Bits to BNNs: Reconstructing FPGA ML-IP with Joint Bitstream and Side-Channel Analysis

Abstract

Energy-efficient hardware acceleration platforms for edge deployment of artificial intelligence (AI) and machine learning (ML) applications has been an ongoing research endeavor. Many efforts have focused on optimizing the algorithms and compute structures for use in resource-constrained hardware such as field-programmable gate arrays (FPGAs). Indeed, the difficult nature of crafting the best model makes the ML model itself a valuable intellectual property (IP) asset. This can be problematic, as the IP can now be exposed to an attacker through physical interfaces, enabling threats from side-channel analysis (SCA) attacks. One of the more devastating attacks is the model extraction attack, which threatens piracy and cloning of the valuable IP. While the problem of SCA-based model extraction on FPGA-deployed neural networks has been well-studied, it does not capture the full picture of what vulnerabilities may be present in those platforms. In this paper, we demonstrate how bitstream analysis can be used to obtain neural network parameters and connectivity information from block RAMs (BRAMs). We leverage the knowledge gleaned from the bitstream to mount a power SCA attack to further refine the network reconstruction effort. This is the first method that has approached the problem of ML-IP theft from the angle of FPGA bitstream analysis and suggests that further work is needed to improve security assurance for edge intelligence.