Analog In-Memory Computing (AIMC) reduces data movement by performing matrix-vector operations close to where neural-network weights are stored. This can improve latency and energy efficiency for suitable inference workloads, but it also changes the hardware attack surface.
My PhD research asks a practical question: what can an attacker learn from the physical behavior of an AIMC accelerator, even without direct access to the stored model?
Where the leakage comes from
An AIMC tile stores weights as conductance values and produces analog computation results. Those results must normally pass through analog-to-digital converters (ADCs) before the rest of a digital system can use them.
The ADCs switch transistors in a data-dependent way. Their power consumption can therefore contain information about the digital values they produce. If an attacker can provide chosen inputs and measure the corresponding power traces, the ADC can become a side-channel leakage point.
This is important because model weights are valuable intellectual property. Recovering them may enable model cloning or support follow-on analysis of the model and its implementation.
TraceFormer: isolating and extracting weights
In TraceFormer, we study this leakage through a two-phase method:
- A Transformer model learns to translate captured ADC power traces into digital output values.
- An input-controlled isolation technique exposes the contribution of one stored weight at a time, allowing its value to be inferred from the ADC trace.
The experiments use oscillator-based ADCs emulated on real hardware and evaluate the method under different operating conditions. The results demonstrate that ADC power leakage can reveal weights stored in an AIMC tile with high accuracy and robustness in the evaluated setup.
This is a physical side-channel attack, not a remote software exploit. Its feasibility depends on the attacker’s measurement access, ability to control inputs, the target ADC design, noise, and the countermeasures implemented by the system.
A related path: power traces as transferable knowledge
P2W explores a related but distinct idea. Instead of using a Transformer to recover one AIMC weight at a time, P2W trains an encoder-decoder neural network to translate power traces from an embedded SoC into an approximate weight matrix. That matrix initializes a new model when only a limited training dataset is available.
Together, the two studies show why model protection cannot stop at encrypting a file at rest. The full inference path - memory cells, converters, interconnects, and digital processing - needs to be considered.
Security design implications
Potential defenses should be evaluated against a defined threat model and measured on the target hardware. Relevant research directions include:
- reducing data-dependent power leakage in ADCs and peripheral circuits;
- randomizing operation order or timing where real-time constraints permit it;
- masking or encoding sensitive intermediate values;
- detecting abnormal measurement or chosen-input behavior;
- testing security across voltage, temperature, process variation, and realistic noise.
Each countermeasure has costs in area, latency, energy, accuracy, or design complexity. The useful engineering question is therefore not whether AIMC can be made “secure” in the abstract, but which protections reduce a specific risk to an acceptable level without erasing AIMC’s efficiency benefits.