Pith. sign in

REVIEW 4 major objections 4 minor 88 references

Real-world Edge Neural Network Implementations Leak Private Interactions Through Physical Side Channel

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EM emissions from edge AI devices leak private user-interaction attributes.

desk verdict First solid evidence that profiled DLSCA can pull class-level interaction attributes from unmodified edge devices over EM, including edge-LLM tokens; the strong 'implementation-agnostic' claim and missing acquisition-order controls are the main things standing between this and a fully convincing paper. read the letter →

arxiv 2501.14512 v1 pith:VROZ5FBY submitted 2025-01-24 cs.CR

Zhuoran Liu , Senna van Hoek , Péter Horváth , Dirk Lauret , Xiaoyun Xu , Lejla Batina This is my paper · ORCID
classification cs.CR
keywords electromagneticsidechanneldeeplearningside-channelanalysisattributeextractionedgeAIprivacyneuralnetworkinferenceleakageLLMattackFPGAsecurityRaspberryPi
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that the privacy of user interactions with neural-network edge devices is not protected at the implementation level: electromagnetic emissions alone reveal private attributes of what the device is computing. It proposes ScaAR, a profiled deep-learning side-channel attack that trains a small convolutional network on raw EM traces annotated with class labels, then predicts the class of inputs or outputs on a target device without knowing the network weights or the hardware design. The authors demonstrate the attack on a commercial FPGA and several Raspberry Pi models across multiple datasets and model architectures, and they provide a first look at edge large language models, where trace length reveals output token count and different tokens can be distinguished. If the paper is right, a nearby passive adversary can learn sensitive attributes about what a user is doing with an AI device, from image content to conversational text.

What carries the argument

The mechanism is data-dependent computation: the amount of work a neural network performs during inference varies with the data it processes, and this variation is visible in the device's electromagnetic emissions. On the FPGA the authors observe the effect of zero-skipping, where all-zero inputs produce clearly different traces from random images. ScaAR turns this leakage into a classification problem: a one-dimensional convolutional network is trained on raw, unaligned, non-averaged EM traces annotated with the class of the interaction, and the trained network is then applied to traces captured from the target. TVLA and Grad-CAM analyses both point to the first convolution as the main leak point, indicating that the leakage comes from the neural network implementation itself rather than from the input bus.

What would settle it

Run ScaAR with profiling done on one physical unit of a board, or one firmware version, and the attack on a different unit or firmware of the same model; if classification accuracy drops to chance, the implementation-agnostic claim fails. Alternatively, run two inference tasks concurrently on the target and check whether the per-task attributes are still recoverable from the mixed EM trace.

Watch

Extended reading notes

Core claim

The paper claims that electromagnetic emanations from unmodified edge devices running neural networks carry enough information to identify private attributes of user interactions, and that a profiled deep-learning classifier can extract those attributes without knowing the model weights, the accelerator design, or the software implementation. The proposed attack, ScaAR, is trained on raw EM traces annotated only with class labels and then predicts the class of inputs or outputs on a target device. On the AMD-Xilinx MPSoC ZCU104 FPGA and Raspberry Pi 3 B, ScaAR recovers input class labels across MNIST, CIFAR-10, and ImageNet-10 for MLP, CNN, and ResNet models, with the highest reported input accuracy at 96.3 percent on the Raspberry Pi; it also recovers output class labels, sometimes more accurately than input labels. For edge LLMs on the Raspberry Pi 5 running Qwen2-0.5B, the paper reports that EM trace length reveals the number of generated tokens and that different intermediate tokens can be distinguished by a t-test, making token-level leakage visible.

Load-bearing premise

The attack succeeds only if the adversary can profile a device sufficiently similar to the victim's, collecting EM traces with known class labels for every user interaction, and if that profile transfers to the actual target.

Editorial extensions

If this is right

  • A passive adversary with physical proximity can recover private attributes from unmodified edge devices, with no need for trace averaging, clock-cycle alignment, or knowledge of the network parameters.
  • Because the same profiling pipeline transfers across an FPGA and two Raspberry Pi models, several datasets, and several network architectures, the leakage appears to be a property of data-dependent neural-network computation rather than of one specific accelerator.
  • Edge LLM deployments inherit the risk: token count is visible in trace length, and individual intermediate tokens can be distinguished, so conversational content may be at risk from EM eavesdropping.
  • Output attribute extraction can be combined with model-extraction techniques, giving an adversary in physical proximity a stronger way to learn about the deployed model without ever querying it.
  • The methodology can be used as a standard side-channel evaluation step when building or selecting secure machine-learning hardware.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the transferability holds across board revisions and firmware versions, the same method could likely recover finer-grained attributes, such as medical condition, age group, or spoken keywords, from any device whose computation depends on those attributes.
  • The LLM token-level result implies that the iterative token-by-token generation process is a repeating side-channel oracle: every output token is reprocessed as input, so an eavesdropper could potentially reconstruct prompts or responses one token at a time.
  • The paper does not evaluate countermeasures; a natural next question is whether constant-time or constant-power inference, masking, or noise injection can suppress the leakage without destroying edge accelerator performance.
  • Because the experiments show cross-session but not cross-device transfer, the strongest reading of implementation-agnostic is still a hypothesis; testing on multiple physical units and different compiler stacks would settle how far the method generalizes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes ScaAR, a profiled deep-learning side-channel attack that recovers class-level attributes of the inputs and outputs of neural network classifiers from electromagnetic (EM) emissions of physical edge devices. The authors evaluate ScaAR on an AMD-Xilinx ZCU104 FPGA, a Raspberry Pi 3 B, and, for LLM pilot experiments, a Raspberry Pi 5. They report high attribute-extraction accuracies on MNIST, CIFAR-10, and ImageNet-10 (for example, 92.8% for ResNet18 on MNIST traces), identify the first convolution as the likely leak location via TVLA and Grad-CAM, and report a cross-session accuracy of 80.0% for CNN3 on MNIST. The paper also presents a preliminary LLM study showing that EM traces differ with output token count and that two intermediate tokens can be distinguished by a t-test.

Significance. If the reported leakage is genuine, the paper makes a useful contribution: it demonstrates that a profiled DLSCA classifier can extract coarse private attributes from unmodified edge devices using single, unaligned EM traces, without knowledge of the network weights or implementation details. The real-hardware evaluation across multiple devices, models, and datasets is a strength, as are the convergent TVLA and Grad-CAM analyses and the cross-session experiment. The LLM pilot, while preliminary, points to an important emerging target. The main weakness is that the paper does not report the trace-acquisition order, so a time-correlated artifact cannot be excluded, and the central 'implementation-agnostic' claim is stronger than the experiments support.

major comments (4)
  1. [Section 5.1.4] The trace acquisition procedure is described without stating whether traces from different classes were interleaved or randomized. If traces were collected class-by-class, the profiled CNN could learn slow time-domain artifacts (probe settling, thermal drift, oscilloscope baseline wander, or voltage/frequency scaling) that are correlated with class through acquisition time, and the accuracies in Tables 5 and 6 would not demonstrate computation-dependent EM leakage. The untrained-CNN control in Section 6.5 is not a full control, because untrained implementations have a different trace structure and may not carry the same acquisition-order signature. Please report the acquisition schedule and rerun at least one configuration with randomized or interleaved class order; this is load-bearing for the central leakage claim.
  2. [Abstract and Section 6.5] The paper claims that ScaAR is 'implementation-agnostic' and generalizable, but the only generalization experiment profiles and attacks the same physical ZCU104 board running the same CNN3 model across two measurement sessions. Table 5 shows results on different devices, but each row trains and tests on the same device and implementation; there is no experiment in which a model trained on one device or implementation is applied to traces from a different device or implementation. Please either add a cross-device or cross-implementation transfer experiment, or revise the claim to accurately describe the demonstrated scope.
  3. [Section 7] The LLM token-distinguishability claim is supported only by a single t-test comparing two intermediate tokens ('H' and 'Sad') in Figure 11, together with an observation that longer outputs produce longer traces. This does not substantiate the abstract's statement that 'different LLM tokens can be distinguishable from the EM traces' as a general capability. For a pilot study, the paper should either report multi-class token classification accuracy over a larger token set or explicitly state that only pairwise distinguishability for one example is demonstrated.
  4. [Sections 4.2.2 and 6.6] Section 4.2.2 states that the adversary does not have knowledge of the parameters, input, or output of the deployed target neural network, but Section 6.6 introduces the additional assumption that the adversary can access the output label during profiling to annotate traces for output attribute extraction. This should be reconciled by clearly presenting output attribute extraction as an extended threat model with a modified adversary capability, rather than under the original threat model.
minor comments (4)
  1. [Sections 4.2.2 and 4.3] There are several typos: 'implementation-agonistic' should be 'implementation-agnostic', 'it's' should be 'its', and 'dont' should be 'don't'.
  2. [Table 2] The last row labels the attack as 'SCAR (OURS)', which is inconsistent with the name 'ScaAR' used in the text and elsewhere in the paper.
  3. [Section 5.1.4] The sentence 'from the PL unit we can get a clear trigger signal from The EM signals are highly distinguishable...' is grammatically incomplete and should be rewritten.
  4. [References] References [7] and [8] are duplicate entries for the same template-attacks paper; one should be removed or the citation should be disambiguated.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation; the attack is an empirical profiled classifier evaluated on held-out traces, so the reported accuracies are not forced by construction.

full rationale

ScaAR does not derive its predictions from the data it is fitted to; it trains a CNN attack model on a profiling split of EM traces annotated with class labels and then evaluates on a separate held-out split from the same device. The class label is the ground truth for training, not a parameter that is reused to construct the test prediction, so high test accuracy is an empirical result rather than a tautology. The paper contains no equation that equates a predicted quantity with a fitted input, no self-citation is load-bearing (the authors' prior works [4,5,24,25,46] appear only as related work or background), and no uniqueness theorem or ansatz is imported from the authors' own prior papers to force the conclusion. The untrained-CNN control, TVLA, Grad-CAM, and cross-session experiments are independent checks of the leakage claim, even if the cross-session test is limited to the same board and model. The broader 'implementation-agnostic' wording exceeds the evidence, since generalization across different devices or implementations is not demonstrated, but overclaiming is a validity or scope concern, not circularity. Likewise, the absence of a stated randomization of acquisition order could threaten the internal validity of the reported accuracies, but that is an experimental confound rather than a reduction of the result to its own inputs. Accordingly, no circular step meets the evidentiary bar of quoting a specific reduction, and the appropriate score is 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central result is empirical and does not rest on a mathematical derivation. The main unpaid inputs are the threat-model assumption of a similar profiling device and the physical assumption that EM emissions encode the processed data. No new physical entities are introduced. The attack model itself is fitted to data, but that is the method, not a hidden free parameter in the claimed leakage.

free parameters (2)
  • Target CPU operating frequencies = RPi3B 600 MHz, RPi5 300 MHz, ZCU104 PL 100 MHz
    The authors reduced clock frequencies to match oscilloscope bandwidth (Table 4 and Section 8). This hand-chosen condition may change the leakage profile, so the results do not directly transfer to unmodified stock devices.
  • DLSCA model hyperparameters = not reported
    Reported accuracies depend on a four-layer 1D CNN (and GPAM/1D-ViT comparisons) whose architecture details, training hyperparameters, and preprocessing are only partially specified in Section 5.1.5, preventing independent reproduction.
assumptions (4)
  • domain assumption The adversary has access to a profiling device sufficiently similar to the target device.
    Stated in Section 4.2.2. The attack is a supervised profiled DLSCA; without a similar profiling device and labeled traces, the method cannot be trained.
  • domain assumption EM emanations during neural network inference are determined by the data being processed.
    Motivated by SEMA in Section 5.2. The entire attack relies on this physical leakage being present and learnable at the selected probe positions.
  • domain assumption One un-averaged EM trace per inference contains enough signal for classification.
    Section 5.1.4 collects one trace per image. The claim that averaging is unnecessary is an empirical observation and is likely setup-dependent.
  • standard math TVLA t-test threshold |t| > 4.5 indicates exploitable leakage.
    Used in Sections 6.4.2 and 7 following standard side-channel methodology [65, 69]. This is a heuristic criterion, not a proof of attack success.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Real-world Edge Neural Network Implementations Leak Private Interactions Through Physical Side Channel." pith.science (2026). https://pith.science/paper/VROZ5FBY

@misc{pith2026250114512,
  author       = {Pith},
  title        = {Pith review of: Real-world Edge Neural Network Implementations Leak Private Interactions Through Physical Side Channel},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VROZ5FBY}},
  note         = {Machine review of arXiv:2501.14512}
}
read the original abstract

Neural networks have become a fundamental component of numerous practical applications, and their implementations, which are often accelerated by hardware, are integrated into all types of real-world physical devices. User interactions with neural networks on hardware accelerators are commonly considered privacy-sensitive. Substantial efforts have been made to uncover vulnerabilities and enhance privacy protection at the level of machine learning algorithms, including membership inference attacks, differential privacy, and federated learning. However, neural networks are ultimately implemented and deployed on physical devices, and current research pays comparatively less attention to privacy protection at the implementation level. In this paper, we introduce a generic physical side-channel attack, ScaAR, that extracts user interactions with neural networks by leveraging electromagnetic (EM) emissions of physical devices. Our proposed attack is implementation-agnostic, meaning it does not require the adversary to possess detailed knowledge of the hardware or software implementations, thanks to the capabilities of deep learning-based side-channel analysis (DLSCA). Experimental results demonstrate that, through the EM side channel, ScaAR can effectively extract the class label of user interactions with neural classifiers, including inputs and outputs, on the AMD-Xilinx MPSoC ZCU104 FPGA and Raspberry Pi 3 B. In addition, for the first time, we provide side-channel analysis on edge Large Language Model (LLM) implementations on the Raspberry Pi 5, showing that EM side channel leaks interaction data, and different LLM tokens can be distinguishable from the EM traces.

Figures

Figures reproduced from arXiv: 2501.14512 by the authors.

Figure 1
Figure 1. Diagram illustrating the working mechanism of [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Schematic physical setup for image input attribute [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Overview of the target devices. The EM probe [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: EM traces when running SqueezeNet inference [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 6
Figure 6. Figure 6: Comparison of attack robustness against trace [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 5
Figure 5. Figure 5: The relation between the attack accuracy of the [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: t-SNE visualization of 500 traces from 10 classes [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: TVLA comparing class 0 traces with randomly [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 10
Figure 10. Figure 10: SEMA on RPi5 traces with different output tokens. [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: t-Test graph comparing the EM emissions of [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

88 extracted references · 69 canonical work pages

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Template attacks in principal subspaces

    Cédric Archambeau, Eric Peeters, F-X Standaert, and J-J Quisquater. Template attacks in principal subspaces. In International Workshop on Cryptographic Hardware and Embedded Systems, 2006

    2006

  3. [3]

    Efficient template attacks based on probabilistic multi-class support vector machines

    Timo Bartkewitz and Kerstin Lemke-Rust. Efficient template attacks based on probabilistic multi-class support vector machines. In International Conference on Smart Card Research and Advanced Applications , 2012

    2012

  4. [4]

    CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel

    Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel. In USENIX Security Symposium, 2019

    2019

  5. [5]

    Poster: Recovering the input of neural networks via single shot side-channel attacks

    Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. Poster: Recovering the input of neural networks via single shot side-channel attacks. In ACM SIGSAC Conference on Computer and Communications Security, 2019

    2019

  6. [6]

    Generalized power attacks against crypto hardware using long-range deep learning

    Elie Bursztein, Luca Invernizzi, Karel Král, Daniel Moghimi, Jean-Michel Picod, and Marina Zhang. Generalized power attacks against crypto hardware using long-range deep learning. IACR Transactions on Cryptographic Hardware and Embedded Systems , 2024

    2024

  7. [7]

    Template attacks

    Suresh Chari, Josyula R Rao, and Pankaj Rohatgi. Template attacks. In International Workshop on Cryptographic Hardware and Embedded Systems, 2002

    2002

  8. [8]

    Template attacks

    Suresh Chari, Josyula R Rao, and Pankaj Rohatgi. Template attacks. In Cryptographic Hardware and Embedded Systems, 2003

    2003

Show all 88 references
  1. [9]

    On reverse engineering neural network implementation on gpu

    Łukasz Chmielewski and Léo Weissbart. On reverse engineering neural network implementation on gpu. In Applied Cryptography and Network Security Workshops, 2021

    2021

  2. [10]

    Tensorflow lite micro: Embedded machine learning for tinyml systems

    Robert David, Jared Duke, Advait Jain, Vijay Janapa Reddi, Nat Jeffries, Jian Li, Nick Kreeger, Ian Nappier, Meghna Natraj, Tiezhen Wang, et al. Tensorflow lite micro: Embedded machine learning for tinyml systems. Proceedings of Machine Learning and Systems, 2021

    2021

  3. [11]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In IEEE Conference on Computer Vision and Pattern Recognition, 2009

    2009

  4. [12]

    A practical implementation of the timing attack

    Jean-Francois Dhem, Francois Koeune, Philippe- Alexandre Leroux, Patrick Mestré, Jean-Jacques Quisquater, and Jean-Louis Willems. A practical implementation of the timing attack. In Smart Card Research and Applications, 2000

    2000

  5. [13]

    Floating-point multiplication timing attack on deep neural network

    Gaofeng Dong, Ping Wang, Ping Chen, Ruizhe Gu, and Honggang Hu. Floating-point multiplication timing attack on deep neural network. In IEEE International Conference on Smart Internet of Things, 2019

    2019

  6. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020

    2010 arXiv

  7. [15]

    Realistic eavesdropping attacks on computer displays with low- cost and mobile receiver system

    Fürkan Elibol, U ˘gur Sarac, and I¸ sin Erer. Realistic eavesdropping attacks on computer displays with low- cost and mobile receiver system. In IEEE European Signal Processing Conference, 2012

    2012

  8. [16]

    Adversarial examples make strong poisons

    Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 2021

    2021

  9. [17]

    Model inversion attacks that exploit confidence information and basic countermeasures

    Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In ACM SIGSAC conference on computer and communications security, 2015

    2015

  10. [18]

    Electromagnetic analysis: Concrete results

    Karine Gandolfi, Christophe Mourtel, and Francis Olivier. Electromagnetic analysis: Concrete results. In Cryptographic Hardware and Embedded Systems, 2001

    2001

  11. [19]

    Neural network based attack on a masked implementation of AES

    Richard Gilmore, Neil Hanley, and Maire O’Neill. Neural network based attack on a masked implementation of AES. In IEEE International Symposium on Hardware Oriented Security and Trust, 2015

    2015

  12. [20]

    Side-channel-assisted reverse-engineering of encrypted dnn hardware accelerator ip and attack surface exploration

    Cheng Gongye, Yukui Luo, Xiaolin Xu, and Yunsi Fei. Side-channel-assisted reverse-engineering of encrypted dnn hardware accelerator ip and attack surface exploration. In IEEE Symposium on Security and Privacy, 2024

    2024

  13. [21]

    Deep learning with Keras

    Antonio Gulli and Sujit Pal. Deep learning with Keras. Packt Publishing Ltd, 2017

    2017

  14. [22]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition, 2016. 14

    2016

  15. [23]

    Recognition of electro- magnetic leakage information from computer radiation with SVM

    Zhang Hongxin, Huang Yuewang, Wang Jianxin, Lu Yinghua, and Zhang Jinling. Recognition of electro- magnetic leakage information from computer radiation with SVM. Computers & Security, 2009

    2009

  16. [24]

    BarraCUDA: Bringing Electromagnetic Side Channel Into Play to Steal the Weights of Neural Networks from NVIDIA GPUs, 2023

    Peter Horvath, Lukasz Chmielewski, Leo Weissbart, Lejla Batina, and Yuval Yarom. BarraCUDA: Bringing Electromagnetic Side Channel Into Play to Steal the Weights of Neural Networks from NVIDIA GPUs, 2023

    2023

  17. [25]

    Sok: neural network extraction through physical side channels

    Péter Horváth, Dirk Lauret, Zhuoran Liu, and Lejla Batina. Sok: neural network extraction through physical side channels. In USENIX Security Symposium, 2024

    2024

  18. [26]

    Deepsniffer: A dnn model extraction framework based on learning architectural hints

    Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xinfeng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, et al. Deepsniffer: A dnn model extraction framework based on learning architectural hints. In International Conference on Architectural Support for Programm...

    2020

  19. [27]

    A survey of forex and stock price prediction using deep learning

    Zexin Hu, Yiqi Zhao, and Matloob Khushi. A survey of forex and stock price prediction using deep learning. Applied System Innovation, 2021

    2021

  20. [28]

    Power2picture: Using generative cnns for input recovery of neural network accelerators through power side- channels on fpgas

    Lukas Huegle, Martin Gotthard, Vincent Meyers, Jonas Krautter, Dennis RE Gnad, and Mehdi B Tahoori. Power2picture: Using generative cnns for input recovery of neural network accelerators through power side- channels on fpgas. In Annual International Symposium on Field-Programm...

    2023

  21. [29]

    Squeezenet: Alexnet-level accuracy with 50x fewer parameters and< 0.5 mb model size, 2016

    Forrest N Iandola, Song Han, Matthew W Moskewicz, Khalid Ashraf, William J Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and< 0.5 mb model size, 2016

    2016

  22. [30]

    Like an open book? read neural network architecture with simple power analysis on 32-bit microcontrollers

    Raphael Joud, Pierre-Alain Moellic, Simon Pontie, and Jean-Baptiste Rigaud. Like an open book? read neural network architecture with simple power analysis on 32-bit microcontrollers. In Smart Card Research and Advanced Application Conference, 2023

    2023

  23. [31]

    In- datacenter performance analysis of a tensor processing unit

    Norman P Jouppi, Cliff Young, Nishant Patil, David Patterson, Gaurav Agrawal, Raminder Bajwa, Sarah Bates, Suresh Bhatia, Nan Boden, Al Borchers, et al. In- datacenter performance analysis of a tensor processing unit. In International Symposium on Computer Architecture, 2017

    2017

  24. [32]

    Highly accurate protein structure prediction with alphafold

    John Jumper, Richard Evans, Alexander Pritzel, Tim Green, Michael Figurnov, Olaf Ronneberger, Kathryn Tunyasuvunakool, Russ Bates, Augustin Žídek, Anna Potapenko, et al. Highly accurate protein structure prediction with alphafold. nature, 2021

    2021

  25. [33]

    Marich: A query- efficient distributionally equivalent model extraction attack

    Pratik Karmakar and Debabrota Basu. Marich: A query- efficient distributionally equivalent model extraction attack. Advances in Neural Information Processing Systems, 2024

    2024

  26. [34]

    Differential power analysis

    Paul Kocher, Joshua Jaffe, and Benjamin Jun. Differential power analysis. In Advances in Cryptology, 1999

    1999

  27. [35]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009

    2009

  28. [36]

    Imagenet classification with deep convolutional neural networks

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 2012

    2012

  29. [37]

    Soft tempest: Hidden data transmission using electromagnetic emanations

    Markus G Kuhn and Ross J Anderson. Soft tempest: Hidden data transmission using electromagnetic emanations. In International Workshop on Information Hiding, 1998

    1998

  30. [38]

    Lecun, L

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner. Gradient- based learning applied to document recognition. Proceedings of the IEEE, 1998

    1998

  31. [39]

    The mnist database of handwritten digits

    Yann LeCun. The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/, 1998

    1998

  32. [40]

    Convolutional networks for images, speech, and time series

    Yann LeCun, Yoshua Bengio, et al. Convolutional networks for images, speech, and time series. The handbook of brain theory and neural networks, 1995

    1995

  33. [41]

    Backpropagation applied to handwritten zip code recognition

    Yann LeCun, Bernhard Boser, John S Denker, Donnie Henderson, Richard E Howard, Wayne Hubbard, and Lawrence D Jackel. Backpropagation applied to handwritten zip code recognition. Neural computation, 1989

    1989

  34. [42]

    Power analysis attack: an approach based on machine learning

    Liran Lerman, Gianluca Bontempi, and Olivier Markowitch. Power analysis attack: an approach based on machine learning. International Journal of Applied Cryptography, 2014

    2014

  35. [43]

    A machine learning approach against a masked AES

    Liran Lerman, Gianluca Bontempi, and Olivier Markowitch. A machine learning approach against a masked AES. Journal of Cryptographic Engineering, 2015

    2015

  36. [44]

    Clairvoyance: Exploiting far-field em emanations of gpu to" see" your dnn models through obstacles at a distance

    Sisheng Liang, Zihao Zhan, Fan Yao, Long Cheng, and Zhenkai Zhang. Clairvoyance: Exploiting far-field em emanations of gpu to" see" your dnn models through obstacles at a distance. In IEEE Security and Privacy Workshops, 2022

    2022

  37. [45]

    Edge-llms: Edge-device large language model competition

    Shiwei Liu, Kai Han, Adriana Fernandez-Lopez, AJAY KUMAR JAISWAL, Zahra Atashgahi, Boqian 15 Wu, Edoardo Ponti, Callie Hao, Rebekka Burkholz, Olga Saukh, et al. Edge-llms: Edge-device large language model competition. In NeurIPS 2024 Competition Track, 2024

    2024

  38. [46]

    Screen gleaning: A screen reading tempest attack on mobile devices exploiting an electromagnetic side channel

    Zhuoran Liu, Niels Samwel, Léo Weissbart, Zhengyu Zhao, Dirk Lauret, Lejla Batina, and Martha Larson. Screen gleaning: A screen reading tempest attack on mobile devices exploiting an electromagnetic side channel. Network and Distributed System Security Symposium, 2021

    2021

  39. [47]

    Optimizing loop operation and dataflow in fpga acceleration of deep convolutional neural networks

    Yufei Ma, Yu Cao, Sarma Vrudhula, and Jae-sun Seo. Optimizing loop operation and dataflow in fpga acceleration of deep convolutional neural networks. In ACM/SIGDA International Symposium on Field- Programmable Gate Arrays, 2017

    2017

  40. [48]

    Breaking cryptographic implementations using deep learning techniques

    Houssem Maghrebi, Thibault Portigliatti, and Emmanuel Prouff. Breaking cryptographic implementations using deep learning techniques. In International Conference on Security, Privacy, and Applied Cryptography Engineering, 2016

    2016

  41. [49]

    Can one hear the shape of a neural network?: Snooping the gpu via magnetic side channel

    Henrique Teles Maia, Chang Xiao, Dingzeyu Li, Eitan Grinspun, and Changxi Zheng. Can one hear the shape of a neural network?: Snooping the gpu via magnetic side channel. In USENIX Security Symposium, 2022

    2022

  42. [50]

    Leaky nets: Recovering embedded neural network models and inputs through simple power and timing side-channels—attacks and defenses

    Saurav Maji, Utsav Banerjee, and Anantha P Chandrakasan. Leaky nets: Recovering embedded neural network models and inputs through simple power and timing side-channels—attacks and defenses. IEEE Internet of Things Journal, 2021

    2021

  43. [51]

    Sparseleakynets: Classification prediction attack over sparsity-aware embedded neural networks using timing side-channel information

    Saurav Maji, Kyungmi Lee, and Anantha P Chandrakasan. Sparseleakynets: Classification prediction attack over sparsity-aware embedded neural networks using timing side-channel information. IEEE Computer Architecture Letters, 2024

    2024

  44. [52]

    Power analysis attacks: Revealing the secrets of smart cards

    Stefan Mangard, Elisabeth Oswald, and Thomas Popp. Power analysis attacks: Revealing the secrets of smart cards. Springer Science & Business Media, 2008

    2008

  45. [53]

    Microsoft copilot

    Microsoft. Microsoft copilot. 2023. Accessed: 2025- 01-23

    2023

  46. [54]

    A survey on neural network hardware accelerators

    Tamador Mohaidat and Kasem Khalil. A survey on neural network hardware accelerators. IEEE Transactions on Artificial Intelligence, 2024

    2024

  47. [55]

    Power side-channel attacks on bnn accelerators in remote fpgas

    Shayan Moini, Shanquan Tian, Daniel Holcomb, Jakub Szefer, and Russell Tessier. Power side-channel attacks on bnn accelerators in remote fpgas. IEEE Journal on Emerging and Selected Topics in Circuits and Systems, 2021

    2021

  48. [56]

    Remote power side-channel attacks on bnn accelerators in fpgas

    Shayan Moini, Shanquan Tian, Daniel Holcomb, Jakub Szefer, and Russell Tessier. Remote power side-channel attacks on bnn accelerators in fpgas. In Design, Automation & Test in Europe Conference & Exhibition, 2021

    2021

  49. [57]

    I know what you trained last summer: A survey on stealing machine learning models and defences

    Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys, 2023

    2023

  50. [58]

    OpenAI. Chatgpt. Version 4, Large language model,

  51. [59]

    Knockoff nets: Stealing functionality of black-box models

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In IEEE Conference on Computer Vision and Pattern Recognition, 2019

    2019

  52. [60]

    Pytorch: An imperative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 2019

    2019

  53. [61]

    Sok: Deep learning-based physical side-channel analysis

    Stjepan Picek, Guilherme Perin, Luca Mariot, Lichao Wu, and Lejla Batina. Sok: Deep learning-based physical side-channel analysis. ACM Computing Surveys, 2023

    2023

  54. [62]

    Machine learning and hardware security: Challenges and opportunities

    Francesco Regazzoni, Shivam Bhasin, Amir Ali Pour, Ihab Alshaer, Furkan Aydin, Aydin Aysu, Vincent Beroulle, Giorgio Di Natale, Paul Franzon, David Hely, et al. Machine learning and hardware security: Challenges and opportunities. In International Conference on Computer-Aided ...

    2020

  55. [63]

    Getty images lawsuit says stability ai misused photos to train ai, February 2023

    Reuters. Getty images lawsuit says stability ai misused photos to train ai, February 2023

    2023

  56. [64]

    Machine learning for microcontroller-class hardware: A review

    Swapnil Sayan Saha, Sandeep Singh Sandha, and Mani Srivastava. Machine learning for microcontroller-class hardware: A review. IEEE Sensors Journal, 2022

    2022

  57. [65]

    Leakage assessment methodology: A clear roadmap for side- channel evaluations

    Tobias Schneider and Amir Moradi. Leakage assessment methodology: A clear roadmap for side- channel evaluations. In Cryptographic Hardware and Embedded Systems, 2015

    2015

  58. [66]

    Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra

    Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In IEEE International Conference on Computer Vision, 2017

    2017

  59. [67]

    Prompt stealing attacks against large language models

    Zeyang Sha and Yang Zhang. Prompt stealing attacks against large language models. arXiv preprint arXiv:2402.12959, 2024. 16

    2024 arXiv

  60. [68]

    Prompt stealing attacks against Text-to-Image generation models

    Xinyue Shen, Yiting Qu, Michael Backes, and Yang Zhang. Prompt stealing attacks against Text-to-Image generation models. In USENIX Security Symposium , 2024

    2024

  61. [69]

    whispering mlaas

    Shubhi Shukla, Manaar Alam, Sarani Bhattacharya, Pabitra Mitra, and Debdeep Mukhopadhyay. “whispering mlaas”: Exploiting timing channels to compromise user privacy in deep neural networks. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2023

    2023

  62. [70]

    X-vectors: Robust dnn embeddings for speaker recognition

    David Snyder, Daniel Garcia-Romero, Gregory Sell, Daniel Povey, and Sanjeev Khudanpur. X-vectors: Robust dnn embeddings for speaker recognition. In IEEE International Conference on Acoustics, Speech and Signal Processing, 2018

    2018

  63. [71]

    Biomedical image classification in a big data architecture using machine learning algorithms

    Christian Tchito Tchapga, Thomas Attia Mih, Aurelle Tchagna Kouanou, Theophile Fozin Fonzin, Platini Kuetche Fogang, Brice Anicet Mezatio, and Daniel Tchiotsop. Biomedical image classification in a big data architecture using machine learning algorithms. Journal of Healthcare ...

    2021

  64. [72]

    Gemini: a family of highly capable multimodal models

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean- Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023

    2023 arXiv

  65. [73]

    Qwen2 technical report

    Qwen Team. Qwen2 technical report. arXiv preprint arXiv:2407.10671, 2024

    2024 arXiv

  66. [74]

    Catastrophic forgetting and mode collapse in gans

    Hoang Thanh-Tung and Truyen Tran. Catastrophic forgetting and mode collapse in gans. In IEEE International Joint Conference on Neural Networks , 2020

    2020

  67. [75]

    You only get one-shot: Eavesdropping input images to neural network by spying soc-fpga internal bus

    May Myat Thu, Maria Méndez Real, Maxime Pelcat, and Philippe Besnier. You only get one-shot: Eavesdropping input images to neural network by spying soc-fpga internal bus. In International Conference on Availability, Reliability and Security, 2023

    2023

  68. [76]

    Openai and news corp reach deal on use of content, May 2024

    The New York Times. Openai and news corp reach deal on use of content, May 2024

    2024

  69. [77]

    Stealing machine learning models via prediction APIs

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction APIs. In USENIX Security Symposium, 2016

    2016

  70. [78]

    Electromagnetic radiation from video display units: An eavesdropping risk? Computers & Security, 1985

    Wim Van Eck. Electromagnetic radiation from video display units: An eavesdropping risk? Computers & Security, 1985

    1985

  71. [79]

    Attention is all you need

    A Vaswani. Attention is all you need. Advances in Neural Information Processing Systems, 2017

    2017

  72. [80]

    I know what you see: Power side-channel attack on convolutional neural network accelerators

    Lingxiao Wei, Bo Luo, Yu Li, Yannan Liu, and Qiang Xu. I know what you see: Power side-channel attack on convolutional neural network accelerators. In Annual Computer Security Applications Conference, 2018

    2018

  73. [81]

    A prompt pattern catalog to enhance prompt engineering with chatgpt

    Jules White, Quchen Fu, Sam Hays, Michael Sandborn, Carlos Olea, Henry Gilbert, Ashraf Elnashar, Jesse Spencer-Smith, and Douglas C Schmidt. A prompt pattern catalog to enhance prompt engineering with chatgpt. arXiv preprint arXiv:2302.11382, 2023

    2023 arXiv

  74. [82]

    Deep neural networks with koopman operators for modeling and control of autonomous vehicles

    Yongqian Xiao, Xinglong Zhang, Xin Xu, Xueqing Liu, and Jiahang Liu. Deep neural networks with koopman operators for modeling and control of autonomous vehicles. IEEE Transactions on Intelligent Vehicles , 2023

    2023

  75. [83]

    Extraction of binarized neural network architecture and secret parameters using side-channel information

    Ville Yli-Mäyry, Akira Ito, Naofumi Homma, Shivam Bhasin, and Dirmanto Jap. Extraction of binarized neural network architecture and secret parameters using side-channel information. In IEEE International Symposium on Circuits and Systems, 2021

    2021

  76. [84]

    Edge-llm: Enabling efficient large language model adaptation on edge devices via unified compression and adaptive layer voting

    Zhongzhi Yu, Zheng Wang, Yuhan Li, Ruijie Gao, Xiaoya Zhou, Sreenidhi Reddy Bommu, Yang Zhao, and Yingyan Lin. Edge-llm: Enabling efficient large language model adaptation on edge devices via unified compression and adaptive layer voting. In ACM/IEEE Design Automation Conference, 2024

    2024

  77. [85]

    Deep learning based recommender system: A survey and new perspectives

    Shuai Zhang, Lina Yao, Aixin Sun, and Yi Tay. Deep learning based recommender system: A survey and new perspectives. ACM computing surveys, 2019

    2019

  78. [86]

    Effective prompt extraction from language models

    Yiming Zhang, Nicholas Carlini, and Daphne Ippolito. Effective prompt extraction from language models. In First Conference on Language Modeling, 2024

    2024

  79. [87]

    Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success

    Yiming Zhang and Daphne Ippolito. Prompts should not be seen as secrets: Systematically measuring prompt extraction attack success. arXiv preprint arXiv:2307.06865, 2023. 17

    2023 arXiv

  80. [2025]

    Accessed: 2025-01-22

    2025

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.