409.4842/) (2014)
- [Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activations](https://mlsanity.com/paper/1609.07061/) (2016)
- [A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects](https://mlsanity.com/paper/2004.02806/) (2020)
- [I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences](https://mlsanity.com/paper/2206.08451/) (2022)
- [SNIFF: Reverse Engineering of Neural Networks with Fault Attacks](https://mlsanity.com/paper/2002.11021/) (2020)
- [Neural Network Compression Framework for fast model inference](https://mlsanity.com/paper/2002.08679/) (2020)
- [MaskedNet: The First Hardware Inference Engine Aiming Power Side-Channel Protection](https://mlsanity.com/paper/1910.13063/) (2019)
- [DeepTheft: Stealing DNN Model Architectures through Power Side Channel](https://mlsanity.com/paper/2309.11894/) (2023)
- [Side-channel attack analysis on in-memory computing architectures](https://mlsanity.com/paper/2209.02792/) (2022)
- [Physical Side-Channel Attacks on Embedded Neural Networks: A Survey](https://mlsanity.com/paper/2110.11290/) (2021)
- [A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks](https://mlsanity.com/paper/2303.18132/) (2023)

## Built on by (most cited first, 4 of 4)

- [Make Shuffling Great Again: A Side-Channel Resistant Fisher-Yates Algorithm for Protecting Neural Networks](https://mlsanity.com/paper/2501.00798/) (2025)
- [Beyond TVLA: Anderson-Darling Leakage Assessment for Neural Network Side-Channel Leakage Detection](https://mlsanity.com/paper/2603.18647/) (2026)
- [Walma: Learning to See Memory Corruption in WebAssembly](https://mlsanity.com/paper/2603.24167/) (2026)
- [Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights](https://mlsanity.com/paper/2610.04436/) (2026)

## Abstract (arXiv)

Embedded devices with neural network accelerators offer great versatility for their users, reducing the need to use cloud-based services. At the same time, they introduce new security challenges in the area of hardware attacks, the most prominent being side-channel analysis (SCA). It was shown that SCA can recover model parameters with a high accuracy, posing a threat to entities that wish to keep their models confidential. In this paper, we explore the susceptibility of quantized models implemented in OpenVINO, an embedded framework for deploying neural networks on embedded and Edge devices. We show that it is possible to recover model parameters with high precision, allowing the recovered model to perform very close to the original one. Our experiments on GoogleNet v1 show only a 1% difference in the Top 1 and a 0.64% difference in the Top 5 accuracies.