# Power Side-Channel Membership Inference Attack on Embedded Machine Learning

arXiv: https://arxiv.org/abs/2610.10909 · HTML: https://mlsanity.com/paper/2610.10909/

## Key facts

- No citing papers in the map yet (data through 7 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- Builds on 10 of its 51 references that are in the map.
- First posted on arXiv 7 Oct 2026.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Builds on (most cited first, 10 of 10)

- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models](https://mlsanity.com/paper/1806.01246/) (2018)
- [MLPerf Tiny Benchmark](https://mlsanity.com/paper/2106.07597/) (2021)
- [LOGAN: Membership Inference Attacks Against Generative Models](https://mlsanity.com/paper/1705.07663/) (2017)
- [TinyML for Ubiquitous Edge AI](https://mlsanity.com/paper/2102.01255/) (2021)
- [CINIC-10 is not ImageNet or CIFAR-10](https://mlsanity.com/paper/1810.03505/) (2018)
- [Information Leakage through Physical Layer Supply Voltage Coupling Vulnerability](https://mlsanity.com/paper/2403.08132/) (2024)
- [SleepWalk: Exploiting Context Switching and Residual Power for Physical Side-Channel Attacks](https://mlsanity.com/paper/2507.22306/) (2025)
- [Application-Specific Power Side-Channel Attacks and Countermeasures: A Survey](https://mlsanity.com/paper/2512.23785/) (2025)
- [Sleep Reveals the Nonce: Breaking ECDSA using Sleep-Based Power Side-Channel Vulnerability](https://mlsanity.com/paper/2602.01491/) (2026)

## Abstract (arXiv)

Membership inference attacks (MIAs) threaten the privacy of machine learning (ML) training data by determining whether a sample was used to train a target model. Existing MIAs rely on model outputs, ranging from prediction probabilities to predicted labels, an assumption that can be restrictive for on-device ML systems with limited or inaccessible outputs. However, suppressing model outputs does not eliminate the data-dependent computations that produce them, which may remain observable through physical side channels. We present PSCMIA, a power side-channel membership inference attack against embedded ML models that can infer membership directly from power traces without requiring prediction probabilities or even the predicted labels. We evaluate PSCMIA across multiple datasets (MNIST, FMNIST, CIFAR10, CINIC10), fully connected (FC) and convolutional neural network (CNN) architectures, and two embedded platforms (STM32F3, XMEGA). PSCMIA achieves ROC-AUC values of up to 0.907 on FC models. For CNN models, the ROC-AUC gap between PSCMIA and probability vector-based shadow MIA ranges from 0.006 to 0.116. Across the FC and CNN evaluations, PSCMIA outperforms label-only MIA in 11 of 16 model-dataset-hardware configurations, demonstrating that physical execution can expose membership information even when conventional model outputs are unavailable through unintended power side-channel leakage.