Influence of Parallelism in Vector-Multiplication Units on Correlation Power Analysis

Problem Statement
The increasing deployment of Neural Networks (NNs) on resource-constrained edge devices introduces significant security risks regarding model confidentiality. While hardware accelerators are commonly used to enhance inference performance through parallel processing, they also alter the physical leakage characteristics exploited by Side-Channel Analysis (SCA). Specifically, Correlation Power Analysis (CPA) attacks, which traditionally target sequential or non-highly parallelized implementations, face new challenges when applied to vector-multiplication units where multiple neurons process the same input simultaneously. Existing research indicates that global power consumption or electromagnetic (EM) emissions may be insufficient for parameter extraction in highly parallel accelerators, yet a formal analysis of how the degree of parallelism quantitatively degrades the success rate of CPA has been lacking. The core problem addressed is determining the threshold of parallelism beyond which global power-based CPA becomes infeasible for extracting neuron weights in fully-connected layers.

Methodology
The authors employ a combined theoretical and experimental approach to model the impact of parallelism on CPA success:

1. Theoretical Modeling:

   • Power Model: The study models the total power consumption ($P_{total}$) of a vector-multiplication unit consisting of an array of Processing Elements (PEs). It assumes an idealized scenario where constant and noise components are minimized, focusing on the data-dependent ($P_{data}$) and operation-dependent ($P_{op}$) components.
   • Statistical Dependency: Unlike cryptographic algorithms where parallel components often process independent data, the study notes that in NN vector multiplication, all PEs process the same input value simultaneously but with different weights. This creates a statistical dependency between the power consumption of different PEs.
   • Correlation Analysis: The authors derive equations to describe the correlation coefficient ($\rho$) between a correct weight hypothesis and the total power consumption as a function of the number of parallel PEs ($n_{PE}$). They utilize Hamming Weight (HW) and Hamming Distance (HD) models to simulate power traces for intermediate results.
   • Signal-to-Noise Ratio (SNR): The study analyzes the relationship between SNR and the success of CPA, establishing a boundary where the correlation of the correct hypothesis drops below that of incorrect hypotheses.

2. Experimental Validation:

   • Hardware Implementation: A vector-multiplication unit was implemented on a Xilinx Artix-7 FPGA (NewAE Technology CW305 Board). The design allows for the dynamic adjustment of the number of parallel PEs (from 1 up to 64).
   • Parameters: The system uses 8-bit quantized weights and inputs, with 32-bit registers for intermediate results. The FPGA operates at 1 MHz to prevent power consumption overlap across clock cycles.
   • Measurement: Power consumption was measured via a shunt resistor and amplified, sampled at 625 MHz. The attack targets the extraction of weights processed by a specific PE while other PEs operate in parallel with different weights.
   • Attack Strategy: The authors test CPA at different time points ($\tau$) within the MAC (Multiply-and-Accumulate) operation sequence, specifically targeting the first multiplication ($\tau=0$) and subsequent register switches ($\tau=1, \tau=7$).

Key Contributions

1. Theoretical Behavioral Description: The paper provides a theoretical description of how parallel data processing in vector-multiplication units affects power consumption, specifically highlighting the statistical dependency introduced by shared inputs.
2. Quantification of Parallelism Impact: The authors derive equations (specifically Eq. 7 and its variants) that describe the exponential decrease in the correlation coefficient for the correct weight hypothesis as the number of parallel PEs increases.
3. Feasibility Boundary: The study establishes a practical boundary for CPA feasibility. It identifies that for the tested implementation, global power-based CPA fails when 8 or more PEs operate in parallel, whereas theoretical models suggest a slightly higher threshold (around 15 PEs) under idealized conditions.
4. Validation of Equations: The derived equations describing correlation decay are validated against practical FPGA measurements, showing a close approximation between simulated and measured data.

Results

• Correlation Decay: As the number of parallel PEs increases, the correlation coefficient for the correct hypothesis decreases exponentially. The study provides specific interpolation functions for different time points ($\tau=0, 3, 7$).
• Attack Feasibility Threshold:
  • Theoretical: The correlation of the correct hypothesis remains distinguishable from incorrect hypotheses up to approximately 15 parallel PEs. Beyond this, the SNR drops below the necessary threshold (approx. 0.045 on average, 0.1 in worst-case scenarios).
  • Experimental: Practical measurements on the FPGA show that the attack becomes infeasible with as few as 8 parallel PEs. At this point, the SNR drops below ~0.02, and incorrect hypotheses begin to exhibit higher correlation coefficients than the correct one.
• Time Point Sensitivity: Targeting later MAC operations (e.g., $\tau=7$) offers slightly higher robustness than targeting the first multiplication ($\tau=0$) because the intermediate results become more disjoint. However, even with later time points, the attack fails beyond 8 parallel PEs in the experimental setup.
• Input Distribution: The study confirms that the statistical distribution of weights (uniform vs. normal) does not significantly impact the success rate of the CPA, as the attack relies on the statistical dependency of the input rather than the specific weight values.

Significance and Claims
The paper claims to provide the first detailed analysis of how parallel vector multiplications in AI accelerators affect the success of correlation-based side-channel attacks. Its primary significance lies in defining the limits of global power analysis for NN extraction:

• It demonstrates that global power consumption is insufficient for extracting weights from vector-multiplication units with high parallelism (specifically $\ge 8$ PEs in the tested configuration).
• It establishes that for such highly parallel accelerators, localized EM measurements are required to isolate the leakage of individual PEs (specifically, probes capable of resolving no more than 4–15 PEs, depending on the specific SNR and parallelism).
• The derived equations allow designers and attackers to estimate the feasibility of CPA attacks based on the degree of parallelism in a specific hardware implementation, without needing to perform exhaustive physical measurements for every configuration.

The authors maintain a modest stance, noting that their findings are based on specific quantized implementations and idealized noise assumptions, but the trends observed are expected to hold for similar vector-multiplication architectures. They explicitly state that the architecture itself is assumed to be extractable via other means, focusing their contribution strictly on the difficulty of parameter (weight) extraction via power analysis in parallel environments.