September 2022 – February 2026 · 42 months · grant agreement 101070634 · 14 partners in nine countries.
NeuroSoC set out to build a flexible computing system in which an analog in-memory-computing neural processing unit is integrated into a multi-processor, functionally safe and secure system-on-chip. The prototype combines a phase-change-memory (PCM) based analog in-memory computing unit with RISC-V processors in 28 nm FD-SOI technology, targeting more than a hundred-fold gains in energy efficiency and compute density for edge-AI workloads.
Leiden University was responsible for the security assessment of the system-on-chip. That work sat in the same work package as IBM and STMicroelectronics, with ST teams in France and Italy, and the closest day-to-day collaboration on the security task was with STMicroelectronics France. My PhD work covers the physical side of the assessment: what the analog compute tiles and their data converters leak through power consumption, how far model weights can be reconstructed from that leakage, and what this means for protecting machine-learning models on the chip.
Built the measurement and analysis pipeline for oscillator-based ADCs, the interface between analog compute tiles and the digital system, and showed that their power traces carry the digital output values.
Combined a Transformer that maps ADC power traces to output values with an input-controlled weight-isolation technique that exposes one stored weight at a time. Published at Euromicro DSD 2025.
Showed that power traces captured from an embedded SoC can be translated into an approximate weight matrix that gives a new model a head start when training data is scarce. Published at ACM SAC 2026.
Co-authored an evaluation of how CNN partitioning strategies expose input data to an eavesdropper on the link between edge devices. Published at SPACE 2025.
Shows that the weights stored in an analog in-memory computing tile can be recovered from the power consumption of its ADCs, using a Transformer and an input-controlled weight-isolation technique.
Turns power traces captured from an embedded SoC into an approximate weight matrix that initialises a new model when the original model and its training data are out of reach.
Compares vertical, horizontal, and data partitioning of CNNs across edge devices against an eavesdropper who reconstructs the input image from intercepted intermediate data.
Official NeuroSoC video. It loads from YouTube only when you press play.
14 beneficiaries, listed as on the project website. The security assessment was Leiden University’s responsibility; security assessment work package, shared with IBM and STMicroelectronics (France and Italy). Closest collaboration on the security task: STMicroelectronics France.
Industry
Academia
