Paper deep dive
Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights
Timon Lumír Fillo, Ján Mikulec, Anubhab Baksi, Jakub Breier, Xiaolu Hou
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Neural-network parameters deployed on embedded devices may be exposed through physical side-channel leakage during inference. Existing side-channel attacks on floating-point neural-network parameters have often targeted reduced numerical precision, while recovering the complete IEEE-754 representation remains considerably more challenging because of the large and structured 32-bit candidate space. We present a profiled template attack for bit-exact recovery of an IEEE-754 single-precision neural-network weight from power measurements. The attack targets the floating-point multiplication between a known input and a first-layer weight. During profiling, multivariate Gaussian templates are learned from randomized network configurations using Hamming-weight classes of the multiplication result, while the remaining network parameters act as nuisance variables. To efficiently search the structured 32-bit floating-point candidate space, we use a hierarchical coarse-to-fine-to-exact procedure that progressively increases both the numerical and leakage-model resolution. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 demonstrate recovery of the exact float32 representation of the target weight. In the evaluated setting, the attack reaches a bit-exact success rate of 99% with 171 traces and 100% from 263 traces onward. These results demonstrate that profiling can enable practical full-precision extraction of floating-point neural-network parameters from physical leakage.
Tags
Links
- Source: https://arxiv.org/abs/2610.04436v1
- Canonical: https://arxiv.org/abs/2610.04436v1
Trouble viewing inline? Open PDF directly →
Full Text
54,128 characters extracted from source content.
Expand or collapse full text
Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights Timon Lumír Fillo Affiliation: Slovak University of Technology, Bratislava, Slovakia E-mail xfillo@stuba.sk, jan.mikulec@stuba.sk, houxiaolu.email@gmail.com Ján Mikulec Affiliation: Slovak University of Technology, Bratislava, Slovakia E-mail xfillo@stuba.sk, jan.mikulec@stuba.sk, houxiaolu.email@gmail.com Anubhab Baksi Affiliation: Indian Institute of Technology Bhilai, India E-mail anubhab.baksi@eit.lth.se Jakub Breier Affiliation: TTControl GmbH, Vienna, Austria E-mail jbreier@jbreier.com Xiaolu Hou Affiliation: Slovak University of Technology, Bratislava, Slovakia E-mail xfillo@stuba.sk, jan.mikulec@stuba.sk, houxiaolu.email@gmail.com Abstract Neural-network parameters deployed on embedded devices may be exposed through physical side-channel leakage during inference. Existing side-channel attacks on floating-point neural-network parameters have often targeted reduced numerical precision, while recovering the complete IEEE-754 representation remains considerably more challenging because of the large and structured 32-bit candidate space. We present a profiled template attack for bit-exact recovery of an IEEE-754 single-precision neural-network weight from power measurements. The attack targets the floating-point multiplication between a known input and a first-layer weight. During profiling, multivariate Gaussian templates are learned from randomized network configurations using Hamming-weight classes of the multiplication result, while the remaining network parameters act as nuisance variables. To efficiently search the structured 32-bit floating-point candidate space, we use a hierarchical coarse-to-fine-to-exact procedure that progressively increases both the numerical and leakage-model resolution. Experiments on a ChipWhisperer-Lite with an Arm Cortex-M4 demonstrate recovery of the exact float32 representation of the target weight. In the evaluated setting, the attack reaches a bit-exact success rate of 99% with 171 traces and 100% from 263 traces onward. These results demonstrate that profiling can enable practical full-precision extraction of floating-point neural-network parameters from physical leakage. Keywords: Template attack Neural networks Side-channel attacks. 1 Introduction Neural-network models deployed on embedded and edge devices often represent valuable intellectual property, as their trained parameters encode knowledge obtained through costly data collection and optimization. At the same time, executing neural-network inference on physical devices can expose model information through side-channel leakage [4, 7]. Power consumption and electromagnetic emanations generated during arithmetic operations may depend on the processed data and model parameters, enabling an adversary with physical measurement capabilities to infer information about the internal model. Prior work has demonstrated that side-channel leakage can reveal neural-network architectures, processed inputs, and model parameters [1, 13, 9, 11]. Parameter recovery attacks have predominantly relied on non-profiled techniques such as correlation power or electromagnetic analysis, while previous applications of template attacks to neural-network implementations have mainly considered input recovery. Several existing side-channel attacks on neural-network parameters assume a limited numerical precision when recovering floating-point weights [1, 12]. More recent approaches have addressed higher-precision floating-point parameter recovery using iterative or IEEE-754-aware correlation-based techniques [9, 11]. Bit-exact recovery has been shown in [3] where the authors utilized a fault injection attack to reverse-engineer the last layer of the network. In contrast, this work investigates exact 32-bit weight recovery in a profiled setting, where candidate hypotheses are evaluated using learned multivariate leakage templates rather than direct correlation with the measured traces. To the best of our knowledge, a profiled template attack specifically targeting bit-exact 32-bit floating-point neural-network weight recovery has not previously been investigated. We investigate a profiled template attack that targets the multiplication between a known network input and the first weight of the first layer. During profiling, traces are collected across randomized network configurations for which the corresponding profiling value of the attacked weight is known, while the remaining parameters are treated as nuisance variables. The resulting templates characterize the leakage of the floating-point intermediate float32(wx)float32(wx) and are subsequently used to evaluate candidate weights on a fixed target network. Weight hypotheses are ranked by their accumulated template likelihood over multiple attack traces, allowing the unknown parameter to be recovered without directly correlating the measured traces with hypothetical leakage values. A key challenge is that the target parameter is represented as a 32-bit IEEE-754 floating-point value, resulting in a large and finely structured candidate space. To make exact recovery practical, we use a hierarchical coarse-to-fine-to-exact search that progressively increases the resolution of the leakage model. The initial stages use only the most significant parts of the floating-point representation to identify promising regions, while the final stage evaluates neighboring representable float32 values using the complete 32-bit leakage model. This strategy combines efficient candidate reduction with bit-exact recovery of the target weight. The main contributions of this work are as follows. • We present a profiled template attack for recovering an IEEE-754 single-precision neural-network weight from physical side-channel measurements. • We construct leakage templates across randomized network configurations that can be applied to recover an unknown target weight with no knowledge of the remaining model parameters. • We introduce a hierarchical coarse-to-fine-to-exact search that enables practical and bit-exact 32-bit weight recovery. • We experimentally demonstrate bit-exact recovery of the targeted float32 weight and quantify the attack efficiency through a success-rate analysis, achieving 99% success with 171 attack traces and 100% success from 263 traces onward in the evaluated setting. 2 Background and Related Work 2.1 Side-Channel Analysis Attacks on Neural Networks During neural-network [6] inference, each layer transforms its input activations through operations such as weighted multiplications, accumulations, and nonlinear activation functions. In a fully connected layer, for example, the output of a neuron is obtained from a weighted sum of its inputs followed by an activation function. Since these computations repeatedly process network parameters and intermediate activations, their execution may produce data-dependent physical leakage. Side-channel analysis (SCA) can exploit such leakage to infer sensitive information about a neural-network implementation. Depending on the attack objective, the targeted information may include the network architecture, trained parameters, or data processed by the model. An adversary can observe physical characteristics of the implementation, including execution time, power consumption, or electromagnetic (EM) emissions, while the network performs inference or training. Previous studies have shown that timing leakage can reveal information about activation functions [1], while power and EM measurements can disclose information about network inputs [2] or structural properties of the model, such as the types of executed layers [14]. Particularly relevant to parameter extraction are attacks based on correlation power analysis (CPA) [1, 12, 10]. In CPA, an attacker generates hypothetical intermediate values for different candidate parameters and maps them to predicted leakage values using a suitable leakage model. The predicted leakage is then statistically correlated with the measured power or EM traces. A candidate producing a consistently high correlation is considered more likely to correspond to the secret parameter. The effectiveness of this approach relies on the relationship between the data manipulated during neural-network computation and the resulting physical leakage. 2.2 Template Attacks Template attacks are a class of profiled side-channel attacks in which an adversary first characterizes the leakage behavior of a device under controlled conditions and subsequently uses the resulting statistical model to recover an unknown sensitive value [5]. In the classical setting, profiling traces with known intermediate values are used to construct multivariate leakage distributions at selected points of interest. During the attack phase, candidate hypotheses are evaluated according to their likelihood under these templates. For each leakage class c, the leakage vector t is commonly modeled using a multivariate Gaussian distribution, |c∼(c,c),t c ( μ_c, _c ), where c μ_c and c _c denote the class-dependent mean vector and covariance matrix, respectively. Template attacks have also been considered in the context of neural-network implementations. Wei et al. [13] applied a power template attack to an FPGA-based convolutional neural-network accelerator with the objective of reconstructing the network input from side-channel measurements. Their attack targets information related to the processed image rather than the model parameters. To the best of our knowledge, previous applications of classical template attacks to neural-network implementations have primarily focused on input recovery, and we are not aware of prior work applying a profiled template attack specifically to the recovery of floating-point neural-network weights. This motivates the study of template-based parameter recovery considered in this work. 2.3 IEEE-754 Floating-Point Representation The target implementation represents neural-network weights, inputs, and intermediate values using IEEE-754 single-precision floating-point numbers [8]. A 32-bit floating-point value consists of one sign bit, eight exponent bits, and twenty-three fraction bits, b31…b0=b31⏟signb30…b23⏟exponentb22…b0⏟fraction.b_31… b_0= b_31_sign b_30… b_23_exponent b_22… b_0_fraction. The IEEE-754 standard refers to the lower 2323 stored bits as the fraction field. These bits are also commonly referred to informally as the mantissa bits; in this work, we use the term fraction bits throughout. For a normalized value, the represented number is x=(−1)s(1+M223)2E−127,x=(-1)^s (1+ M2^23 )2^E-127, where s is the sign bit, E denotes the unsigned exponent field, and M is the integer represented by the fraction bits. This representation is relevant to side-channel analysis because arithmetic operations manipulate data whose binary encoding depends on the sign, exponent, and fraction fields. In particular, numerically close floating-point values may differ only in a small number of fraction bits, while larger numerical changes may also modify the exponent field. These properties influence the leakage models used for recovering floating-point neural-network parameters. The hierarchical recovery strategy in this work exploits this structure by increasing the number of considered fraction bits across three stages. A reduced-bit representation is used for the initial search to provide robustness over a wide candidate range, while progressively more bits are included during refinement to distinguish increasingly close floating-point candidates. 3 Threat Model and Experimental Setup 3.1 Threat Model We consider a profiled adversary. The adversary knows the network architecture and the position of the targeted multiplication in the forward pass, can choose the network input x, and can measure the power consumption of the target device during inference. For profiling, the adversary has a device of the same type that can be programmed with weights of the adversary’s choice, so the targeted weight is known for every profiling trace. On the attacked device, the weights are fixed and unknown. In our experiments, the profiling and attack traces are acquired on the same physical board, which is re-programmed between the two phases. 3.2 Target Neural Network We consider a feed-forward neural network implemented in software on the target microcontroller. The network consists of four layers with 77, 55, 44, and 33 neurons, respectively. The first layer represents the input layer, while the following three layers are fully connected. The hidden layers use the ReLU activation function, whereas the output layer applies a sigmoid activation. All weights and intermediate values are represented as IEEE-754 single-precision floating-point numbers. The objective of the attack is to recover the first weight of the first fully connected layer, w⋆=W0,0(1).w =W^(1)_0,0. In the fixed target network used during the attack phase, this weight is set to 1.431.43 in the firmware source. At run time, the device stores the nearest float32 value, 1.42999994754791…1.42999994754791… (bit pattern 0x3FB70A3D). The targeted weight is particularly suitable for a first side-channel analysis because it is involved in a multiplication with an attacker-chosen input. For each inference, the attacker supplies a floating-point value x, which is assigned to the first neuron of the input layer. The remaining input neurons keep their fixed initial activation of 0.50.5. During the forward pass, the first neuron of the first hidden layer therefore computes a term of the form z0(1)=b0(1)+w⋆x+∑j=16W0,j(1)aj(0),z_0^(1)=b_0^(1)+w x+ _j=1^6W^(1)_0,ja_j^(0), where aj(0)a_j^(0) denotes the activation of input neuron j and b0(1)b_0^(1) is the neuron bias. In the implemented network, the biases are initialized to zero. The forward pass processes the neurons in order, starting with the first input of the first neuron. The first multiplication of the whole inference is consequently v=float32(w⋆x).v=float32(w x). The target microcontroller (STM32F303) has a hardware floating-point unit, but the firmware is compiled with the ChipWhisperer default -mfloat-abi=soft. Every floating-point multiplication is therefore executed by a software library routine that processes the sign, exponent, and fraction of the operands with integer instructions. This intermediate value is the leakage target considered throughout this work. Since x is known to the attacker, each candidate value w w induces a hypothetical intermediate v^=float32(w^x), v=float32( wx), from which a corresponding leakage class can be predicted. The attack therefore does not attempt to observe the weight value directly. Instead, it exploits the data-dependent leakage generated while the processor evaluates the floating-point multiplication between the unknown weight and the known input. Targeting the first weight also limits uncertainty in the processed operand. For weights in later layers, the corresponding input activation depends on previous weighted sums and nonlinear activation functions and is therefore generally unknown unless earlier network parameters are already available. In contrast, for W0,0(1)W^(1)_0,0 one operand of the multiplication is directly selected by the attacker. This makes the first weight a natural target for evaluating the feasibility of profiled template-based neural-network parameter recovery. Although the analysis focuses on a single weight, the complete forward pass is executed during every measurement. Consequently, the measured power traces contain leakage not only from the targeted multiplication but also from the remaining multiplications, additions, activation functions, and control operations of the network. During profiling, the non-target weights are varied together with the target weight and are not explicitly incorporated into the leakage model. They therefore act as nuisance parameters whose contribution must be tolerated by the profiling procedure. 3.3 Profiling Scenario The profiling phase is used to characterize the side-channel leakage of the targeted floating-point multiplication. For this purpose, all network weights are drawn at random from the interval [−2,2][-2,2], and a new random configuration is generated every 100100 traces (Section 3.5). The targeted weight W0,0(1)W^(1)_0,0 is known during profiling. For every acquired trace, the corresponding input value x and the current value of the targeted weight are stored together with the power measurement. This information allows the intermediate product v=float32(W0,0(1)x)v=float32(W^(1)_0,0x) to be reconstructed exactly for the profiling measurements. The remaining network weights are also randomized, while the biases stay zero in both phases. However, the non-target weights are not used by the leakage model and are not required during template construction. They therefore act as nuisance parameters whose influence is implicitly captured in the measured power traces. This profiling setting is intended to reduce dependence on one particular fixed network configuration. The profiling dataset contains 50,00050,000 traces. The network configuration is refreshed once every 100100 traces. Consequently, the dataset contains 500500 distinct randomized network configurations. Within each configuration, the weight values remain fixed while different input values are applied. Let the profiling dataset be denoted by prof=(xi,wi,i)i=1Nprof,D_prof= \ (x_i,w_i,T_i ) \_i=1^N_prof, where xix_i is the known network input, wiw_i is the known value of the targeted weight, and iT_i is the corresponding measured power trace. In our experiments, Nprof=50,000.N_prof=50,000. For each profiling measurement, the known pair (xi,wi)(x_i,w_i) is used to compute the hypothetical intermediate processed by the target device. The corresponding leakage class is then derived from the IEEE-754 representation of the product. These labeled profiling traces are subsequently used for point-of-interest selection and for construction of the multivariate Gaussian templates described in Section 4. The profiling phase is performed independently from the attack phase. In particular, the fixed target-network weight used during the attack is not required for template construction. The templates characterize the leakage associated with classes of floating-point multiplication results rather than with individual weight values. As a result, the same profiling model can be evaluated against candidate weights of an independently configured target network. 3.4 Attack Scenario During the attack phase, the neural-network configuration is fixed and the value of the targeted weight W0,0(1)W^(1)_0,0 is unknown to the attacker. The attacker can provide the input value x and acquire the corresponding power trace generated during network inference. Unlike the profiling phase, the value of the targeted weight is not included in the attack-trace metadata. The attack dataset is represented as attack=(xi,i)i=1Nattack,D_attack= \ (x_i,T_i ) \_i=1^N_attack, where xix_i denotes the known input value and iT_i is the corresponding measured power trace. The unknown parameter w⋆w remains constant across all traces because the same target network is used throughout the attack experiment. For a candidate weight w w, the attacker computes the hypothetical intermediate v^i=float32(w^xi). v_i=float32( wx_i). The IEEE-754 representation of v^i v_i is then mapped to a leakage class according to the leakage model established during profiling. The measured trace iT_i is compared with the template corresponding to this hypothetical class. Each attack trace therefore provides statistical evidence about the correctness of the candidate weight. Evidence from multiple traces is accumulated using the template log-likelihood, L(w^)=∑i=1Nattacklogp(i∣ci(w^)),L( w)= _i=1^N_attack p (t_i c_i( w) ), where it_i denotes the samples of trace iT_i at the selected points of interest and ci(w^)c_i( w) is the hypothetical leakage class predicted for candidate w w. The candidate with the highest accumulated likelihood is considered the most plausible value of the targeted weight. To avoid evaluating the complete IEEE-754 weight space directly, the attack applies the hierarchical coarse-to-fine-to-exact search described in Section 4.5. The search progressively reduces the candidate space while increasing the precision of the leakage model. For experimental validation, the true weight value is known to the evaluator from the fixed network configuration. This value is used only to assess whether the attack successfully recovered the targeted parameter and is not used during candidate scoring or template matching. 3.5 Measurement Platform Power measurements are acquired with a ChipWhisperer-Lite and its integrated STM32F303 (Arm Cortex-M4) target (CWLITEARM). The firmware is programmed through the STM32 serial bootloader. The scope uses the ChipWhisperer default settings: the target is clocked at 7.377.37 MHz, the ADC samples at four times the target clock (29.4829.48 MS/s), and the gain is 2525 dB. Communication between the host and the target is implemented using the ChipWhisperer SimpleSerial protocol. The capture script uses a single fixed acquisition window for every inference. Each trace contains 24,40024,400 samples (about 6,1006,100 target clock cycles), close to the capture-buffer limit of the ChipWhisperer-Lite. No sample decimation is applied, i.e., the decimation factor is set to one. Before collecting either the profiling or attack dataset, 5050 dummy inferences are executed to allow the target and measurement setup to reach a stable operating state. A hardware trigger is used to delimit the neural-network inference operation. Immediately before execution of the forward pass, the firmware raises the trigger signal using trigger_high(). The trigger is lowered using trigger_low() after the complete forward pass has finished. The acquisition window starts at the rising edge of the trigger and has a fixed length. The acquisition window therefore begins shortly before the targeted multiplication and also contains the subsequent forward-pass operations. The analysis uses only the first 1,0001,000 samples (250250 clock cycles) of each trace, which contain the targeted multiplication. The host supplies the network input through a SimpleSerial p command. The input value is represented as an IEEE-754 single-precision floating-point number and packed into the first four bytes of a 1616-byte command payload. Upon receiving the command, the firmware assigns this value to the first input neuron and executes the network forward pass. A separate SimpleSerial k command is used to configure the weights. During profiling, the host sends a 3232-bit random seed to the target. The firmware initializes its pseudo-random number generator with this seed and generates all network weights uniformly in the interval [−2,2][-2,2]. The generated configuration remains unchanged for a batch of 100100 consecutive measurements. The firmware additionally returns the first weight of the first layer to the host, allowing the attacked parameter to be associated with the corresponding profiling traces. During the attack phase, the firmware is rebuilt with the fixed target-network parameters. The same k command sequence is retained in order to preserve a similar communication procedure between profiling and attack acquisition. However, the random values generated in response to this command do not replace the fixed attack weights. Thus, only the network input varies between attack measurements, while the unknown target weight remains constant. The input values used in both phases are generated independently from a uniform distribution, x∼(−1,1).x (-1,1). A fixed host-side random seed is used to make the acquisition procedure reproducible. The profiling and attack measurements are stored in separate ChipWhisperer projects. The profiling project contains 50,00050,000 traces, while the attack project contains 5,0005,000 traces. For profiling traces, the stored metadata contain both the applied input and the corresponding first-layer target weight. For attack traces, only the applied input is stored, reflecting the assumption that the target weight is unknown during the recovery phase. 4 Profiled Template Attack This section presents the proposed profiled template attack for recovering the targeted neural-network weight. Section 4.1 defines the floating-point leakage model, Section 4.2 describes the selection of points of interest, and Section 4.3 explains the construction of the Gaussian templates. Section 4.4 introduces the likelihood-based candidate scoring, while Section 4.5 describes the coarse-to-fine-to-exact recovery procedure. 4.1 Leakage Model The proposed attack targets the intermediate value produced by the floating-point multiplication between the known input x and a candidate weight w. For each trace, the corresponding intermediate is modeled as v=float32(wx).v=float32(wx). We assume that the instantaneous power consumption depends on the binary representation of this intermediate value. The leakage is therefore modeled using the Hamming weight of selected bits of the IEEE-754 single-precision representation of v. Let Bm(v)B_m(v) denote the m most significant bits of the IEEE-754 representation of v, i.e., the sign bit, the 88 exponent bits, and the first m−9m-9 fraction bits. The leakage class at resolution m is defined as cm(v)=HW(Bm(v)).c_m(v)=HW (B_m(v) ). To support efficient candidate refinement, three leakage resolutions are used. The coarse model considers the sign bit, the 88 exponent bits, and the 88 most significant fraction bits, resulting in 1717 modeled bits and 1818 possible Hamming-weight classes. The fine model extends the fraction contribution to 1414 bits, resulting in 2323 modeled bits and 2424 possible classes. The exact model uses the complete 3232-bit IEEE-754 representation and therefore contains 3333 possible Hamming-weight classes. The three leakage models can be written as ccoarse(v) c_coarse(v) =HW(B17(v)), =HW (B_17(v) ), cfine(v) c_fine(v) =HW(B23(v)), =HW (B_23(v) ), cexact(v) c_exact(v) =HW(B32(v)). =HW (B_32(v) ). Using fewer fraction bits in the first stages makes the model tolerant to small errors in the candidate weight. A candidate that is close to, but not exactly equal to, the true weight produces a product whose upper bits mostly agree with the true product, while its lower fraction bits are effectively random. The unmodeled bits still influence the measured leakage, and their contribution becomes part of the noise captured by the template covariance. Increasing the number of modeled bits makes the model more selective, but it also requires the candidate to be closer to the true weight. The full 3232-bit model is finally used in the exact stage, where the candidates are individual float32 values. During profiling, the true intermediate value is available because both x and the profiling weight are known. During the attack, the same leakage classes are computed hypothetically for each candidate weight w w as cm(w^,x)=HW(Bm(float32(w^x))).c_m( w,x)=HW (B_m (float32( wx) ) ). These hypothetical classes determine which profiling template is used to evaluate each candidate against the measured attack traces. 4.2 Point-of-Interest Selection The points of interest (POIs) are selected from the profiling traces by identifying time samples whose measured leakage is most strongly correlated with the targeted floating-point multiplication. For each profiling trace i, the exact intermediate value vi=float32(wixi)v_i=float32(w_ix_i) is known from the profiling input xix_i and profiling weight wiw_i. A scalar leakage label is assigned to each profiling trace using the Hamming weight of the complete 3232-bit IEEE-754 representation of viv_i, hi=HW(B32(vi)).h_i=HW (B_32(v_i) ). For every time sample s in the analysis window (the first 1,0001,000 samples of each trace), the Pearson correlation coefficient between the measured trace samples and the leakage labels is then computed as ρs=corr((T1[s],…,TN[s]),(h1,…,hN)). _s=corr ( (T_1[s],…,T_N[s] ), (h_1,…,h_N ) ). The samples are ranked according to the absolute correlation magnitude |ρs|| _s|. To avoid selecting several samples from the same local leakage peak, a minimum temporal separation is enforced between selected POIs. In the current implementation, five POIs are retained, with a minimum spacing of 2020 samples between them. Let the selected positions be denoted by =p1,p2,…,p5.P=\p_1,p_2,…,p_5\. Each power trace is subsequently reduced to the five-dimensional leakage vector i=[Ti[p1],Ti[p2],Ti[p3],Ti[p4],Ti[p5]].t_i= [T_i[p_1],T_i[p_2],T_i[p_3],T_i[p_4],T_i[p_5] ]. The selected POIs are shared by the coarse, fine, and exact template sets. Only the leakage-class definition changes between the three stages, while the same five time samples are used for template construction and candidate evaluation. 4.3 Template Construction The profiling traces are grouped according to the leakage classes defined in Section 4.1. Each profiling leakage vector it_i (Section 4.2) is labeled with the Hamming-weight class ci=cm(vi)c_i=c_m(v_i) of its known intermediate value. For each class c, the class mean is estimated as c=1Nc∑i:ci=ci, μ_c= 1N_c _i:c_i=ct_i, where NcN_c denotes the number of profiling traces assigned to class c. Instead of estimating a separate covariance matrix for every class, the implementation uses a pooled covariance matrix shared across all classes. This reduces the number of parameters that must be estimated and improves numerical stability for sparsely populated classes. The pooled covariance is computed from the deviations of the profiling vectors from their corresponding class means, =1Nℳ∑c∈ℳ∑i:ci=c(i−c)(i−c)T, = 1N_M _c _i:c_i=c (t_i- μ_c ) (t_i- μ_c )^T, where ℳM is the set of classes with enough profiling traces for a direct estimate (see below) and Nℳ=∑c∈ℳNcN_M= _c N_c is the number of profiling traces in these classes. Each leakage class is therefore represented by a multivariate Gaussian template, |c∼(c,).t c ( μ_c, ). A class mean is estimated directly only when at least 3030 profiling traces are available for that class. Classes with fewer observations are treated as insufficiently populated. Their mean vectors are obtained by extrapolation: for every POI, a straight line is fitted through the means of the sufficiently populated classes as a function of the Hamming weight (least squares, with each class weighted by its number of traces NcN_c), and the line is evaluated at the missing classes. Such a class is therefore not treated as impossible; a hypothesis that requires it simply receives a low likelihood when its predicted mean is far from the measured leakage. Three independent template sets are constructed according to the three leakage resolutions, with 1818 coarse, 2424 fine, and 3333 exact classes. The number of classes estimated directly and by extrapolation in the recorded profiling dataset is reported in Section 5.1. The resulting template sets are subsequently used in the corresponding stages of the hierarchical search. The coarse templates provide robust discrimination over the complete weight interval, the fine templates refine the most likely regions, and the exact templates are used for the final float32-level recovery. 4.4 Candidate Likelihood During the attack phase, each candidate weight is evaluated according to how well its predicted leakage classes explain the measured power traces. For a candidate weight w w and known input xix_i, the hypothetical intermediate value is computed as v^i=float32(w^xi). v_i=float32( wx_i). The corresponding leakage class is then obtained using the leakage model of the current search stage, ci(w^)=HW(Bm(v^i)),c_i( w)=HW (B_m( v_i) ), where m=17m=17, 2323, or 3232 for the coarse, fine, or exact model, respectively. Given the predicted class ci(w^)c_i( w), the five-dimensional attack leakage vector it_i is evaluated using the corresponding Gaussian template. The log-likelihood contribution of trace i is ℓi(w^)=logp(i∣ci(w^)). _i( w)= p (t_i c_i( w) ). Using the multivariate Gaussian model, this can be expressed as ℓi(w^)=−12(i−ci(w^))T−1(i−ci(w^))+K, _i( w)=- 12 (t_i- μ_c_i( w) )^T ^-1 (t_i- μ_c_i( w) )+K, where K contains terms that are constant with respect to the candidate weight. Since the covariance matrix is shared across leakage classes, these constant terms do not affect candidate ranking and can be omitted during implementation. With the constant omitted, every contribution ℓi(w^) _i( w) is non-positive. Assuming that the attack traces are independent given their leakage classes, the evidence from multiple traces is accumulated by summing their log-likelihood contributions, L(w^)=∑i=1Nattackℓi(w^).L( w)= _i=1^N_attack _i( w). A correct candidate is expected to predict leakage classes that are consistently compatible with the measured traces. Incorrect candidates produce different hypothetical multiplication results and therefore different leakage-class sequences, resulting in lower accumulated likelihoods. The candidate with the highest accumulated score is selected as w^⋆=argmaxw^L(w^). w = _ wL( w). The same likelihood formulation is used in all three stages of the attack. The stages differ only in the candidate search space and in the resolution of the corresponding leakage templates. 4.5 Hierarchical Weight Recovery To avoid an exhaustive search over the complete IEEE-754 single-precision space, the proposed attack uses a hierarchical recovery procedure composed of coarse, fine, and exact stages. Each stage evaluates candidate weights using the likelihood function introduced in Section 4.4, while progressively increasing the resolution of both the candidate search and the leakage model. Coarse search. The first stage searches the complete assumed weight interval w^∈[−2,2] w∈[-2,2] with a step size of 10−410^-4. This results in 40,00140,001 candidate weights. Each candidate is evaluated using the coarse template set based on the sign bit, exponent bits, and the 88 most significant fraction bits of the multiplication result. After likelihood accumulation over the available attack traces, the six highest-scoring separated peaks are retained. A minimum separation of 0.0050.005 is enforced between selected peaks to avoid retaining several neighboring candidates corresponding to the same local maximum. Fine search. Each of the six coarse finalists is refined independently within a local interval of ±10−4± 10^-4 around the corresponding coarse estimate. The local search uses a step size of 10−610^-6, resulting in 201201 candidates per coarse finalist. The candidate likelihoods are recomputed using the fine template set, which includes 1414 fraction bits in addition to the sign and exponent bits. The best candidate from each local region is retained, producing six refined candidates. The refined candidate with the highest fine-stage likelihood is then selected for exact recovery. Exact search. The best fine candidate is interpreted directly as an IEEE-754 single-precision value. Its neighboring representable float32 values are enumerated within ±512± 512 units in the last place (ULPs). These values are additionally evaluated with both signs and scaled by 2j2^j for j∈−10,…,10j∈\-10,…,10\, and candidates outside [−2,2][-2,2] are discarded. The scaled variants ±w^ 2j± w\,2^j have exactly the same fraction bits as w w, so their products differ from the true product only in the sign and exponent bits. The coarse and fine models cannot separate them reliably (Section 5.2), and the exact stage must be able to reach the true weight even if the fine stage selected one of these look-alikes. For a fine result close to 1.431.43, this gives 1,0251,025 neighboring values, 1111 scales that stay within [−2,2][-2,2], and 22 signs, i.e., 22,55022,550 exact candidates. Each remaining candidate is evaluated using the exact template set based on the complete 3232-bit representation of the hypothetical multiplication result, ci(w^)=HW(B32(float32(w^xi))).c_i( w)=HW (B_32 (float32( wx_i) ) ). The candidate with the highest accumulated exact-template likelihood is returned as the recovered weight, w^⋆=argmaxw^∈exactLexact(w^). w = _ w _exactL_exact( w). The hierarchical procedure therefore reduces the search space progressively. The coarse stage identifies promising regions over the full weight interval, the fine stage resolves nearby numerical candidates, and the exact stage distinguishes neighboring IEEE-754 representations and power-of-two look-alikes to obtain a bit-precise float32 estimate. 5 Experimental Results 5.1 Profiling Leakage The profiling traces exhibit clear data-dependent leakage associated with the targeted floating-point multiplication. Using the full 3232-bit Hamming-weight model defined in Section 4.1, the correlation analysis described in Section 4.2 identifies several distinct leakage peaks within the analysis window. The five selected points of interest are located at sample indices =518, 569, 622, 657, 737.P=\518,\,569,\,622,\,657,\,737\. The correlation is negative at all five POIs, and its absolute value lies between 0.740.74 and 0.930.93. This indicates a strong statistical dependence between the measured power consumption and the Hamming weight of the floating-point multiplication result. Figure 1 shows the correlation for every sample of the analysis window together with the selected POIs. The first ≈400≈ 400 samples show almost no correlation, which is consistent with the operations executed between the trigger and the start of the multiplication. The several strong and temporally separated peaks after that suggest that the intermediate value influences the measured leakage at multiple points during the software multiplication routine and the operations that follow it, such as storing the product and adding it to the neuron’s sum. Figure 1: Pearson correlation between the profiling traces and the Hamming weight of the full 3232-bit product v=float32(wx)v=float32(wx) for every sample of the analysis window. The red markers are the five selected POIs. The profiling data are subsequently divided into Hamming-weight classes for construction of the coarse, fine, and exact templates. Not all theoretically possible classes are sufficiently represented in the profiling dataset. By using a minimum threshold of 3030 traces per class, 1111 of the 1818 coarse classes, 1313 of the 2424 fine classes, and 1616 of the 3333 exact classes are estimated directly from measured traces. The remaining class means are obtained through the extrapolation procedure described in Section 4.3. Figure 2 shows the resulting class means at the first POI. For all three template sets, the means of the measured classes decrease almost linearly with the Hamming weight, which supports the linear extrapolation of the missing classes. The error bars show the standard deviation of the noise at this POI. It is two to three times larger than the difference between neighboring class means, so a single trace carries little information and evidence from many traces has to be combined. Figure 2: Template means at the first POI for the coarse (left), fine (middle), and exact (right) template sets. Blue: classes estimated from at least 3030 profiling traces, with error bars of one standard deviation of the noise. Gray: extrapolated classes. These results confirm that the targeted multiplication produces sufficiently strong leakage for template construction, while also illustrating the increasing sparsity of Hamming-weight classes as more IEEE-754 bits are included in the leakage model. 5.2 Weight Recovery We evaluate the proposed attack on the fixed target network described in Section 3.2. The configured value of the attacked weight is 1.431.43, which is represented during execution by its nearest IEEE-754 single-precision value, w⋆≈1.4299999.w ≈ 1.4299999. The hierarchical recovery procedure described in Section 4.5 is applied to the first 1,0001,000 attack traces. The six coarse finalists are 1.42991.4299, 0.71500.7150, 0.35750.3575, 0.08940.0894, −1.4300-1.4300, and 0.17870.1787. Apart from the true weight, these are its look-alikes w⋆/2w /2, w⋆/4w /4, w⋆/16w /16, −w⋆-w , and w⋆/8w /8, whose products share the fraction bits of the true product. The fine stage ranks the finalist near the true weight highest and refines it to 1.42999611.4299961, which is 3333 ULPs below the true value. The exact stage then recovers w^=1.4299999, w=1.4299999, which matches the true single-precision representation of the target weight bit for bit (0x3FB70A3D). The same exact value is recovered when all 5,0005,000 available attack traces are used. The recovery error is therefore |w^−w⋆|=0,| w-w |=0, when evaluated in the float32 representation used by the implementation. These results demonstrate that the proposed profiled template attack is able to identify the exact single-precision representation of the targeted first-layer weight from the measured power traces. The following sections further analyze how candidate likelihoods evolve as traces are accumulated and how the probability of successful recovery depends on the number of attack traces. 5.3 Candidate Convergence To illustrate how evidence accumulates across attack traces, we analyze the cumulative log-likelihood of the candidates of every stage. For a candidate weight w w and the first n attack traces, the cumulative score is defined as Ln(w^)=∑i=1nℓi(w^),L_n( w)= _i=1^n _i( w), where ℓi(w^) _i( w) is computed with the templates of the respective stage. Figure 3 shows LnL_n for the first 1,0001,000 attack traces in acquisition order. For every stage, the true weight is compared with all wrong candidates of that stage: the complete coarse grid, the fine grids around all six coarse finalists, and all exact candidates. Instead of drawing every wrong candidate, the figure shows the best, the mean, and the worst score among them for every n. In the coarse and fine stages, candidates within 0.0050.005 of the true weight are counted as correct, since these stages only have to reach the neighborhood of the true weight. In the exact stage, every candidate except the bit-exact true weight is counted as wrong. Since every contribution ℓi(w^) _i( w) is non-positive (Section 4.4), all curves decrease as more traces are added. Candidate ranking is determined by the relative score, with the most plausible candidate corresponding to the highest, i.e., least negative, cumulative log-likelihood. The mean and the worst wrong candidate fall behind the true weight quickly: after 1010 traces, about 97%97\% or more of the wrong candidates of every stage already score below the true weight. The best wrong candidate stays close to the true weight much longer: the true weight scores higher than every wrong candidate after 427427 traces in the coarse stage, 497497 traces in the fine stage, and 446446 traces in the exact stage. In the exact stage, all 1,0241,024 neighboring float32 values within ±512± 512 ULPs are already outscored after 77 traces. The strongest competitors are the power-of-two look-alikes (w⋆/2w /2, w⋆/4w /4, w⋆/16w /16, and w⋆/256w /256), whose products differ from the true product only in the exponent bits. The coarse and fine stages do not need the true weight to score highest overall. The coarse stage only needs it among the six finalists, and the fine stage only compares the six refined finalists. The trace order shown here is also harder than average: the complete attack on these traces selects the look-alike w⋆/256w /256 until 446446 traces, whereas random subsets of 7373 traces already succeed in 88%88\% of the cases (Section 5.4). Figure 3: Cumulative log-likelihood of the true weight and of the best, mean, and worst wrong candidate over the first 1,0001,000 attack traces, for the coarse (top left, 39,90039,900 wrong candidates), fine (top right, 1,0051,005), and exact (bottom, 22,54922,549) stage. This convergence behavior also motivates the success-rate analysis in Section 5.4, where the attack is repeated for different numbers of traces to quantify the probability of recovering the correct weight. 5.4 Success Rate To quantify the number of attack traces required for reliable recovery, we evaluate the empirical success rate of the complete hierarchical attack for increasing trace counts. The trace counts N are 2626 values spaced logarithmically between 11 and 500500. The experiment is repeated 100100 times. In every repetition, 500500 of the 5,0005,000 attack traces are drawn in a random order, and the attack is run on the first N of them for every trace count, so the subsets are nested. A recovery is considered successful only when the recovered value equals the true float32 weight bit for bit, i.e., w^=w⋆ w=w , the same criterion as in Section 5.2. The empirical success rate is defined as SR(N)=#successful recoveries using N traces100.SR(N)= \#\successful recoveries using N traces\100. Figure 4 shows the resulting success rate as a function of the number of attack traces. The attack exhibits a rapid improvement as additional traces are included, reaching approximately 64%64\% success with 3838 traces, 88%88\% with 7373 traces, and 95%95\% with 138138 traces. The success rate reaches 99%99\% with 171171 traces and 100%100\% from 263263 traces up to the largest evaluated count of 500500. These results indicate that the proposed profiling attack does not require the full set of 5,0005,000 attack traces to recover the target weight reliably. Instead, the likelihood information accumulated from a few hundred measurements is sufficient to obtain consistent recovery in the evaluated setting. Figure 4: Empirical success rate of the proposed weight-recovery attack as a function of the number of attack traces. 6 Discussion Interpretation of the Results The results indicate that the profiling model captures leakage associated with the targeted floating-point multiplication rather than with a single fixed network configuration. Although the non-target weights vary during profiling and are not included in the leakage model, the resulting templates remain sufficiently discriminative to recover the target weight in the fixed attack network. The success-rate analysis further shows that evidence accumulates consistently in favor of the correct candidate as more traces are used. This supports the assumption that the selected POIs and templates provide a meaningful statistical model of the leakage of float32(wx).float32(wx). Role of the Hierarchical Search The hierarchical search balances robustness and precision during weight recovery. The coarse stage uses a reduced IEEE-754 leakage model to identify promising regions over the full weight interval, while the fine stage increases the leakage resolution to distinguish nearby candidates. The final stage then evaluates neighboring float32 values using the complete 3232-bit leakage model. This progression avoids applying the most detailed leakage model to the entire candidate space. It therefore reduces the computational cost of the search while preserving the ability to recover the exact floating-point representation of the target weight. Limitations and Future Work The present study focuses on the first weight of the first layer on a single target platform, providing an initial evaluation of the proposed profiling methodology. A natural next step is to extend the analysis to multiple network configurations and deeper layers. Future work should also investigate the portability of the templates across different devices and measurement sessions, as well as the effect of larger or more balanced profiling datasets on sparsely populated Hamming-weight classes. 7 Conclusion This work presented a profiled template attack for recovering a single-precision neural-network weight from power side-channel measurements. The attack models the leakage of the floating-point multiplication between a known input and the unknown target weight, and uses templates constructed from randomized profiling configurations. A hierarchical coarse-to-fine-to-exact search enables efficient exploration of the candidate space and exact recovery of the target float32 value. The experimental evaluation demonstrates successful weight recovery and shows that reliable recovery can be achieved with only a few hundred attack traces in the considered setting. References [1] L. Batina, S. Bhasin, D. Jap, and S. Picek (2019) CSI N: reverse engineering of neural network architectures through electromagnetic side channel. In 28th USENIX Security Symposium (USENIX Security 19), p. 515–532. Cited by: §1, §2.1, §2.1. [2] L. Batina, S. Bhasin, D. Jap, and S. Picek (2019) Poster: recovering the input of neural networks via single shot side-channel attacks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, p. 2657–2659. Cited by: §2.1. [3] J. Breier, D. Jap, X. Hou, S. Bhasin, and Y. Liu (2021) SNIFF: reverse engineering of neural networks with fault attacks. IEEE Transactions on Reliability 71 (4), p. 1527–1539. Cited by: §1. [4] H. Chabanne, J. Danger, L. Guiga, and U. Kühne (2021) Parasite: mitigating physical side-channel attacks against neural networks. In International Conference on Security, Privacy, and Applied Cryptography Engineering (SPACE), p. 148–167. Cited by: §1. [5] S. Chari, J. R. Rao, and P. Rohatgi (2003) Template attacks. In Cryptographic Hardware and Embedded Systems – CHES 2002, LNCS, Vol. 2523, p. 13–28. Cited by: §2.2. [6] I. Goodfellow, Y. Bengio, and A. Courville (2016) Deep learning. MIT Press. Cited by: §2.1. [7] M. Hashemi, S. Roy, D. Forte, and F. Ganji (2022) HWGN2^2: side-channel protected NNs through secure and private function evaluation. In International Conference on Security, Privacy, and Applied Cryptography Engineering, p. 225–248. Cited by: §1. [8] (2019) IEEE standard for floating-point arithmetic. IEEE Std 754-2019 (Revision of IEEE 754-2008) (), p. 1–84. External Links: Document Cited by: §2.3. [9] R. Joud, P. Moëllic, S. Pontié, and J. Rigaud (2022) A practical introduction to side-channel extraction of deep neural network parameters. In International Conference on Smart Card Research and Advanced Applications, p. 45–65. Cited by: §1. [10] Z. Lehocký, J. Breier, D. Jap, S. Bhasin, and X. Hou (2025) Side-channel analysis of OpenVINO-based neural network models. In International Conference on Availability, Reliability and Security, p. 307–324. Cited by: §2.1. [11] H. Nozaki and K. Kobara (2024) Power analysis of floating-point operations for leakage resistance evaluation of neural network model parameters. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E107-A (3), p. 331–343. Cited by: §1. [12] L. Puškáč, M. Benovič, J. Breier, and X. Hou (2025) Make shuffling great again: a side-channel-resistant Fisher–Yates algorithm for protecting neural networks. IEEE Transactions on Very Large Scale Integration (VLSI) Systems. Cited by: §1, §2.1. [13] L. Wei, B. Luo, Y. Li, Y. Liu, and Q. Xu (2018) I know what you see: power side-channel attack on convolutional neural network accelerators. In Proceedings of the 34th Annual Computer Security Applications Conference, p. 393–406. Cited by: §1, §2.2. [14] X. Yan, X. Lou, G. Xu, H. Qiu, S. Guo, C. H. Chang, and T. Zhang (2023) Mercury: an automated remote side-channel attack to Nvidia deep learning accelerator. arXiv preprint arXiv:2308.01193. Cited by: §2.1.