Deploying a neural network on an edge device protects it from ordinary file access, but it does not make the model physically opaque. Inference causes data-dependent electrical activity, and carefully measured power traces can reveal information about the computation.
Our work explores two different ways to use that leakage. They address related security questions, but they should not be treated as the same method.
P2W: unconventional transfer learning
P2W considers a scenario where an existing model runs inside an embedded system-on-chip, direct access to that model is unavailable, and only a limited dataset is available for training a new model.
The method follows this pipeline:
- Capture power traces while the target SoC executes its model on controlled inputs.
- Train an encoder-decoder neural network to translate those traces into an approximate weight matrix.
- Use the recovered matrix to initialize a new model.
- Fine-tune the new model with the limited dataset that is available.
In the evaluated experiments, the average accuracy obtained by training only on the limited dataset was 37%. Initializing with P2W and then fine-tuning on the same data raised the average to 97%; across the reported cases, the approach improved accuracy by up to three times over the corresponding classical training setup.
P2W is therefore best understood as a proof of concept for transferring useful model knowledge through a physical side channel, not as exact bit-for-bit recovery of every parameter.
TraceFormer: extracting individual AIMC weights
TraceFormer targets analog in-memory-computing (AIMC) tiles. It focuses on power leakage from the ADCs that convert analog tile outputs into digital values.
TraceFormer combines:
- a Transformer trained to map ADC power traces to digital output values; and
- an input-controlled technique that isolates the effect of one stored weight at a time.
That combination allows the value of an isolated weight to be inferred from the corresponding ADC power trace. The paper evaluates oscillator-based ADCs emulated on real hardware and reports high accuracy and robustness under the tested operating conditions.
What the results do - and do not - establish
These studies show that power leakage can expose valuable information about an embedded model. They do not imply that every accelerator can be attacked with the same equipment, trace count, or accuracy.
Practical feasibility depends on factors such as:
- physical access and measurement bandwidth;
- control over model inputs;
- the target architecture and converter design;
- voltage, temperature, clocking, and environmental noise;
- any masking, randomization, filtering, or detection mechanisms.
Stating those assumptions matters. A defensible hardware-security result describes the attacker, the measurements, the target, and the limits of the evaluation - not only the headline accuracy.
Design takeaway
Model protection must cover the complete execution path. Encrypting model storage is useful, but weights and intermediate values can still influence observable power while they are being processed. Security reviews for edge-AI accelerators should therefore include physical leakage from memories, data converters, interconnects, and digital compute units.