Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollers

TL;DR

This work demonstrates that architectural details of DNNs deployed on 32-bit microcontrollers can be extracted from simple EM side-channel traces without extensive profiling. By examining CMSIS-NN based execution of CNNs and MLPs, the authors reveal a Russian doll effect where single EM patterns map to layer hyper-parameters such as $H_{out}$, $K$, $Z$, $S$, $P$, $Z_{pool}$, and $N_e$, enabling stepwise reconstruction of the full architecture. The key contributions include a practical extraction methodology, empirical validation on MNIST and CIFAR-10 models, and a discussion of the implications for security and the urgent need for architecture-obfuscation defenses on constrained devices. The findings indicate that protecting model architecture on edge devices is critical for robust AI security in regulated and safety-critical deployments.

Abstract

Model extraction is a growing concern for the security of AI systems. For deep neural network models, the architecture is the most important information an adversary aims to recover. Being a sequence of repeated computation blocks, neural network models deployed on edge-devices will generate distinctive side-channel leakages. The latter can be exploited to extract critical information when targeted platforms are physically accessible. By combining theoretical knowledge about deep learning practices and analysis of a widespread implementation library (ARM CMSIS-NN), our purpose is to answer this critical question: how far can we extract architecture information by simply examining an EM side-channel trace? For the first time, we propose an extraction methodology for traditional MLP and CNN models running on a high-end 32-bit microcontroller (Cortex-M7) that relies only on simple pattern recognition analysis. Despite few challenging cases, we claim that, contrary to parameters extraction, the complexity of the attack is relatively low and we highlight the urgent need for practicable protections that could fit the strong memory and latency requirements of such platforms.

Figures (9)

• Figure 1: Detailed architecture of considered models. Various conv. implementations are detailed in Section \ref{['exp_section:conv_overview']}
• Figure 2: Overviews of conv. layers EM activity related to $H_{out}$
• Figure 3: Single GeMM execution traces with zoom for MNIST conv. layers
• Figure 4: Zoom in Matrix-product EM activity with kernels of size $Z=3$
• Figure 5: MaxPool layers of CNN models