Paper says power analysis struggles to extract full model weights
Original title: ML Models Are Not Ciphers: Power Analysis for Weight Extraction Is Harder Than You Think
Even a noiseless leakage adversary needs many traces, and deep-layer recovery suffers as models reduce entropy.
A cs.CR paper challenges treating machine-learning models as ciphers whose secret weights can be fully recovered by cryptographic power analysis. Prior proofs of concept recovered only a few weights, typically from shallow layers of untrained networks. The authors study complete, fully trained networks and report that limited-precision floating-point arithmetic and low diffusion make recovery harder than for ciphers.
Unconfirmed: Difficulty is shown under an idealized noiseless channel, not on a measured device.
- The adversary is assumed to see leakage-model output with no added noise.
- Targets are fully trained functional networks, not random initializations.
- Low-diffusion linear operations can require an unexpectedly large number of traces.
- Models reduce data entropy, hampering recovery in deeper layers.
From the original article
1 min read at arxiv.orgCan power-analysis techniques reveal secret weights of machine-learning models? Multiple recent works demonstrate proof-of-concept attacks that can partially recover such weights. To that end, these works build on techniques from cryptographic engineering, treating the model as a ``cipher'' and its secret weights as keys.
By Mohammed Qaiss · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.