Power Side-Channel Attacks on Neural Networks Hit a Wall: Floating-Point Math and Entropy Reduction Break the Crypto Playbook

Treating ML models like ciphers for side-channel attacks doesn't scale. Floating-point arithmetic and shrinking data entropy in deep layers make full weight recovery fundamentally harder than prior work suggests.

Imagine you're a locksmith who's spent decades cracking combination safes. You know every click, every vibration, every telltale sound the tumblers make. Now someone hands you a new kind of lock — it looks similar, it has dials and a mechanism — but the internal gears are made of rubber instead of steel, and the deeper you go, the quieter the mechanism gets. That's the core insight of this paper: the side-channel techniques honed on cryptographic hardware don't transfer cleanly to neural network weight extraction, and the reasons are structural, not incidental. The committed claim is this: machine-learning models are fundamentally different from ciphers in two ways that make power-analysis weight extraction much harder than the cryptographic analogy suggests. First, ML models use limited-precision floating-point arithmetic and low-diffusion linear operations, whereas ciphers use high-diffusion nonlinear integer arithmetic. The floating-point regime means that the power traces carry less distinguishing information per operation, requiring dramatically more traces to resolve individual weights — even under idealized noise-free conditions. Second, ciphers are designed to maximize output entropy (that's what makes them secure), while neural networks are designed to reduce entropy — to compress and classify. As data flows through deeper layers, the variability that side-channel analysis depends on collapses, making weight recovery progressively harder the deeper you go. Prior work in this space — papers by Batina et al. (2019), Joud et al., and others — demonstrated proof-of-concept weight extraction on shallow layers or small subsets of weights from randomly initialized networks. This paper directly challenges those results by asking the question nobody wanted to ask: what happens when you try to recover ALL weights from ALL layers of a fully trained, functional network? The answer is sobering. Even with an unrealistically strong adversary — one who can observe the leakage model output directly without any noise — recovery degrades significantly in deeper layers and requires far more input traces than prior art would predict. The architecture of the attack follows the Correlation Power Analysis (CPA) family from cryptographic engineering. The adversary collects power consumption traces during inference, builds hypothetical leakage models for each candidate weight value, and correlates predicted leakage against observed traces. In crypto, this works because AES S-boxes and similar primitives create high-contrast, high-diffusion power signatures that differ sharply between key candidates. In floating-point multiply-accumulate operations typical of neural networks, the Hamming-weight differences between candidate outputs are compressed and less discriminating, so you need exponentially more traces to achieve the same confidence. The integrity setup is stronger than typical for this subfield: the authors deliberately assume the strongest possible adversary (noise-free, direct observation) to isolate the fundamental challenges from implementation-specific noise. This is a smart methodological move — it means the difficulties they identify are lower bounds, not artifacts of a noisy setup. However, the work is entirely simulation-based; no physical hardware measurements are reported. The benchmarks are self-defined rather than drawn from a community standard, which is understandable given how new this attack surface is, but it does limit independent comparison. The milestone question is fascinating. Current state-of-the-art can partially recover weights from shallow layers of small networks under favorable conditions. The next meaningful threshold would be full weight recovery of a production-scale network (say, a ResNet-18 or a small transformer) from physical hardware traces. This paper strongly suggests that threshold is much farther away than the field assumed — possibly requiring orders of magnitude more traces than are practically collectible, or entirely new attack strategies that don't depend on per-weight correlation. The obvious next experiment is attacking a real model on real hardware — an FPGA or ASIC accelerator running a trained network — and comparing the trace counts needed against the theoretical predictions. The authors didn't run this, and the honest read is (a): the theoretical analysis alone is the contribution, and physical experiments are a separate, expensive paper. But it also means the gap between theoretical difficulty and practical impossibility remains unquantified. The field will need someone to close that gap before the defensive implications are clear.