💻 computer science

FeatureBleed: Inferring Private Enriched Attributes From Sparsity-Optimized AI Accelerators

This paper introduces FeatureBleed, the first hardware-level attack that exploits zero-skipping optimizations in AI accelerators to infer private backend-retrieved features through timing analysis, demonstrating a significant privacy-performance trade-off and proposing a low-overhead padding-based defense.

Original authors: Darsh Asher, Farshad Dizani, Joshua Kalyanapu, Rosario Cammarota, Aydin Aysu, Samira Mirbagher Ajorpaz

Published 2026-02-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Darsh Asher, Farshad Dizani, Joshua Kalyanapu, Rosario Cammarota, Aydin Aysu, Samira Mirbagher Ajorpaz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you walk into a high-tech restaurant. You order a simple dish, like a "Grilled Chicken Salad." The chef (the AI) doesn't just cook based on your order; they secretly pull a "secret file" from a locked cabinet in the back of the kitchen (the backend database) that contains your entire medical history, your credit score, or your past shopping habits. They use this secret info to decide exactly how to season your salad.

You, the customer, only see the final plate. You don't know what secrets the chef used. The restaurant claims, "Don't worry, we never tell you what's in the secret file."

But this paper reveals a new way to steal those secrets.

The researchers discovered that even though the chef doesn't say what secret they used, the speed at which they cook the meal gives it away.

The Core Problem: "Skipping the Zeros"

Modern AI chips (the super-fast brains inside computers) are designed to be incredibly efficient. To save time and energy, they use a trick called "Zero-Skipping."

Think of it like a chef chopping vegetables.

If the recipe says "add 100 carrots," the chef chops 100 carrots.
If the recipe says "add 100 carrots, but 90 of them are actually just empty air (zeros)," the smart chef skips chopping the 90 empty ones and only chops the 10 real carrots.

This makes the meal ready much faster. However, this creates a tiny, invisible "tell."

Secret A (High Sparsity): The secret file had lots of "empty air." The chef skipped a lot of work. Result: The meal is served in 2 seconds.
Secret B (Low Sparsity): The secret file was full of real data. The chef had to chop everything. Result: The meal takes 5 seconds.

The Attack: "FEATUREBLEED"

The researchers, calling their attack FEATUREBLEED, realized that a hacker doesn't need to break into the kitchen or steal the secret files. They just need a stopwatch.

Here is how the attack works in simple steps:

The Setup: The hacker acts like a normal customer. They send a request to the system (e.g., "Predict the risk for Patient ID #123").
The Secret: The system secretly pulls a private attribute (e.g., "Does this patient have a heart condition?") from the backend.
The Timing: The system processes the request. Because of the "Zero-Skipping" trick, the time it takes to finish depends entirely on that hidden heart condition.
- If the patient has a heart condition, the data is "dense," and the chip works harder. Time: 5 seconds.
- If they don't, the data is "sparse," and the chip skips work. Time: 2 seconds.
The Leak: The hacker measures the time. By timing thousands of requests, they build a map. They learn: "Oh, whenever the system takes 5 seconds, it means the patient has a heart condition."

They can do this without ever seeing the patient's data, without being in the same building as the server, and without the system knowing they are timing it.

Why This is Scary

Usually, we think of hacking as stealing passwords or breaking encryption. This is different. It's like a spy listening to the rhythm of a typewriter to guess what letter is being typed, even if the paper is blank.

The paper tested this on real-world scenarios:

Medical Records: Guessing if a patient has a kidney issue vs. a lung issue just by how fast the AI answers.
Credit Scores: Guessing marital status or income levels based on timing.
Hardware: It works on Intel CPUs, Intel AI chips, and NVIDIA GPUs. It's not a bug in one specific computer; it's a feature of how all modern fast computers work.

The Trade-Off: Speed vs. Privacy

The researchers found a catch-22.

To stop the leak: You have to tell the chef to chop everything, even the empty air, every single time, so the time is always the same.
The Cost: This makes the restaurant 25% more expensive (more energy) and twice as slow.

The Solution: "Padding"

The paper suggests a clever fix called Padding.
Instead of making the chef chop everything (which is wasteful), the chef just waits at the counter.

If the meal is ready in 2 seconds, the chef pretends to be busy for 3 more seconds before serving it.
If the meal takes 5 seconds, they serve it immediately.

Now, every meal takes exactly 5 seconds. The hacker's stopwatch becomes useless.

The Cost: The restaurant is only about 7% slower on average, and it doesn't waste extra energy chopping imaginary vegetables.

The Bottom Line

This paper warns us that in our rush to make AI faster and more efficient, we accidentally built a "speedometer" that leaks our private secrets. The very optimizations that make our phones and medical systems run fast are also the ones that let hackers guess our most sensitive data just by watching the clock.

The fix exists, but it requires us to accept a tiny bit of slowness to keep our secrets safe.

1. Problem Statement

Modern machine learning (ML) systems in sensitive domains (healthcare, finance, recommendation engines) increasingly rely on backend enrichment. In this architecture, a user submits a request with minimal public data (e.g., a patient ID or location), and the system internally retrieves sensitive, private attributes from a backend database (e.g., a Feature Store) to enrich the input before running the inference model. These private attributes influence the model's decision but are never exposed to the API caller.

The Vulnerability:
While these systems protect data confidentiality at the software level, this paper demonstrates that hardware-level optimizations in modern AI accelerators inadvertently leak this private information. Specifically, zero-skipping mechanisms (which skip computation when encountering zero-valued activations to save power and time) create a timing side-channel. The execution time of an inference depends on the sparsity of the data, which is correlated with the hidden backend attributes.

2. Methodology: FEATUREBLEED

The authors propose FEATUREBLEED, the first hardware-level attack that steals private backend-retrieved attributes solely through end-to-end timing analysis.

Threat Model:
- Attacker: A legitimate remote API user who can submit inference queries and measure response latency.
- Constraints: The attacker has black-box access only (no model weights, gradients, or confidence scores). They do not need co-location with the victim or shared hardware resources.
- Target: Inferring a sensitive attribute (e.g., medical diagnosis, marital status) that is retrieved internally but hidden from the API.
Attack Workflow:
1. Profiling: The attacker queries the system with auxiliary or synthetic identifiers to record inference latencies. Different backend attribute values trigger different activation sparsity patterns, resulting in distinct execution times.
2. Learning: The attacker clusters these timing profiles to identify groups corresponding to hidden attributes. They train a secondary classifier (e.g., Gradient Boosted Decision Tree) using inference time, non-sensitive inputs, and predicted labels as features.
3. Inference: For a target query, the attacker measures the latency, maps it to the learned timing cluster, and infers the sensitive backend attribute.
Differentiation from Prior Work:
Unlike previous attacks (e.g., LOMIA, CSMIA) that require knowledge of ground-truth labels, confidence scores, or the ability to flip sensitive attributes, FEATUREBLEED requires none of these. It bypasses defenses that mask confidence scores or output labels because the leakage occurs in the timing of the computation, not the output.

3. Key Contributions

First Hardware-Level Backend Retrieval Attack: Demonstrates that performance optimizations (zero-skipping) in AI accelerators undermine data confidentiality in backend enrichment pipelines.
Generalizability: The attack works across:
- Hardware: Intel AVX (CPU), Intel AMX (on-core AI accelerator), and NVIDIA A100 (GPU).
- Models: Deep Neural Networks (DNNs), Convolutional Neural Networks (CNNs), and hybrid pipelines.
- Domains: Medical records, medical imaging, and socioeconomic data.
Root Cause Identification: Pinpoints sparsity-driven zero-skipping as the mechanism. The correlation is: Backend Attribute $\rightarrow$ Activation Sparsity $\rightarrow$ Execution Time (via Zero-Skipping).
Mitigation Strategy: Proposes a padding defense that equalizes response times to the worst-case execution time, effectively masking the timing leakage.

4. Experimental Results

The authors evaluated FEATUREBLEED on three datasets: Texas-100X (clinical records), OrganAMNIST (medical imaging), and Census-19 (socioeconomic data).

Attack Accuracy:
- Texas-100X (Surgical Procedures): Achieved up to 98.98% accuracy (Adversarial Advantage of +98.87 percentage points over random guessing) on NVIDIA A100.
- OrganAMNIST: Achieved up to 56.08% accuracy (significantly above random guessing) for specific organ classifications.
- Census-19: Achieved up to 65.59% accuracy for marital status inference.
Hardware Comparison:
- NVIDIA A100: Showed the highest leakage (up to 70.3% average accuracy), likely due to aggressive Tensor Core optimizations.
- Intel AMX & AVX: Showed comparable leakage (approx. 61% accuracy), confirming the vulnerability exists on both CPUs and GPUs.
Model Size Impact:
- Leakage strength increases with model width. A model with 1,053,696 parameters achieved 99.37% accuracy, whereas smaller models showed lower but still significant leakage.
Root Cause Verification:
- Experiments confirmed that disabling frequency scaling (DVFS/TurboBoost) does not stop the attack.
- Energy analysis showed that zero-skipping creates an energy gap between all-zero and all-one operands even at fixed frequencies.

5. Significance and Trade-offs

Privacy vs. Performance: The paper quantifies the trade-off of disabling the vulnerable optimization.
- Disabling Zero-Skipping: Increases energy consumption by up to 25% per operation and incurs 100% performance overhead (doubling latency).
- Proposed Padding Defense: Masks timing leakage by waiting for the worst-case execution time before responding. This incurs only 7.24% average performance overhead and no additional energy cost (as the extra time is mostly idle power).
Industry Impact: The vulnerability affects major platforms (Uber, NVIDIA, Microsoft, Visa, etc.) that use backend enrichment. The authors disclosed findings to Intel and NVIDIA, who acknowledged the issue but noted that fixing it requires fundamental changes to hardware optimization strategies.

Conclusion

FEATUREBLEED reveals a critical class of side-channel attacks where hardware efficiency features (zero-skipping) directly compromise data privacy in AI systems. It demonstrates that even if sensitive data is never exposed via the API, the time it takes to process that data can reveal it. The paper argues for a shift toward hardware-software co-design to mitigate these leaks without sacrificing the performance benefits of modern AI accelerators.