Paper 2023/163

Hardware-Software Co-design for Side-Channel Protected Neural Network Inference

Anuj Dubey, North Carolina State University
Rosario Cammarota, Intel (United States)
Avinash Varna, Intel (United States)
Raghavan Kumar, Intel (United States)
Aydin Aysu, North Carolina State University

Physical side-channel attacks are a major threat to stealing confidential data from devices. There has been a recent surge in such attacks on edge machine learning (ML) hardware to extract the model parameters. Consequently, there has also been some work, although limited, on building corresponding side-channel defenses against such attacks. All the current solutions either take the fully software or fully hardware-centric approaches, which are limited either in performance or flexibility. In this paper, we propose the first hardware-software co-design solution for building side-channel-protected ML hardware. Our solution targets edge devices and addresses both performance and flexibility needs. To that end, we develop a secure RISC-V-based coprocessor design that can execute a neural network implemented in C/C++. The coprocessor uses masking to execute various neural network operations like weighted summations, activation functions, and output layer computation in a side-channel secure fashion. We extend the original RV32I instruction set with custom instructions to control the masking gadgets inside the secure coprocessor. We further use the custom instructions to implement easy-to-use APIs that are exposed to the end-user as a shared library. Finally, we demonstrate the empirical side-channel security of the design with 1M traces.

Available format(s)
Publication info
machine learning inferenceside-channel analysismaskingflexibility
Contact author(s)
aanujdu @ ncsu edu
aaysu @ ncsu edu
2023-02-15: approved
2023-02-10: received
See all versions
Short URL
Creative Commons Attribution


      author = {Anuj Dubey and Rosario Cammarota and Avinash Varna and Raghavan Kumar and Aydin Aysu},
      title = {Hardware-Software Co-design for Side-Channel Protected Neural Network Inference},
      howpublished = {Cryptology ePrint Archive, Paper 2023/163},
      year = {2023},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.