Power2Picture: Using Generative CNNs for Input Recovery of Neural Network Accelerators through Power Side-Channels on FPGAs

Artificial neural networks pervade almost all areas of today's life, being used for both simple image classification tasks as well as highly complex decision making in mission-critical tasks. This makes artificial neural networks an attractive target for attackers to recover the model architecture or user inputs and outputs through either classical software vulnerabilities or hardware side-channel and fault attacks. With increasing complexity of the models, smaller companies now often opt for pre-trained public models, which are then used with potentially sensitive inputs, for instance, in medical applications. In this work, we present a novel remote side-channel attack methodology to steal neural network inputs using generative convolutional neural networks. After measuring voltage fluctuations using on-chip sensors, we are able to recover the original inputs to image classifiers on different FPGA platforms. Our results prove the effectiveness of our attack, as we are able to recover inputs from networks running on different devices, with different datasets, and under different operating conditions.