# Physical Side-Channel Attacks on Embedded Neural Networks: A Survey
## 4 Physical SCA Attacks on DNNs
### Recovering Network Architecture and Parameters
#### 4.2.1 Micro-Controller Targets
For validation, the authors compare the accuracy of the original network and the reverse engineered one. Results show comparable accuracy with an averaged loss of precision of 0.01% and average weight error of 0.0025% for the MLP model and 0.36% loss of precision for the deeper CNNs. **Discussion and limitations:** As \begin{table}
\begin{tabular}{c c} \hline \hline
**Aim of the Attack** & \\ \hline Reverse engineering & Recovering model layout param [20; 34], weights [20; 29; 34; 29; 30; 31; 32; 33; 34], biases [20; 29] and distinguishing among model architectures and parameters sparsity ratios [35] \\ Data theft & Recovering inputs [19; 21; 29; 36; 37; 38] \\ \hline
**Attacked NN** & \\ \hline MLP & [20; 21; 30; 36] \\ \hline CNN & [20; 29], Zero-skiping, normalised [29], Systolic array only [31; 32], AlexNet, InceptionV3, ResNet50, ResNet101 [35], BNN [19; 29; 33; 34; 37; 38], ConvNet, VGGNet [34] \\ \hline
**Dataset** & \\ \hline MNIST & [19; 21; 29; 33; 36; 37; 38] \\ \hline CIFAR-10 & [20; 29; 34] \\ \hline ImageNet & [29; 35] \\ \hline
**Physical Target** & \\ \hline FPGA & [30], Spartan3-A [31; 32], Spartan-6 LV5 [19], ZynqXC7000 [34], Kintex7 [33], ZCU104 and VCU118 [37; 38] \\ \hline \(\mu\)C & Rasperri Pi [35], ARM Cortex-M0+, custom-designed RISC-V [29], ATmega328P [20; 29] and ARM Cortex-M3 [20; 21; 36] \\ \hline
**Physical Measurement** & \\ \hline Power & SPA [29], DPA [21; 33], CPA/chain-CPA [31; 32], template attack [19], power, SVM [35] and remotely obtained [38][37] \\ \hline EM & HPA [21; 36], SEMA [20; 29], SEMA \& adversarial [34], DEMA [21; 36] and CEMA [20; 30; 34] \\ \hline
**Exploits** & \\ \hline Architecture design & Systolic array [31; 32], adder tree [33] and line buffer [19; 37; 38] \\ \hline Hardware target specificity & All-0’s pre-charge of data bus [20] and timing extraction of individual operations [20; 29] \\ \hline Correlation between & Parameters sparsity and power consumption [35], latency and number of parameters/operations [34], power/EM signatures and secret data processed (summations of products) [19; 21; 31; 32; 33; 34] and activation functions [20; 34] \\ \hline
**Evaluation Metric** & \\ \hline Attack accuracy & Recovered pixel-level accuracy [19; 21; 36; 37; 38], mean structural similarity index between original and recovered image (MSSIM [39]) [37; 38], input precision recognition of the network (original vs recovered) [19; 20; 34], average accuracy of recovered NN parameters [20; 29; 35] and normalised \\ \hline Attack efficiency & Portion of the correct recovered values (weights) [30; 31; 32] \\ \hline Attack complexity & Number of measurements required [31; 32; 33; 37; 38], image reconstruction complexity and memory complexity [19] \\ \hline
**Attacker Capabilities** & \\ \hline Attack knowledge & Network architecture [21; 29; 33; 34; 35; 36], set of possible network architectures [35], network parameters [19; 21; 29; 36; 37; 38], used pruning techniques [35] and hardware implementation details [31; 32; 33] \\ \hline Control on inputs & [20; 29; 33; 34; 35] \\ \hline Disabling all peripherals & [29] \\ \hline
**Assumptions Made to Facilitate the Attack** & Limited set of possible network models [35], limited set of possible filter-sizes [34], recovering reduced precision values [20; 21; 36] and input images with easily distinguishable background from foreground [19; 37; 38] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classification of attacks according to each feature. highlighted by the authors, the assumptions on this attack adversary are minimal, which renders this attack even more serious. On the other hand, attack complexity scaling and loss of precision of the recovered model remain to be evaluated for larger and deeper networks. Finally, this attack exploits a bus pre-charge to all '0's which is a characteristic specific to micro-controllers. **Power:** [PERSON] et al. [29] follow the previous work of [20], adapting the methodology to power signatures and evaluating it in DNN models with different precision (floating point, fixed point and binary).