Characterizing Side-Channel Leakage of DNN Classifiers though Performance Counters

Rapid advancements in Deep Neural Networks (DNN) have led to their deployment in a wide range of com-mercial applications. DNN classifiers are powerful tools that drive a broad spectrum of important applications, from image recognition to autonomous vehicles. Like other applications, they have been shown to be vulnerable to side-channel information leakage. There have been several proof-of-concept attacks demon-strating the extraction of their model parameters and input data. However, no prior study has examined the possibility of using side-channels to extract the DNN classifier's decision or output. In this initial study, we aim to understand if there exists a correlation between the output class selected by a classifier and side-channel information collected while running the inference process on a CPU. Our initial evaluation shows that with the proposed approach it is possible to accurately recover the output class for model inputs via multiple side-channels: primarily power, but also branch mispredictions and cache misses.