{"id":"f74f3436-fd90-495e-9a0f-786ff18e6e97","arxiv_id":"2501.14512","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A profiling attack called ScaAR uses deep learning on electromagnetic traces to recover input and output class labels from neural networks on real edge devices, and shows initial evidence that LLM output tokens leak through EM emissions.","lead":"This paper shows that electromagnetic emissions from FPGAs and Raspberry Pis running neural networks can reveal which class of input a user supplied, such as recognizing a dog image, without the attacker knowing the network's internals. It also provides a first look at how the same emissions from a small language model on a Raspberry Pi leak information about the words it generates.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Acquisition-order confounding is not addressed: if traces were collected class-by-class, reported accuracies may reflect drift rather than EM leakage; a randomized-order rerun is needed.","rationale":"The paper's central claim is that a profiled DL adversary can recover coarse private attributes from EM traces of unmodified edge devices. That claim stands or falls on whether the class-discriminative signal in the traces comes from the NN computation rather than from the measurement protocol. In profiled side-channel analysis, randomized acquisition order is a standard control precisely because oscilloscope baselines, probe coupling, and device temperature drift on timescales comparable to trace-collection runs. The manuscript never states that this control was used. If it was not, a CNN trained on raw traces can easily exploit the resulting class-correlated drift; t-SNE separability and TVLA |t| values would also be inflated. This threat is more load-bearing than the cross-device generalization issue identified by the reader, because it affects every classifier experiment in Table 5 and Table 6, not just the scope of the generalization claim. The cross-session experiment is not a sufficient control unless class ordering was randomized in both sessions, and the untrained-CNN experiment is not a sufficient control because the trace structure and drift behavior differ. I therefore recommend keeping the conditional verdict, with the explicit condition that the authors provide or run a randomized-order acquisition. This is not an accusation; it is a missing methodological detail that could be resolved by a single experiment.","tokens_in":19159,"tokens_out":9553,"duration_ms":94136,"concrete_test":"Rerun the ZCU104 CNN3-on-MNIST experiment (or, cheaper, LeNet5/MNIST) with all class labels randomly interleaved during acquisition, using the same trigger, probe, and model as Section 6.1, and report attack accuracy on a held-out interleaved test set. If the accuracy drops to chance (about 10%) or substantially below Table 5, the reported accuracies are confounded by acquisition order. If accuracy remains near 80%, the EM leakage is genuine and the concern is resolved. To make the control airtight, also randomize class order independently in the profiling and attack sessions and verify that the trained model still transfers.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing threat to the central claim is not the profiling-device assumption but the absence of any stated randomization of acquisition order. Section 5.1.4 describes collecting one trace per inference and splitting traces 90/10 for profiling and attack, but it never states that traces from different classes were interleaved or randomized. If traces were collected class-block by class-block, a CNN attack model can learn slow time-domain artifacts (probe settling, thermal drift, oscilloscope baseline wander) that are correlated with class through acquisition time; the reported 80-96% accuracies in Table 5 would then not demonstrate computation-dependent EM leakage of user interactions. The cross-session result in Section 6.5 does not control for this if the same class ordering was reused across sessions, and the TVLA/t-SNE analyses inherit the same possible confound. The untrained-CNN control in Section 6.5 is not a full control: untrained implementations have a different trace structure and may not carry the same drift signature, so it does not rule out acquisition-order leakage for trained models. This concern is concrete and testable rather than speculative: the paper simply does not report the acquisition schedule.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ScaAR, a profiled deep-learning side-channel attack that recovers class-level attributes of the inputs and outputs of neural network classifiers from electromagnetic (EM) emissions of physical edge devices. The authors evaluate ScaAR on an AMD-Xilinx ZCU104 FPGA, a Raspberry Pi 3 B, and, for LLM pilot experiments, a Raspberry Pi 5. They report high attribute-extraction accuracies on MNIST, CIFAR-10, and ImageNet-10 (for example, 92.8% for ResNet18 on MNIST traces), identify the first convolution as the likely leak location via TVLA and Grad-CAM, and report a cross-session accuracy of 80.0% for CNN3 on MNIST. The paper also presents a preliminary LLM study showing that EM traces differ with output token count and that two intermediate tokens can be distinguished by a t-test.","tokens_in":19302,"tokens_out":3793,"duration_ms":35801,"significance":"If the reported leakage is genuine, the paper makes a useful contribution: it demonstrates that a profiled DLSCA classifier can extract coarse private attributes from unmodified edge devices using single, unaligned EM traces, without knowledge of the network weights or implementation details. The real-hardware evaluation across multiple devices, models, and datasets is a strength, as are the convergent TVLA and Grad-CAM analyses and the cross-session experiment. The LLM pilot, while preliminary, points to an important emerging target. The main weakness is that the paper does not report the trace-acquisition order, so a time-correlated artifact cannot be excluded, and the central 'implementation-agnostic' claim is stronger than the experiments support.","major_comments":[{"comment":"The trace acquisition procedure is described without stating whether traces from different classes were interleaved or randomized. If traces were collected class-by-class, the profiled CNN could learn slow time-domain artifacts (probe settling, thermal drift, oscilloscope baseline wander, or voltage/frequency scaling) that are correlated with class through acquisition time, and the accuracies in Tables 5 and 6 would not demonstrate computation-dependent EM leakage. The untrained-CNN control in Section 6.5 is not a full control, because untrained implementations have a different trace structure and may not carry the same acquisition-order signature. Please report the acquisition schedule and rerun at least one configuration with randomized or interleaved class order; this is load-bearing for the central leakage claim.","section":"Section 5.1.4"},{"comment":"The paper claims that ScaAR is 'implementation-agnostic' and generalizable, but the only generalization experiment profiles and attacks the same physical ZCU104 board running the same CNN3 model across two measurement sessions. Table 5 shows results on different devices, but each row trains and tests on the same device and implementation; there is no experiment in which a model trained on one device or implementation is applied to traces from a different device or implementation. Please either add a cross-device or cross-implementation transfer experiment, or revise the claim to accurately describe the demonstrated scope.","section":"Abstract and Section 6.5"},{"comment":"The LLM token-distinguishability claim is supported only by a single t-test comparing two intermediate tokens ('H' and 'Sad') in Figure 11, together with an observation that longer outputs produce longer traces. This does not substantiate the abstract's statement that 'different LLM tokens can be distinguishable from the EM traces' as a general capability. For a pilot study, the paper should either report multi-class token classification accuracy over a larger token set or explicitly state that only pairwise distinguishability for one example is demonstrated.","section":"Section 7"},{"comment":"Section 4.2.2 states that the adversary does not have knowledge of the parameters, input, or output of the deployed target neural network, but Section 6.6 introduces the additional assumption that the adversary can access the output label during profiling to annotate traces for output attribute extraction. This should be reconciled by clearly presenting output attribute extraction as an extended threat model with a modified adversary capability, rather than under the original threat model.","section":"Sections 4.2.2 and 6.6"}],"minor_comments":[{"comment":"There are several typos: 'implementation-agonistic' should be 'implementation-agnostic', 'it's' should be 'its', and 'dont' should be 'don't'.","section":"Sections 4.2.2 and 4.3"},{"comment":"The last row labels the attack as 'SCAR (OURS)', which is inconsistent with the name 'ScaAR' used in the text and elsewhere in the paper.","section":"Table 2"},{"comment":"The sentence 'from the PL unit we can get a clear trigger signal from The EM signals are highly distinguishable...' is grammatically incomplete and should be rewritten.","section":"Section 5.1.4"},{"comment":"References [7] and [8] are duplicate entries for the same template-attacks paper; one should be removed or the citation should be disambiguated.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The empirical core is worth publishing after the acquisition-order issue is resolved and the generalization claims are calibrated. The missing randomization is a concrete, fixable experimental-reporting problem rather than an inherent flaw in the approach, so I am not recommending rejection. The paper would also benefit from a data-availability statement, as no code or traces are currently offered for reproduction."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things up front. First, this is the first demonstration I know of that profiled DLSCA can recover class-level input and output attributes from unmodified commercial edge devices over EM, and the RPi5/Qwen2 token-distinguishability is a genuinely new datapoint. Second, the paper overclaims: 'implementation-agnostic' is not supported by the experiments, and the acquisition-order confound is unaddressed. Neither kills the result, but both need to be fixed before I'd trust the strong version.\n\nWhat's good: the threat-model refinement is sensible—attribute extraction rather than pixel-perfect input recovery is the right framing for real privacy harm. They cover two very different platforms, four datasets, several model architectures, and they report a cross-session same-board test (84.4% profiling to 80.0% attack). TVLA and Grad-CAM agree on the first convolution as the leak point, which is internally consistent. The untrained-CNN control is a reasonable attempt to separate implementation leakage from input-data leakage. Single-trace, no-averaging acquisition is the practically honest setting.\n\nWhere it's soft. The biggest gap is that the paper never states whether traces from different classes were interleaved or randomized during acquisition. If they were collected class-by-class, the attack model could be learning slow drift—probe settling, thermal effects, oscilloscope baseline wander—rather than computation-dependent EM leakage. The cross-session result does not control for this if the same ordering was reused. This is concrete and testable; the paper just doesn't report the schedule. The untrained-CNN control is not a full control for that confound. I'd want a randomized-order rerun before the headline result is treated as established.\n\nSecond, the 'implementation-agnostic' language in the abstract overreaches. The only generalization experiment is cross-session on the same physical ZCU104 board running the same CNN3 model, not across devices or across implementations. The claim should be scoped to 'same device class, re-mounted measurement.'\n\nThird, there are no error bars, no baselines vs. chance, and no code/data release. Some accuracies (e.g., 45.6% on MNIST MLP) are close to what you'd expect from a weak prior, so per-configuration confidence intervals matter. The LLM section is explicitly preliminary: one model, one prompt, two tokens, and a t-test rather than a trained classifier. Fine as a pilot, not as a full attack evaluation.\n\nThe citation pattern is fine—they engage the prior input-recovery and DLSCA literature directly, and the attribution to Power2Pic for shared threat model looks right.\n\nVerdict: this deserves a serious referee. It is a solid proof-of-concept with a novel target, and the weaknesses are fixable with more transparent acquisition details and broader generalization tests. I'd send it out, but with the expectation of major revision.","headline":"First solid evidence that profiled DLSCA can pull class-level interaction attributes from unmodified edge devices over EM, including edge-LLM tokens; the strong 'implementation-agnostic' claim and missing acquisition-order controls are the main things standing between this and a fully convincing paper.","tokens_in":19914,"tokens_out":2742,"would_cite":true,"duration_ms":25253,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"EM emissions from edge AI devices leak private user-interaction attributes.","keywords":["electromagnetic side channel","deep learning side-channel analysis","attribute extraction","edge AI privacy","neural network inference leakage","LLM side-channel attack","FPGA security","Raspberry Pi"],"falsifier":"Run ScaAR with profiling done on one physical unit of a board, or one firmware version, and the attack on a different unit or firmware of the same model; if classification accuracy drops to chance, the implementation-agnostic claim fails. Alternatively, run two inference tasks concurrently on the target and check whether the per-task attributes are still recoverable from the mixed EM trace.","tokens_in":18908,"feed_emoji":"📡","tokens_out":6711,"duration_ms":57993,"temperature":0.7,"pith_summary":"This paper tries to show that the privacy of user interactions with neural-network edge devices is not protected at the implementation level: electromagnetic emissions alone reveal private attributes of what the device is computing. It proposes ScaAR, a profiled deep-learning side-channel attack that trains a small convolutional network on raw EM traces annotated with class labels, then predicts the class of inputs or outputs on a target device without knowing the network weights or the hardware design. The authors demonstrate the attack on a commercial FPGA and several Raspberry Pi models across multiple datasets and model architectures, and they provide a first look at edge large language models, where trace length reveals output token count and different tokens can be distinguished. If the paper is right, a nearby passive adversary can learn sensitive attributes about what a user is doing with an AI device, from image content to conversational text.","feed_headline":"EM emissions leak private attributes from edge AI devices","feed_subtitle":"A trained model recovers input and output class labels from FPGAs and Raspberry Pis, and even LLM tokens.","key_machinery":"The mechanism is data-dependent computation: the amount of work a neural network performs during inference varies with the data it processes, and this variation is visible in the device's electromagnetic emissions. On the FPGA the authors observe the effect of zero-skipping, where all-zero inputs produce clearly different traces from random images. ScaAR turns this leakage into a classification problem: a one-dimensional convolutional network is trained on raw, unaligned, non-averaged EM traces annotated with the class of the interaction, and the trained network is then applied to traces captured from the target. TVLA and Grad-CAM analyses both point to the first convolution as the main leak point, indicating that the leakage comes from the neural network implementation itself rather than from the input bus.","core_discovery":"The paper claims that electromagnetic emanations from unmodified edge devices running neural networks carry enough information to identify private attributes of user interactions, and that a profiled deep-learning classifier can extract those attributes without knowing the model weights, the accelerator design, or the software implementation. The proposed attack, ScaAR, is trained on raw EM traces annotated only with class labels and then predicts the class of inputs or outputs on a target device. On the AMD-Xilinx MPSoC ZCU104 FPGA and Raspberry Pi 3 B, ScaAR recovers input class labels across MNIST, CIFAR-10, and ImageNet-10 for MLP, CNN, and ResNet models, with the highest reported input accuracy at 96.3 percent on the Raspberry Pi; it also recovers output class labels, sometimes more accurately than input labels. For edge LLMs on the Raspberry Pi 5 running Qwen2-0.5B, the paper reports that EM trace length reveals the number of generated tokens and that different intermediate tokens can be distinguished by a t-test, making token-level leakage visible.","pith_inferences":["If the transferability holds across board revisions and firmware versions, the same method could likely recover finer-grained attributes, such as medical condition, age group, or spoken keywords, from any device whose computation depends on those attributes.","The LLM token-level result implies that the iterative token-by-token generation process is a repeating side-channel oracle: every output token is reprocessed as input, so an eavesdropper could potentially reconstruct prompts or responses one token at a time.","The paper does not evaluate countermeasures; a natural next question is whether constant-time or constant-power inference, masking, or noise injection can suppress the leakage without destroying edge accelerator performance.","Because the experiments show cross-session but not cross-device transfer, the strongest reading of implementation-agnostic is still a hypothesis; testing on multiple physical units and different compiler stacks would settle how far the method generalizes."],"forward_implications":["A passive adversary with physical proximity can recover private attributes from unmodified edge devices, with no need for trace averaging, clock-cycle alignment, or knowledge of the network parameters.","Because the same profiling pipeline transfers across an FPGA and two Raspberry Pi models, several datasets, and several network architectures, the leakage appears to be a property of data-dependent neural-network computation rather than of one specific accelerator.","Edge LLM deployments inherit the risk: token count is visible in trace length, and individual intermediate tokens can be distinguished, so conversational content may be at risk from EM eavesdropping.","Output attribute extraction can be combined with model-extraction techniques, giving an adversary in physical proximity a stronger way to learn about the deployed model without ever querying it.","The methodology can be used as a standard side-channel evaluation step when building or selecting secure machine-learning hardware."],"supporting_citations":[{"why":"supplies the single-shot side-channel input-recovery baseline that ScaAR generalizes from explicit inputs to interaction attributes.","marker":"[5]"},{"why":"documents power and timing side-channel input recovery on embedded neural networks, whose implementation-specific assumptions ScaAR removes.","marker":"[50]"},{"why":"provides the Power2Pic profiled input-recovery attack sharing the implementation-agnostic threat model and the GAN baseline ScaAR avoids.","marker":"[28]"},{"why":"pioneered power side-channel attacks on CNN accelerators with hard-threshold pixel extraction, a contrast case for ScaAR's threshold-free design.","marker":"[80]"},{"why":"defines the TVLA leakage-assessment method used to locate class-dependent EM leakage in the traces.","marker":"[65]"},{"why":"supplies the one-dimensional CNN architecture used as the DLSCA attack model.","marker":"[70]"},{"why":"offers the transformer-based GPAM deep-learning side-channel method compared as an alternative attack model.","marker":"[6]"},{"why":"shows EM side channels can reverse-engineer neural-network architectures, motivating the implementation-level privacy threat.","marker":"[4]"}],"fun_headline_variants":["Electromagnetic side channel leaks user interactions from edge AI","EM emissions from edge AI reveal private inputs and outputs","ScaAR attack reads edge AI interactions via electromagnetic leaks","LLM tokens leak from Raspberry Pi via electromagnetic side channel","Electromagnetic side channel exposes private interactions on edge AI devices"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack succeeds only if the adversary can profile a device sufficiently similar to the victim's, collecting EM traces with known class labels for every user interaction, and if that profile transfers to the actual target.","fun_headline_variants_meta":{"raw":{"variants":["Electromagnetic side channel leaks user interactions from edge AI","EM emissions from edge AI reveal private inputs and outputs","ScaAR attack reads edge AI interactions via electromagnetic leaks","LLM tokens leak from Raspberry Pi via electromagnetic side channel","Electromagnetic side channel exposes private interactions on edge AI devices"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000591,"raw_usage":{"total_tokens":2814,"prompt_tokens":1030,"completion_tokens":1784,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":646,"completion_tokens_details":{"reasoning_tokens":1705}},"tokens_in":646,"tokens_out":1784,"duration_ms":10877,"temperature":1.0,"reasoning_tokens":1705,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:04:35.331229+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run ScaAR with profiling done on one physical unit of a board, or one firmware version, and the attack on a different unit or firmware of the same model; if classification accuracy drops to chance, the implementation-agnostic claim fails. Alternatively, run two inference tasks concurrently on the target and check whether the per-task attributes are still recoverable from the mixed EM trace.","supporting_citations":[{"cited_title":"Leaky nets: Recovering embedded neural network models and inputs through simple power and timing side-channels—attacks and defenses","cited_arxiv_id":null,"evidence_quote":"documents power and timing side-channel input recovery on embedded neural networks, whose implementation-specific assumptions ScaAR removes."},{"cited_title":"Power2picture: Using generative cnns for input recovery of neural network accelerators through power side- channels on fpgas","cited_arxiv_id":null,"evidence_quote":"provides the Power2Pic profiled input-recovery attack sharing the implementation-agnostic threat model and the GAN baseline ScaAR avoids."},{"cited_title":"I know what you see: Power side-channel attack on convolutional neural network accelerators","cited_arxiv_id":null,"evidence_quote":"pioneered power side-channel attacks on CNN accelerators with hard-threshold pixel extraction, a contrast case for ScaAR's threshold-free design."},{"cited_title":"Leakage assessment methodology: A clear roadmap for side- channel evaluations","cited_arxiv_id":null,"evidence_quote":"defines the TVLA leakage-assessment method used to locate class-dependent EM leakage in the traces."},{"cited_title":"X-vectors: Robust dnn embeddings for speaker recognition","cited_arxiv_id":null,"evidence_quote":"supplies the one-dimensional CNN architecture used as the DLSCA attack model."}],"review_version":1}