Pith. sign in

REVIEW 5 minor 52 references

Deep-learning hardware leaks model architecture, weights and inputs through power, EM, cache and timing side channels, and current defenses leave major gaps.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-07-11 21:59 UTC pith:KS7LI3ZM

load-bearing objection Solid, usable survey of DL hardware SCAs with a clear taxonomy and concrete case studies; incremental novelty but no load-bearing flaws.

arxiv 2607.04055 v1 pith:KS7LI3ZM submitted 2026-07-04 cs.CR

Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures

Zahra Mohammadi , Mona Hashemi , Siamak Mohammadi This is my paper
classification cs.CR
keywords Side-Channel AttacksDeep Learning ModelsModel Reverse EngineeringIntellectual PropertySide-Channel ProtectionModel SecurityHardware SecurityCache Timing
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Deep learning models are valuable intellectual property and privacy-sensitive assets, yet the CPUs, GPUs, FPGAs and accelerators that run them were built for performance, not side-channel resistance. This survey shows that passive observation of power draw, electromagnetic emissions, cache timing, memory-access patterns or GPU context-switch latency is enough for an attacker to reconstruct network topology, recover trained parameters and even steal private inputs. It organises the attack surface into a taxonomy by leakage source, access model and objective, then walks through concrete case studies on commercial hardware. Existing countermeasures such as masking, balanced logic, cache partitioning and runtime detection are catalogued together with their area, power and latency costs, revealing that none yet provide comprehensive protection. The paper therefore argues that systematic, cross-layer defences and evaluation of newer architectures remain urgent open problems.

Core claim

Hardware side-channel attacks can extract deep-learning model architecture, parameters and inputs by observing physical and micro-architectural leakage, and the defences surveyed so far leave significant residual vulnerabilities that must be closed by future research.

What carries the argument

The unified taxonomy of Figure 1 that classifies every attack by leakage source (cache, memory, timing, power, EM, context-switch), adversary access (passive/active, physical/remote), target platform and objective (architecture/parameters/inputs), thereby organising the entire literature and exposing the gaps.

Load-bearing premise

The literature-search method that privileges high-citation and recent papers and then samples only about thirty to forty studies is assumed to give complete, unbiased coverage of the attack surface.

What would settle it

Discovery of a high-impact side-channel attack or defence on deep-learning hardware that falls outside every category of the paper’s taxonomy and was published in a major venue before mid-2025 would show that the survey’s coverage and gap analysis are incomplete.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Model owners must treat physical and micro-architectural leakage as first-class threats equivalent to software model extraction.
  • Cloud multi-tenant GPU and FPGA platforms require isolation mechanisms that specifically block cache, power and context-switch channels.
  • Edge and IoT deployments need low-overhead power/EM countermeasures that fit resource-constrained devices.
  • Transformer and other emerging architectures will inherit the same leakage vectors unless new defences are designed for them.
  • Watermarking schemes that claim IP protection must be re-evaluated against power, cache and timing extraction attacks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the taxonomy already links architecture recovery to model stealing and input recovery to privacy breaches, any future SCA-resistant accelerator must simultaneously protect all three objectives or the remaining unprotected channel will still enable the post-extraction abuses listed in Table 1.
  • The heavy reliance on chosen-input DPA/CEMA for weight recovery implies that simply randomising or encrypting the input interface could raise the cost of parameter extraction far more than masking alone.
  • Runtime detection pipelines developed for cryptographic caches can be repurposed almost unchanged for DNN executables, giving an immediately deployable first line of defence while hardware redesigns mature.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 5 minor

Summary. This survey paper organizes the landscape of hardware side-channel attacks (SCAs) against deep-learning models. It classifies leakage sources (cache, memory, timing, power, EM, context-switch), adversary capabilities (passive/active, physical/remote), and attacker objectives (architecture, parameters, inputs), then maps those objectives to post-extraction abuses (Table 1). Section 2 surveys DL hardware platforms (CPUs, GPUs, FPGAs, custom accelerators) and their characteristic leakages; Section 3 presents detailed case studies of representative attacks (SPA/DPA pipelines, BarraCUDA EM analysis, Cache Telepathy, DeepCache, memory-access reverse-engineering, Leaky DNN context-switch attacks); Section 4 reviews defenses (masking, hiding, randomization, noise injection, cache partitioning/randomization, dummy operations, runtime detection) and summarizes them with overheads in Table 2; Section 5 lists open directions (Transformers/LSTMs, hybrid HW/SW surfaces, SCA-resilient watermarking). The central claim is taxonomic and descriptive: hardware SCAs can extract model architecture, parameters and inputs, and existing defenses leave significant residual gaps.

Significance. The paper fills a genuine gap. While SCAs on cryptographic hardware are mature, the DL-specific literature has been scattered across power/EM, cache, and GPU context-switch papers. The unified taxonomy (Figure 1), the concrete attack pipelines in §3, and the defense-to-leakage mapping in Table 2 give practitioners and researchers a single reference that makes the threat surface and residual gaps explicit. The work is timely given the rapid deployment of MLaaS and edge AI accelerators. Strengths include the systematic literature-search description (§1.4), the clear separation of leakage sources from objectives, and the explicit call-outs of open problems (Transformers, hybrid surfaces, watermarking under SCA). No machine-checked proofs or new experimental results are claimed; the contribution is organizational and synthetic, which is appropriate for a survey.

minor comments (5)
  1. §1.4 states that the survey concentrates on ~30–40 representative studies from 2020–2025. A short explicit list (or a table) of the included papers, perhaps as an appendix, would make the coverage claim fully auditable and help readers locate the primary sources.
  2. Table 2 lists overheads qualitatively (“Latency↑, moderate power overhead”). Where the cited papers report concrete numbers (area %, energy %, throughput loss), adding those figures would strengthen the comparison without changing the table structure.
  3. Several 2025 arXiv preprints are cited ([13], [14], [17], etc.). A brief note that these works are not yet peer-reviewed would help readers calibrate confidence.
  4. Figure 1 is referenced early but its caption and visual layout are not described in the text. A one-sentence walk-through of the taxonomy axes would improve accessibility.
  5. Minor typographical issues: missing spaces after some citations, occasional hyphenation inconsistencies (“side-channel” vs “side channel”), and a few incomplete sentences in the author biographies. These are easily fixed in copy-editing.

Circularity Check

0 steps flagged

No circularity: pure survey with no derivation, fit, or self-referential claim that reduces to its inputs.

full rationale

This paper is a literature survey of hardware side-channel attacks and defenses on deep-learning models. It constructs a taxonomy (Figure 1), reviews representative attacks by leakage source (power/EM, cache/timing, memory access, GPU context-switch) in §3, maps defenses in Table 2 / §4, and lists open problems in §5. There are no equations, no fitted parameters, no uniqueness theorems, and no claimed first-principles predictions. Citations are used only as evidence of prior empirical attacks (Cache Telepathy, DeepCache, BarraCUDA, Leaky DNN, etc.); none of the load-bearing claims reduce by construction to a self-definition, a fitted quantity renamed as a prediction, or an author-overlapping uniqueness result. The literature-search methodology in §1.4 is a selection heuristic, not a circular derivation. Score 0 is therefore the correct outcome.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 1 invented entities

A survey rests almost entirely on the cited literature and on the authors’ selection and categorization choices. No free parameters are fitted; the only ‘invented’ construct is the tailored taxonomy itself, which is an organizational device rather than a physical entity.

axioms (2)
  • domain assumption The selected set of ~30–40 papers published mainly 2020–2025 is representative of the state of hardware SCAs on deep learning.
    Stated in §1.4 literature-search methodology; underpins completeness of taxonomy and gap analysis.
  • domain assumption Physical and micro-architectural leakages (power, EM, cache, timing, context-switch) can be observed by an adversary with the access levels described.
    Background assumption drawn from the SCA literature and used throughout §§2–3.
invented entities (1)
  • DL-specific SCA taxonomy (leakage sources × attacker objectives × hardware platforms) no independent evidence
    purpose: Organize existing attacks and defenses for deep-learning hardware.
    Presented in Figure 1 and §2 as an adaptation of prior SCA taxonomies; no independent empirical validation beyond the surveyed papers.

reviewed 2026-07-11 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures." pith.science (2026). https://pith.science/paper/KS7LI3ZM

@misc{pith2026260704055,
  author       = {Pith},
  title        = {Pith review of: Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KS7LI3ZM}},
  note         = {Machine review of arXiv:2607.04055}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

As deep learning models are increasingly deployed in critical sectors such as healthcare, finance, and security, ensuring their protection against emerging threats has become crucial. Among these threats, side-channel attacks (SCAs) represent a particular challenge since they can extract sensitive information such as model architectures, parameters, and even user inputs without requiring direct access to the model. By leveraging the physical and micro-architectural properties of the hardware, attackers can compromise systems. This survey begins by classifying leakage sources and attacker objectives, then analyzes representative studies that demonstrate practical side-channel exploits against deep-learning hardware. It also reviews existing defenses aimed at mitigating these vulnerabilities and concludes by outlining key open research challenges and potential future directions.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

52 extracted references · 22 canonical work pages · 3 internal anchors

  1. [1]

    Liu and et al

    Y. Liu and et al. A Survey on Side-Channel- based Reverse Engineering Attacks on Deep Neu- ral Networks. In2022 IEEE 4th International Conference on Artificial Intelligence Circuits and Systems (AICAS), pages 312–315. IEEE, June

  2. [2]

    doi: 10.1109/aicas54282.2022.9869995

    doi:10.1109/aicas54282.2022.9869995 2022

  3. [3]

    Méndez Real and R

    M. Méndez Real and R. Salvador. Physical Side- Channel Attacks on Embedded Neural Networks: A Survey.Applied Sciences, 11(15):6790, July

  4. [4]

    doi: 10.3390/app11156790

    work page doi:10.3390/app11156790

  5. [5]

    Survey of Attacks and Defenses on Edge-Deployed Neural Networks

    M. Isakov, V. Gadepally, K. M. Gettings, and M. A. Kinsy. Survey of Attacks and Defenses on Edge-Deployed Neural Networks.arXiv, 2019. doi: 10.48550/ARXIV.1911.11932

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.1911.11932 2019

  6. [6]

    D. Meyer. The Cost of Training AI Could Soon Become Too Much to Bear.Fortune, April

  7. [7]

    https://fortune.com/2024/04/04/ai- training-costs-how-much-is-too-much- openai-gpt-anthropic-microsoft/

    2024

  8. [8]

    Horváth, D

    P. Horváth, D. Lauret, Z. Liu, and L. Batina. SoK: Neural Network Extraction Through Phys- ical Side Channels. InProceedings of the 33rd USENIX Conference on Security Symposium, SEC ’24, USA, 2024. USENIX Association. doi: 10.5555/3698900.3699091

    work page doi:10.5555/3698900.3699091 2024

  9. [9]

    Sweney and D

    M. Sweney and D. Milmo. OpenAI ‘reviewing’ allegations that its AI models were used to make DeepSeek.The Guardian, January 2025. https://www.theguardian.com/technology/ 2025/jan/29/openai-chatgpt-deepseek- china-us-ai-models

    2025

  10. [10]

    Mittal, H

    S. Mittal, H. Gupta, and S. Srivastava. A Survey on Hardware Security of DNN Models and Ac- celerators.Journal of Systems Architecture, 117: 102163, 2021. doi: 10.1016/j.sysarc.2021.102163

    work page doi:10.1016/j.sysarc.2021.102163 2021

  11. [11]

    Picek, G

    S. Picek, G. Perin, L. Mariot, L. Wu, and L. Batina. SoK: Deep Learning-based Physical Side-channel Analysis.ACM Computing Surveys, 55(11):1–35, 2023. doi: 10.1145/3569577

    doi:10.1145/3569577 2023

  12. [12]

    Nayan, Q

    T. Nayan, Q. Guo, M. A. Duniawi, M. Botacin, S. Uluagac, and R. Sun. SoK: All You Need to Know About On-device ML Model Extraction - The Gap Between Research and Practice. In Proceedings of the 33rd USENIX Conference on Security Symposium, pages 1–18. USENIX Asso- ciation, 2024. doi: 10.5555/3698900.3699193

    work page doi:10.5555/3698900.3699193 2024

  13. [13]

    M. Yan, C. W. Fletcher, and J. Torrellas. Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures. InProceedings of the 29th USENIX Conference on Security Sympo- sium, SEC’20, USA, 2020. USENIX Association. doi: 10.5555/3489212.3489325

    work page doi:10.5555/3489212.3489325 2020

  14. [14]

    J. Wei, Y. Zhang, Z. Zhou, Z. Li, and M. A. Al Faruque. Leaky DNN: Stealing Deep-Learning Model Secret with GPU Context-Switching Side- Channel. In2020 50th Annual IEEE/IFIP In- ternational Conference on Dependable Systems and Networks (DSN), pages 125–137. IEEE, June

  15. [15]

    doi: 10.1109/dsn48063.2020.00031

    doi:10.1109/dsn48063.2020.00031 2020

  16. [16]

    Liu and A

    Y. Liu and A. Srivastava. GANRED: GAN- based Reverse Engineering of DNNs via Cache Side-Channel. InProceedings of the 2020 ACM SIGSAC Conference on Cloud Computing Secu- rity Workshop, pages 41–52. ACM, Nov. 2020. doi: 10.1145/3411495.3421356

    doi:10.1145/3411495.3421356 2020

  17. [17]

    Z. Gao, J. Hu, F. Guo, Y. Zhang, Y. Han, S. Liu, H. Li, and Z. Lv. I Know What You Said: Un- veiling Hardware Cache Side-Channels in Lo- cal Large Language Model Inference (Version 3). arXiv, 2025. doi: 10.48550/ARXIV.2505.06738

    Pith/arXiv arXiv doi:10.48550/arxiv.2505.06738 2025

  18. [18]

    Spill The Beans: Exploiting CPU Cache Side-Channels to Leak Tokens from Large Language Models

    A. Adiletta and B. Sunar. Spill The Beans: Ex- ploiting CPU Cache Side-Channels to Leak To- kens from Large Language Models (Version 1). arXiv, 2025. doi: 10.48550/ARXIV.2505.00817

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2505.00817 2025

  19. [19]

    Hu and et al

    X. Hu and et al. DeepSniffer: A DNN Model Ex- traction Framework Based on Learning Architec- tural Hints. InProceedings of the Twenty-Fifth International Conference on Architectural Sup- port for Programming Languages and Operating Systems, pages 385–399. ACM, Mar. 2020. doi: 10.1145/3373376.3378460

    doi:10.1145/3373376.3378460 2020

  20. [20]

    Y. Gao, H. Qiu, Z. Zhang, B. Wang, H. Ma, A. Abuadbba, M. Xue, A. Fu, and S. Nepal. DeepTheft: Stealing DNN Model Architectures through Power Side Channel. In2024 IEEE Sym- posium on Security and Privacy (SP),pages3311–

  21. [21]

    doi: 10.1109/sp54263.2024

    IEEE, 2024. doi: 10.1109/sp54263.2024. 00250

    doi:10.1109/sp54263.2024 2024

  22. [22]

    Chaudhuri, S

    A. Chaudhuri, S. Shukla, S. Bhattacharya, and D. Mukhopadhyay. “Energon”: Unveiling Trans- formers from GPU Power and Thermal Side- Channels (Version 1).arXiv, 2025. doi: 10.48550/ ARXIV.2508.01768. IS e C ure 16

    Pith/arXiv arXiv 2025

  23. [23]

    K. Lee, M. Ashok, S. Maji, R. Agrawal, A. Joshi, M. Yan, J. S. Emer, and A. P. Chandrakasan. Secure Machine Learning Hardware: Challenges and Progress [Feature].IEEE Circuits and Sys- tems Magazine, 25(1):8–34, 2025. doi: 10.1109/ mcas.2024.3509376

    arXiv 2025

  24. [24]

    Z. Liu, Y. Yuan, Y. Chen, S. Hu, T. Li, and S. Wang. DeepCache: Revisiting Cache Side- Channel Attacks in Deep Neural Networks Ex- ecutables. InProceedings of the 2024 ACM SIGSAC Conference on Computer and Commu- nications Security, pages 4495–4508. ACM, Dec

    2024

  25. [25]

    doi: 10.1145/3658644.3690241

    work page doi:10.1145/3658644.3690241

  26. [26]

    H. Wang, S. M. Hafiz, K. Patwari, C.-N. Chuah, Z. Shafiq, and H. Homayoun. Stealthy Infer- ence Attack on DNN via Cache-based Side- Channel Attacks. In2022 Design, Automa- tion & Test in Europe Conference & Exhibition (DATE), pages 1515–1520. IEEE, Mar. 2022. doi: 10.23919/date54114.2022.9774742

    doi:10.23919/date54114.2022.9774742 2022

  27. [27]

    Horvath, L

    P. Horvath, L. Chmielewski, L. Weissbart, L. Batina, and Y. Yarom. BarraCUDA: Edge GPUs Do Leak DNN Weights.arXiv preprint, Dec. 2023.https://arxiv.org/abs/ 2312.07783

    Pith/arXiv arXiv 2023

  28. [28]

    Y. Sun, G. Jiang, X. Liu, P. He, and S.-K. Lam. Layer Sequence Extraction of Optimized DNNs Using Side-Channel Information Leaks.IEEE Transactions on Computer-Aided Design of Inte- grated Circuits and Systems, 43(10):3102–3115,

  29. [29]

    doi: 10.1109/tcad.2024.3389554

    work page doi:10.1109/tcad.2024.3389554 2024

  30. [30]

    S. B. Dutta, H. Naghibijouybari, A. Gupta, N. Abu-Ghazaleh, A. Marquez, and K. Barker. Spy in the GPU-box: Covert and Side Channel Attacks on Multi-GPU Systems. InProceedings of the 50th Annual International Symposium on Computer Architecture (ISCA ’23), pages 1–13. ACM, 2023. doi: 10.1145/3579371.3589080

    doi:10.1145/3579371.3589080 2023

  31. [31]

    W. Hua, Z. Zhang, and G. E. Suh. Reverse Engi- neering Convolutional Neural Networks Through Side-channel Information Leaks. In2018 55th ACM/ESDA/IEEE Design Automation Confer- ence (DAC). IEEE, June 2018. doi: 10.1109/dac. 2018.8465773

    work page doi:10.1109/dac 2018

  32. [32]

    L. Wei, B. Luo, Y. Li, Y. Liu, and Q. Xu. I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 393–406. ACM, Dec. 2018. doi: 10.1145/3274694.3274696

    work page doi:10.1145/3274694.3274696 2018

  33. [33]

    S. Tian, S. Moini, D. Holcomb, R. Tessier, and J. Szefer. A Practical Remote Power Attack on Machine Learning Accelerators in Cloud FP- GAs. In2023 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 1–6. IEEE, 2023. doi: 10.23919/date56975.2023. 10136956

    doi:10.23919/date56975.2023 2023

  34. [34]

    Huegle, M

    L. Huegle, M. Gotthard, V. Meyers, J. Krautter, D.R.E.Gnad,andM.B.Tahoori.Power2Picture: Using Generative CNNs for Input Recovery of NeuralNetworkAcceleratorsthroughPowerSide- Channels on FPGAs. In2023 IEEE 31st Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM), pages 155–161. IEEE, 2023. doi: 10.1109/fccm57271. 2023.00025

    work page doi:10.1109/fccm57271 2023

  35. [35]

    L. Wu, L. Wu, Z. Ba, and X. Zhang. An Input Recovery Side-Channel Attack on DNN Acceler- ator with Three-Dimensional Power Surface. In 2025 IEEE International Symposium on Hard- ware Oriented Security and Trust (HOST), pages 1–11. IEEE, 2025. doi: 10.1109/host64725.2025. 11050042

    doi:10.1109/host64725.2025 2025

  36. [36]

    NNLeak: An AI-Oriented DNN Model Extrac- tion Attack through Multi-Stage Side Channel Analysis

    Y.Gao,H.Ma,M.Yan,J.He,Y.Zhao,andY.Jin. NNLeak: An AI-Oriented DNN Model Extrac- tion Attack through Multi-Stage Side Channel Analysis. In2023 Asian Hardware Oriented Secu- rity and Trust Symposium (AsianHOST), pages 1–6. IEEE, 2023. doi: 10.1109/asianhost59942. 2023.10409396

    work page doi:10.1109/asianhost59942 2023

  37. [37]

    Hong and et al

    S. Hong and et al. Security Analysis of Deep Neural Networks Operating in the Pres- ence of Cache Side-Channel Attacks.arXiv preprint, 2018. https://doi.org/10.48550/ ARXIV.1810.03487

    Pith/arXiv arXiv 2018

  38. [38]

    S. Hong, M. Davinroy, Y. Kaya, D. Dachman- Soled, and T. Dumitraş. How to 0wn NAS in Your Spare Time.arXiv preprint, 2020. doi: 10. 48550/ARXIV.2002.06776. https://doi.org/ 10.48550/ARXIV.2002.06776

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2002.06776 2020

  39. [39]

    S. Maji, K. Lee, and A. P. Chandrakasan. Sparse- LeakyNets:ClassificationPredictionAttackOver Sparsity-Aware Embedded Neural Networks Us- ing Timing Side-Channel Information.IEEE Computer Architecture Letters, 23(1):133–136,

  40. [40]

    doi: 10.1109/lca.2024.3397730

    work page doi:10.1109/lca.2024.3397730 2024

  41. [41]

    G. Wang, C. Zhou, Y. Wang, B. Chen, H. Guo, and Q. Yan. Beyond Boundaries: A Comprehen- sive Survey of Transferable Attacks on AI Sys- tems.arXiv preprint, 2023. https://doi.org/ 10.48550/ARXIV.2311.11796

    Pith/arXiv arXiv doi:10.48550/arxiv.2311.11796 2023

  42. [42]

    Sharma, S

    J. Sharma, S. S. Ojha, and R. Dubey. Exploring Flush+Reload Side Channel Attack Vulnerabil- ities: Detection and Countermeasures. In2023 2nd International Conference on Automation, Computing and Renewable Systems (ICACRS), volume 17, pages 717–723. IEEE, 2023. doi: 10.1109/icacrs58579.2023.10404114

    work page doi:10.1109/icacrs58579.2023.10404114 2023

  43. [43]

    Albalawi

    A. Albalawi. On Preventing and Mitigating Cache Based Side-Channel Attacks on AES Sys- tem in Virtualized Environments.Computer and Information Science (CIS), 17(1):9, Feb. 2024. IS e C ure 17 doi: 10.5539/cis.v17n1p9

    work page doi:10.5539/cis.v17n1p9 2024

  44. [44]

    Batina, S

    L. Batina, S. Bhasin, D. Jap, and S. Picek. CSI NN: Reverse Engineering of Neural Network Ar- chitectures Through Electromagnetic Side Chan- nel. InProceedings of the 28th USENIX Con- ference on Security Symposium, SEC’19, pages 515–532, USA, 2019. USENIX Association. doi: 10.5555/3361338.3361374

    work page doi:10.5555/3361338.3361374 2019

  45. [45]

    Dubey, R

    A. Dubey, R. Cammarota, and A. Aysu. Masked- Net: The First Hardware Inference Engine Aim- ing Power Side-Channel Protection. In2020 IEEE International Symposium on Hardware Ori- ented Security and Trust (HOST), pages 197–208. IEEE, Dec. 2020. doi: 10.1109/host45689.2020. 9300276

    work page doi:10.1109/host45689.2020 2020

  46. [46]

    Brosch, M

    M. Brosch, M. Probst, M. Glaser, and G. Sigl. A Masked Hardware Accelerator for Feed-Forward Neural Networks With Fixed-Point Arithmetic. IEEE Transactions on Very Large Scale Integra- tion (VLSI) Systems, 32(2):231–244, 2024. doi: 10.1109/tvlsi.2023.3340553

    work page doi:10.1109/tvlsi.2023.3340553 2024

  47. [47]

    Q. Fang, L. Lin, H. Zhang, T. Wang, and M. Alioto. Voltage Scaling-Agnostic Counterac- tion of Side-Channel Neural Net Reverse Engi- neering via Machine Learning Compensation and Multi-Level Shuffling. In2023 IEEE Symposium on VLSI Technology and Circuits (VLSI Technol- ogy and Circuits).IEEE,June2023.doi:10.23919/ vlsitechnologyandcir57934.2023.10185228

    arXiv 2023

  48. [48]

    X. Yan, C. H. Chang, and T. Zhang. Defense Against ML-based Power Side-Channel Attacks on DNN Accelerators with Adversarial Attacks. arXiv preprint, Dec. 2023.https://arxiv.org/ abs/2312.04035

    Pith/arXiv arXiv 2023

  49. [49]

    Lungu, B

    N. Lungu, B. B. Dash, M. R. Mishra, L. Barik, A. Tripathy, and S. S. Patra. GPUSecBench: Evaluating the Cache Side-Channel Resilience of a GPU Security Execution Pipeline. In2024 Second International Conference on Intelligent Cyber Physical Systems and Internet of Things (ICoICI), pages 564–571. IEEE, 2024. doi: 10. 1109/icoici62503.2024.10696012

    arXiv 2024

  50. [50]

    Joshi, A

    T. Joshi, A. Kawalay, A. Jamkhande, and A. Joshi. Hybrid Deep Learning Model for Mul- tiple Cache Side Channel Attacks Detection: A Comparative Analysis.arXiv preprint, Jan. 2025. https://arxiv.org/abs/2501.17123

    Pith/arXiv arXiv 2025

  51. [51]

    H. Wang, H. Sayadi, S. Rafatirad, A. Sasan, and H. Homayoun. SCARF: Detecting Side- Channel Attacks at Real-time using Low-level Hardware Features. In2020 IEEE 26th Interna- tional Symposium on On-Line Testing and Robust System Design (IOLTS). IEEE, July 2020. doi: 10.1109/iolts50870.2020.9159708

    work page doi:10.1109/iolts50870.2020.9159708 2020

  52. [52]

    H. Kim, C. Hahn, H. J. Kim, Y. Shin, and J.Hur. DeepLearning-BasedDetectionforMulti- ple Cache Side-Channel Attacks.IEEE Transac- tions on Information Forensics and Security, 19: 1672–1686, 2024. doi: 10.1109/tifs.2023.3340088. Zahra Mohammadiis currently a Ph.D. candidate in Computer Engi- neering at the University of Tehran, specializing in Computer Arc...

    work page doi:10.1109/tifs.2023.3340088 2024

This paper was first reviewed by grok-4.5 on July 11, 2026.