Reverse Engineering Neural Network Folding with Remote FPGA Power Analysis

Specialized hardware accelerators in the form of FPGAs are widely being used for neural network implementations. By that, they also become the target of power analysis attacks that try to reverse engineer the embedded secret information, in the form of model parameters. However, most of these attacks assume rather simple implementations, not realistic frameworks. Layer folding is used in such accelerators to optimize the network under given area constraints with various degrees of parallel and sequential operations. In this paper, we show that folding does mislead existing power side-channel attacks on frameworks such as FINN. We show how we can extract the folding parameters successfully and use that information to subsequently also recover the number of neurons–something not reliably possible without knowing the folding information. Following the methodologies of both profiling side-channel attacks and machine learning, our approach can extract the amount of neurons with 98% accuracy on a test device, compared to 44-79% accuracy based on related work under the same test conditions and datasets. Furthermore, we show how a classifier that is based on regression can detect previously unknown parameters, which has not been shown before. To verify our results under different environmental conditions, we test the target device in a climate chamber under various temperature ranges and still reach accuracies of at least 93%.