Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Double Strike: Breaking Approximation-Based Side-Channel Countermeasures for DNNs

Lorenzo Casalino, Maria Méndez Real, Jean-Christophe Prévotet, Rubén Salvador

TL;DR

This work reveals a fundamental vulnerability in the MACPruning countermeasure, a pruning-based approximate computing approach used to harden DNN implementations against side-channel attacks. By exploiting a control-flow dependency tied to pixel importance, the authors develop a pattern-matching preprocessing pipeline that realigns traces and enables efficient non-profiled CPA-based recovery of weights, achieving up to $96\%$ recovery of important weights in experiments on a Cortex-M4 with an MLP. They also show that unintended microarchitectural leakage can further enable recovery of non-important weights, effectively undermining the security of MACPruning. The results motivate the need for truly control-flow independent defenses and highlight the broader risk that AxC-based countermeasures introduce new leakage channels; the work also provides open-source tooling and traces to spur further research.

Abstract

Deep neural networks (DNNs), which support services such as driving assistants and medical diagnoses, undergo lengthy and expensive training procedures. Therefore, the training's outcome - the DNN weights - represents a significant intellectual property asset to protect. Side-channel analysis (SCA) has recently appeared as an effective approach to recover this confidential asset from DNN implementations. In response, researchers have proposed to defend DNN implementations through classic side-channel countermeasures, at the cost of higher energy consumption, inference time, and resource utilisation. Following a different approach, Ding et al. (HOST'25) introduced MACPRUNING, a novel SCA countermeasure based on pruning, a performance-oriented Approximate Computing technique: at inference time, the implementation randomly prunes (or skips) non-important weights (i.e., with low contribution to the DNN's accuracy) of the first layer, exponentially increasing the side-channel resilience of the protected DNN implementation. However, the original security analysis of MACPRUNING did not consider a control-flow dependency intrinsic to the countermeasure design. This dependency may allow an attacker to circumvent MACPRUNING and recover the weights important to the DNN's accuracy. This paper describes a preprocessing methodology to exploit the above-mentioned control-flow dependency. Through practical experiments on a Chipwhisperer-Lite running a MACPRUNING-protected Multi-Layer Perceptron, we target the first 8 weights of each neuron and recover 96% of the important weights, demonstrating the drastic reduction in security of the protected implementation. Moreover, we show how microarchitectural leakage improves the effectiveness of our methodology, even allowing for the recovery of up to 100% of the targeted non-important weights. Lastly, by adapting our methodology [continue in pdf].

Double Strike: Breaking Approximation-Based Side-Channel Countermeasures for DNNs

TL;DR

This work reveals a fundamental vulnerability in the MACPruning countermeasure, a pruning-based approximate computing approach used to harden DNN implementations against side-channel attacks. By exploiting a control-flow dependency tied to pixel importance, the authors develop a pattern-matching preprocessing pipeline that realigns traces and enables efficient non-profiled CPA-based recovery of weights, achieving up to recovery of important weights in experiments on a Cortex-M4 with an MLP. They also show that unintended microarchitectural leakage can further enable recovery of non-important weights, effectively undermining the security of MACPruning. The results motivate the need for truly control-flow independent defenses and highlight the broader risk that AxC-based countermeasures introduce new leakage channels; the work also provides open-source tooling and traces to spur further research.

Abstract

Deep neural networks (DNNs), which support services such as driving assistants and medical diagnoses, undergo lengthy and expensive training procedures. Therefore, the training's outcome - the DNN weights - represents a significant intellectual property asset to protect. Side-channel analysis (SCA) has recently appeared as an effective approach to recover this confidential asset from DNN implementations. In response, researchers have proposed to defend DNN implementations through classic side-channel countermeasures, at the cost of higher energy consumption, inference time, and resource utilisation. Following a different approach, Ding et al. (HOST'25) introduced MACPRUNING, a novel SCA countermeasure based on pruning, a performance-oriented Approximate Computing technique: at inference time, the implementation randomly prunes (or skips) non-important weights (i.e., with low contribution to the DNN's accuracy) of the first layer, exponentially increasing the side-channel resilience of the protected DNN implementation. However, the original security analysis of MACPRUNING did not consider a control-flow dependency intrinsic to the countermeasure design. This dependency may allow an attacker to circumvent MACPRUNING and recover the weights important to the DNN's accuracy. This paper describes a preprocessing methodology to exploit the above-mentioned control-flow dependency. Through practical experiments on a Chipwhisperer-Lite running a MACPRUNING-protected Multi-Layer Perceptron, we target the first 8 weights of each neuron and recover 96% of the important weights, demonstrating the drastic reduction in security of the protected implementation. Moreover, we show how microarchitectural leakage improves the effectiveness of our methodology, even allowing for the recovery of up to 100% of the targeted non-important weights. Lastly, by adapting our methodology [continue in pdf].
Paper Structure (25 sections, 5 equations, 7 figures, 4 algorithms)

This paper contains 25 sections, 5 equations, 7 figures, 4 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Side-Channel-Driven DNN Weight Recovery
  4. The MACPruning Countermeasure
  5. Exploiting the Control-Flow Dependency
  6. Threat Model
  7. MACPruning Implementation
  8. Control-Flow Dependency
  9. Preprocessing Methodology
  10. Pattern Identification
  11. MACs Classification
  12. Filter Processed Pixels
  13. Important MACs Concatenation
  14. Experimental Evaluation
  15. Experimental Setup
  16. ...and 10 more sections

Figures (7)

  • Figure 1: Application of MACPruning to the $k$-th neuron during two inferences and its effect on the side-channel traces. Solid lines represent important pixels, whereas dashed ones refer to executed non-important pixels. A missing path from pixel to the sum block indicates a skipped non-important pixel.
  • Figure 2: Side-channel patterns associated with important and non-important pixels identified from traces measured during the execution of Listing \ref{['lst:macpruning-implementation']}.
  • Figure 3: The application of the identified patterns to distinguish what mac processes important and non-important pixels. We use $E$, $S$, and $I$ to indicate, respectively, non-important (executed and skipped) and important pixels. We measured the trace during the execution of Listing \ref{['lst:macpruning-implementation']}.
  • Figure 4: Proposed methodology to circumvent the MACPruning countermeasure. This methodology preprocesses the collected side-channel traces before the actual analysis phase (e.g., cpa) and consists of $4$ steps: side-channel patterns identification (A), classification of macs operations (B), filtering out skipped pixels from input images (Step C) and concatenation of the side-channel patterns of important macs (Step D).
  • Figure 5: Mean correlation score (over the $5$ experiments, each consisting of $10$k traces) for weights $w_{3}$ and $w_{7}$ during the execution of the neuron $\#3$. We report the score for the true weight value and the best weight value. We highlight with solid orange lines the mac where the true value scores the best.
  • ...and 2 more figures

Theorems & Definitions (1)

  • proof