Power-Based Attacks on Spatial DNN Accelerators

TL;DR

This paper demonstrates that realistic spatial DNN accelerators are vulnerable to power analysis attacks, with novel techniques able to extract models even from more complex 2D array architectures.

Contribution

It provides the first comprehensive analysis of power-based attacks on realistic 8-bit spatial DNN accelerators, revealing vulnerabilities and proposing advanced attack methods.

Findings

1D array fully broken with 20K traces

2D array more secure but still vulnerable with 460K traces

Template-based DPA can fully extract models from 2D array with 40K traces

Abstract

With proliferation of DNN-based applications, the confidentiality of DNN model is an important commercial goal. Spatial accelerators, that parallelize matrix/vector operations, are utilized for enhancing energy efficiency of DNN computation. Recently, model extraction attacks on simple accelerators, either with a single processing element or running a binarized network, were demonstrated using the methodology derived from differential power analysis (DPA) attack on cryptographic devices. This paper investigates the vulnerability of realistic spatial accelerators using general, 8-bit, number representation. We investigate two systolic array architectures with weight-stationary dataflow: (1) a 3 $\times$ 1 array for a dot-product operation, and (2) a 3 $\times$ 3 array for matrix-vector multiplication. Both are implemented on the SAKURA-G FPGA board. We show that both architectures are ultimately vulnerable. A conventional DPA succeeds fully on the 1D array, requiring 20K power measurements. However, the 2D array exhibits higher security even with 460K traces. We show that this is because the 2D array intrinsically entails multiple MACs simultaneously dependent on the same input. However, we find that a novel template-based DPA with multiple profiling phases is able to fully break the 2D array with only 40K traces. Corresponding countermeasures need to be investigated for spatial DNN accelerators.