ML-Assisted Power Side-Channel Attacks on ML Accelerators in Shared FPGAs

What it is

Etim, Erol and Szefer (Yale, Northwestern) describe a remote power side-channel attack in which a co-tenant on a shared FPGA uses on-chip Time-to-Digital Converter (TDC) sensors to recover a victim's CNN input images. The target is ImageNet-scale (224×224) color input. Prior TDC attacks recovered only MNIST/Fashion-MNIST-scale grayscale images (28×28). The authors call this a proof-of-concept leakage study, not an end-to-end attack on a deployed model.

How it works

The page describes two attacks, and the summary covers only the first.

• Image reconstruction: The attacker recovers a grayscale reconstruction from TDC traces. Interpolation-based upscaling (software and hardware) and learned recoloring then produce a full-scale color image. Recoloring is generative, so the paper quantifies in its Section 6.2 how much of the output is real leakage and how much is ML-synthesized.
• Hamming-weight classification: The side channel leaks the Hamming weight of processed pixel data. The attacker recovers a "scaled Hamming-weight" version of the image and feeds it to trained classifiers. This identifies the image's class without recovering full-color pixels.

The victim runs only the first convolution layer of a VGG-16/VGG-19-style CNN. The experiments are on a Xilinx ZYNQ-based PYNQ-Z2 board. The authors find that visually high-contrast images are the easiest to attack, and they define a contrast metric to confirm this.

Preconditions / Affected

• A multi-tenant FPGA where attacker and victim logic share the power delivery network.
• Unencrypted input reaching the accelerator. The paper explicitly excludes ML on homomorphically encrypted data.
• The page cites AWS EC2 F2 instances and SmartSSDs as cloud FPGA context, but it does not claim these were attacked.

What to do

The page states no patch or detection. The defense it tests is a pixel substitution: each pixel is replaced, within a fixed intensity budget, by a value with a different Hamming weight. This lowers the contrast the attacker sees while the image looks similar. Results:

• It degrades the attacker's original models on the selected test images.
• On the full ImageNet validation set it costs the victim's accuracy considerably more than the attacker's.
• An attacker retrained on substituted images regains accuracy at the largest budget for every architecture tested.

The practical takeaway is not to rely on a fixed, public input mapping. The authors say robust defenses need randomized or input-dependent transformations. The page also implies that tenant isolation on shared FPGAs is the more direct control.

Caveats

• The authors state that the victim is deliberately limited to the first convolution layer, under favorable measurement conditions. Their Section 10 discusses these assumptions, but it was not in the fetched text.
• Recolored output is partly generated, so visual fidelity overstates the leaked information.
• The fetched text is truncated in the threat model section. Quantitative results (accuracy and image-quality numbers) are not available here, so check the paper before citing any.