# Side-Channel Analysis of OpenVINO-based Neural Network Models

**Authors:** Dirmanto Jap, Jakub Breier, Zdenko Lehocký, Shivam Bhasin, Xiaolu Hou  
**arXiv:** [2407.16467](https://arxiv.org/abs/2407.16467)  
**Date:** 2024-07-23  
**Summary page:** https://www.summarizepaper.com/en/paper/2407.16467v1/

## Key points

- Embedded devices with neural network accelerators offer convenience by reducing reliance on cloud-based services but come with new security challenges
- Security challenges include hardware attacks like side-channel analysis (SCA) which can compromise sensitive data
- Attack methods such as electromagnetic (EM) analysis and power side-channel attacks can reveal crucial model details
- Notable attack methods include DeepTheft targeting DNN models in MLaaS environments and Gamma-Knife leveraging software-based power side channels
- Countermeasures proposed to mitigate vulnerabilities include incorporating masking techniques into hardware design and utilizing modular arithmetic and Domain-Oriented Masking (DOM)
- Importance of addressing security concerns in embedded neural network deployments highlighted through experiments on GoogleNet v1
- Embedded devices play a crucial role in today's technology-integrated world, designed for specific tasks and often equipped with neural network accelerators for efficient processing

## Summary

, , , , 


In the realm of embedded devices with neural network accelerators, the convenience they offer in terms of reducing reliance on cloud-based services comes hand in hand with new security challenges. These challenges, particularly in the form of hardware attacks like side-channel analysis (SCA), have been extensively studied. Researchers have showcased how attackers can reverse-engineer model details such as activation functions, layer types, and even detailed hyperparameters through methods like electromagnetic (EM) analysis and power side-channel attacks. One notable attack method is DeepTheft, which targets DNN models deployed in Machine Learning as a Service (MLaaS) environments by exploiting power side channels. Another innovative approach called Gamma-Knife leverages software-based power side channels to extract neural network architectures without physical access or high-precision equipment. These attacks have demonstrated high accuracy in recovering key architectural details from popular neural networks like VGGNet and ResNet. On the flip side, researchers have proposed countermeasures to mitigate these vulnerabilities. One such approach involves incorporating masking techniques into hardware design to protect against differential power analysis attacks. Additionally, utilizing modular arithmetic and Domain-Oriented Masking (DOM) can enhance the security of neural networks while maintaining efficiency. In this paper, we focus on exploring the susceptibility of quantized models implemented in OpenVINO for embedded systems and edge devices to SCA. Through experiments on GoogleNet v1, we demonstrate that it is possible to recover model parameters with high precision, highlighting the importance of addressing security concerns in embedded neural network deployments. In today's world where technology is becoming increasingly integrated into our daily lives, embedded devices play a crucial role. They are small computing systems designed to perform specific tasks and are often equipped with neural network accelerators for efficient processing. These specialized hardware components are designed to accelerate the execution of neural networks, making them an essential part of embedded devices. They enable faster and more efficient processing, reducing reliance on cloud-based services. The use of embedded devices with neural network accelerators brings new security challenges. These include hardware attacks like side-channel analysis (SCA), which can compromise the confidentiality and integrity of sensitive data. Attackers can exploit vulnerabilities in embedded devices with neural network accelerators through various methods such as electromagnetic (EM) analysis and power side-channel attacks. These attacks can reveal crucial model details, posing a significant threat to the security of embedded systems. To mitigate these vulnerabilities, researchers have proposed countermeasures such as incorporating masking techniques into hardware design and utilizing modular arithmetic and Domain-Oriented Masking (DOM). These measures aim to enhance the security of embedded neural network deployments while maintaining efficiency.