# Upper Limits on the Cosmic Neutrino Background from Cosmic Rays

Mar Císcar-Monsalvatje1, Gonzalo Herrera2,1,3, Ian M. Shoemaker2 1School of
Natural Sciences, Technische Universität München, James-Franck-Straße, 85748
Garching, Germany,
2 Center for Neutrino Physics, Department of Physics, Virginia Tech,
Blacksburg, VA 24061, USA,
3 Max-Planck-Institut für Physik (Werner-Heisenberg-Institut), Föhringer Ring
6,80805 München, Germany,

###### Abstract

Extragalactic and galactic cosmic rays scatter with the cosmic neutrino
background during propagation to Earth, yielding a flux of relic neutrinos
boosted to larger energies. If an overdensity of relic neutrinos is present in
galaxies, and neutrinos are massive enough, this flux might be detectable by
high-energy neutrino experiments. For a lightest neutrino of mass $m_{\nu}\sim
0.1$ eV, we find an upper limit on the local relic neutrino overdensity of
$\sim 10^{13}$ and an upper limit on the relic neutrino overdensity at TXS
0506+056 of $\sim 10^{10}$. Future experiments like GRAND or IceCube-Gen2
could improve these bounds by orders of magnitude.

##  I Introduction

The cosmic neutrino background is present in our Universe with a total average
density of $n_{\nu}\sim 336$ cm-3 for all flavors Dolgov  _et al._ (1997);
Mangano  _et al._ (2005). Despite their large density, their energies are
lower than the largest neutrino mass Vitagliano  _et al._ (2020), which is
constrained by the KATRIN experiment for electron antineutrinos to
$m_{\nu}<0.8$ eV Aker  _et al._ (2022a). This makes their detection very
challenging. Relic neutrinos can hardly induce detectable signals at Earth-
based detectors since their interaction cross section at sub-eV energies is
suppressed, and the energy depositions are very small, $\sim$ meV$-$eV. A
widely discussed mechanism to overcome the low energy deposition is the
capture of a neutrino on a $\beta-$unstable nucleus, which is a thresholdless
reaction Weinberg (1962); Cocco  _et al._ (2007); Blennow (2008); Long  _et
al._ (2014); Baracchini  _et al._ (2018); Akita  _et al._ (2021); Alvey  _et
al._ (2022); Bauer and Shergold (2023); Perez-Gonzalez and Sen (2023).
However, the feasibility of this detection method is limited by Heisenberg’s
uncertainty principle Cheipesh  _et al._ (2021); Nussinov and Nussinov (2022);
Apponi  _et al._ (2022). Given the difficulties of such detection, some works
in the literature have invoked Beyond the Standard Model (BSM) mechanisms
enabling relic neutrinos to be detectable at Earth by various mechanisms and
with different signatures and experiments, e.g. Weiler (1982); Fargion  _et
al._ (1999); Ibe and Kaneta (2014); Brdar  _et al._ (2022); Das  _et al._
(2022); Asteriadis  _et al._ (2023); Yin (2019).

In this letter, we explore the possibility that cosmic rays scatter off relic
neutrinos and boost them via purely Standard Model mechanisms, inducing a flux
of relic neutrinos with larger energies reaching the Earth. A similar task was
done in the 80s when the neutrino mass was less constrained, and the
uncertainties in the atmospheric and astrophysical high-energy neutrino fluxes
were larger Hara and Sato (1980, 1981). Here, we estimate this flux due to
scatterings of cosmic ray protons with massive neutrinos and assess whether
such a contribution could be discerned from other neutrino sources. In
particular, we will calculate the flux of relic neutrinos boosted by cosmic
ray protons in the Milky Way and the flux of relic neutrinos boosted by cosmic
ray protons in the blazar TXS 0506+056, which is believed to be a proton
accelerator from its detected emission in high-energy neutrinos Aartsen  _et
al._ (2018). We will place an upper limit on the local, or TXS 0506+056
present relic neutrino overdensity from a non-observation of a particular
spectral feature on top of the measured atmospheric and astrophysical high
energy neutrino fluxes, or from an excess of events w.r.t experimental limits
on cosmogenic neutrinos. We further analyze the dependence of this constraint
on the neutrino mass and discuss whether such overdensities could be obtained
in a model where neutrinos self-interact via a light scalar mediator Smirnov
and Xu (2022). The phenomenological probe considered in this work allows the
testing of neutrino overdensities on much larger physical scales than other
complementary probes such as Aker  _et al._ (2022b); Tsai  _et al._ (2022).

##  II Boosted flux of relic neutrinos from cosmic ray proton scatterings

Cosmic ray protons have much larger energies than the relic neutrinos, which
are effectively at rest. The maximum kinetic energy transferred to a neutrino
in a single collision is Bringmann and Pospelov (2019); Cappiello  _et al._
(2019)

$T_{\nu}^{\max}=\frac{T_{p}^{2}+2m_{p}T_{p}}{T_{p}+\left(m_{p}+m_{\nu}\right)^{2}/\left(2m_{\nu}\right)},$
(1)

where $T_{p}$ is the kinetic energy of the proton. The induced flux of cosmic
relic neutrinos by scatterings with cosmic ray protons is given by the
following line of sight integral

$\frac{d\Phi_{\nu}}{dT_{p}}=\int\frac{d\Omega}{4\pi}\int_{\text{l.o.s.}}d\ell\sigma_{p\nu}(T_{p})n_{\nu}\frac{d\Phi_{p}}{dT_{p}}\equiv\sigma_{\nu
p}(T_{p})n_{\nu}\frac{d\Phi_{p}}{dT_{p}}D_{\mathrm{eff}},$ (2)

where $\sigma_{\nu p}(T_{p})$ refers to the neutral current proton-neutrino
scattering cross section, $d\Phi_{p}/dT_{p}$ is the proton flux spectrum, and
$D_{\rm eff}$ is the effective distance. For the Milky Way case we consider
the measured cosmic ray proton flux on Earth up to the GZK cut-off ($T_{p}\sim
5\times 10^{19}$ eV) Greisen (1966); Zatsepin and Kuz’min (1966); Cronin  _et
al._ (1997). We assume $D_{\rm eff}\sim 10$ kpc over which cosmic rays scatter
off relic neutrinos in the Milky Way. In reality, ultra-high energy cosmic
rays could scatter off relic neutrinos over larger distances, of the order of
$10-100$ Mpc Plotko  _et al._ (2023), so our choice is conservative. For TXS
0506+056, we calculate the high-energy proton flux following Wang  _et al._
(2022), with a cut-off at $1.7\times 10^{9}$ GeV Ansoldi  _et al._ (2018);
Winter  _et al._ (2020), and rescale it by $1/d^{2}$, where $d=1835.4$ Mpc. We
assume that protons scatter off relic neutrinos over an effective distance of
$D_{\rm eff}=10$ kpc in the host galaxy of TXS 0506+056, which lies under the
mean free path of these protons for the relic neutrino overdensities
considered in this work.

The neutral current neutrino-proton cross section in the regime of interest
where the momentum transfer is smaller than the mediator mass scales with
energy as

$\sigma_{p\nu}\sim\begin{cases}\frac{G_{F}^{2}s}{\pi}&\mathrm{for}\,\,\,2m_{\nu}E_{p}>m_{p}^{2},\\\
\frac{G_{F}^{2}E_{p}^{2}m_{\nu}^{2}}{\pi
m_{p}^{2}}&\mathrm{for}\,\,\,2m_{\nu}E_{p}<m_{p}^{2},\end{cases}$ (3)

where $s=2m_{\nu}E_{p}+m_{p}^{2}+m_{\nu}^{2}$ and $E_{p}=T_{p}+m_{p}$. The
dependence at very high $s$ is not relevant in this work due to the high
suppression by the small value of $m_{\nu}$. We have checked that our
expressions for the cross section match the experimentally measured values at
sufficiently high center of mass energies Formaggio and Zeller (2012).

The cosmic neutrino flux as a function of the final neutrino energy reads

$\frac{d\Phi_{\nu}}{dT_{\nu}}=\int_{0}^{\infty}dT_{p}\frac{d\Phi_{\nu}}{dT_{p}}\frac{1}{T_{\nu}^{\max}\left(T_{p}\right)}\Theta\left[T_{\nu}^{\max}\left(T_{p}\right)-T_{\nu}\right].$
(4)

Figure 1: Upper plot: Flavor averaged ($\nu_{\alpha}+\bar{\nu}_{\alpha}$) flux
of relic neutrinos boosted by Milky Way cosmic ray protons at Earth, for
different values of the local neutrino overdensity in the Milky Way. The
neutrino mass is taken to be $m_{\nu}=0.1$ eV. For comparison, we show the
flux from the sum of atmospheric neutrinos and diffuse extragalactic neutrinos
measured by experiments at Earth Richard  _et al._ (2016); Aartsen  _et al._
(2016a, 2020). We also show the current upper limits on the cosmogenic
neutrino flux at very high-energies from Auger Aab  _et al._ (2015), IceCube
Aartsen  _et al._ (2016b) and ANITA Gorham  _et al._ (2018). We also show
sensitivity projections from GRAND200k (10yr) and IceCube-Gen2 radio (10 yr)
Kotera (2021); Abbasi  _et al._ (2021). Lower plot: Flavor averaged
($\nu_{\alpha}+\bar{\nu}_{\alpha}$) boosted relic neutrino flux from TXS
0506+056 Aartsen  _et al._ (2018). We also show in brown the observed non-
diffuse flux of neutrinos coming from TXS 0506+056 (see main text for
details).

Using this formalism, we compute the fluxes of relic neutrinos boosted by
cosmic ray protons from the Milky Way and TXS 0506+056. The boosted flux is
orders of magnitude smaller than the flux of atmospheric and high-energy
neutrinos. However, this flux might become sizable at energies above
$10^{5}-10^{6}$ GeV for sufficiently large neutrino overdensities,
$\eta_{\nu}$, in the Milky Way or TXS 0506+056, as can be seen in Fig. 1.

While in standard scenarios, the neutrino clustering via gravitational effects
is expected to be very small Ringwald and Wong (2004); Mertsch  _et al._
(2020); Zimmer  _et al._ (2023); Hotinli  _et al._ (2023), in some models,
neutrinos can self-interact via a scalar mediator, which leads to large
overdensities. The maximal predicted neutrino density in this scenario is
$n_{\nu}\sim 4.3\times 10^{8}$ cm-3 Stephenson  _et al._ (1998); Smirnov and
Xu (2022) for $m_{\nu}\sim 0.1$ eV, which translates into an overdensity of
$\eta_{\nu}\sim 1.2\times 10^{6}$. Currently, the most stringent upper limit
on the local neutrino overdensity w.r.t. the average value comes from the
KATRIN experiment, which is $\eta_{\nu}\leq 9.7\times 10^{10}$ at 90$\%$ CL
Aker  _et al._ (2022b).

It can be noticed from the upper plot of Fig. 1 that for overdensities at the
level of the KATRIN bound, the boosted relic neutrino flux in the Milky Way
does not reach the measurements reported by the IceCube collaboration on the
diffuse extragalactic neutrino background (shown in light orange for muon
neutrinos and red points for electron and tau neutrinos). However, for TXS
0506+056, such an overdensity would induce a detectable neutrino flux above
IceCube measurements in the source direction, and also above the non-
observation limits placed on cosmogenic neutrinos (green solid lines). As
discussed, we do not speculate how such large relic neutrino densities would
be present at the source. Similar discussions have been placed in the context
of dark matter spikes around the supermassive black hole of TXS 0506+056, with
enhancements above $10^{9}$ times the cosmological density of dark matter
Gondolo and Silk (1999); Wang  _et al._ (2022); Ferrer  _et al._ (2023); Cline
_et al._ (2023). However, to the best of our knowledge, a discussion on the
clustering of relic neutrinos around supermassive black holes is lacking in
the literature.

As shown in Fig. 1, the relic neutrinos may contribute at the energies
relevant for the diffuse extragalactic and cosmogenic neutrino fluxes but with
a different spectral index. Thus, if a sufficiently large overdensity is
present, the IceCube experiment could observe the relic neutrino contribution
by analyzing the spectral features.

It is worth mentioning that here we have focused on the boosted relic neutrino
contribution arising from cosmic ray proton scatterings, but relic neutrinos
are also boosted to larger energies by scatterings off cosmic ray electrons.
Due to their lower density and energies, however, we have found this
contribution to be negligible compared to that from cosmic ray protons.

##  III Upper limit on local relic neutrino overdensity

We can set an upper limit on the relic neutrino overdensity from the
requirement that the boosted relic neutrino flux should not be larger than the
measured diffuse extragalactic neutrino flux, or the existing limits for
cosmogenic neutrinos. In particular, we follow the criteria that the sum of
boosted relic neutrino flux shall not be larger than the observed neutrino
flux at any energy by a factor $C$

$\Phi_{\rm C\nu B}^{\rm Boosted}\leq C\Phi_{\nu}^{\rm Observed},$ (5)

where the factor $C$ depends on the uncertainty of the measured neutrino flux,
which is energy dependent. Uncertainties in the astrophysical neutrino fluxes
are below one order of magnitude at all relevant energies, except for one
energy bin of IceCube corresponding to electron and tau neutrinos around
$10^{6}$ GeV Abbasi  _et al._ (2022). Thus, we will consider $C=1$.

The maximal neutrino density in a cluster due to Yukawa interactions induced
by a massless scalar mediator is determined by the neutrino mass as Smirnov
and Xu (2022)

$n_{\nu}^{\max}=4.3\times
10^{8}\mathrm{~{}cm}^{-3}\bigg{(}\frac{m_{\nu}}{0.1\,\mathrm{eV}}\bigg{)}^{3}.$
(6)

This corresponds to an overdensity, w.r.t. to the standard average value of

$\eta^{\max}=1.2\times
10^{6}\bigg{(}\frac{m_{\nu}}{0.1\,\mathrm{eV}}\bigg{)}^{3}.$ (7)

Figure 2: Upper plot: Constrained local overdensity as a function of the
lightest neutrino mass, for an effective distance of $D_{\rm eff}=10$ kpc and
for both normal hierarchy (solid line) and inverted hierarchy (dashed line).
We also show projected constraints from future experiments in dashed-dotted
and dotted lines. For comparison, we show the bound from KATRIN and maximum
values favored by relic neutrino clustering mediated by self-interactions. We
further show the cosmological bound on the sum of neutrino masses from the
combination of CMB and BAO data at 68$\%$ C.L, ($\sum m_{\nu}<0.19$ eV) for NH
(solid) and IH (dashed). In orange, we show the requirement for the neutrino
halo mass to not exceed $M_{\rm MW}\lesssim 10^{13}M_{\odot}$. Lower plot:
Same for TXS 0506+056.

In Fig. 2, we show our upper limit on the local neutrino overdensity (upper
plot) and neutrino overdensity in TXS 0506+056 (lower plot). We show this
limit for a normal hierarchy of neutrino masses (NH) in solid purple and an
inverted hierarchy (IH) in dashed purple as a function of the lightest
neutrino mass. We also show in purple dash-dotted and dotted lines projections
for the overdensities which future cosmogenic neutrino experiments IceCube-
Gen2 and GRAND will be able to probe Kotera (2021); Abbasi  _et al._ (2021).

For comparison, we show the previous bound by KATRIN in solid blue and the
theoretically motivated values of the relic neutrino overdensities in the case
of Yukawa self-interactions, following Eq. (7), in dotted light blue, taking
into account the contribution from the three neutrino eigenstates. The grey
region (right of the grey solid line for NH and of grey dashed line for IH) is
disfavoured in $\Lambda$CDM cosmology, e.g. Roy Choudhury and Choubey (2018);
Chacko  _et al._ (2020); Di Valentino  _et al._ (2021); Franco Abellán  _et
al._ (2022).

Our limit from the Milky Way is weaker than the bounds from KATRIN and
asteroid data Aker  _et al._ (2022b); Tsai  _et al._ (2022). However, these
limits only apply at distance scales as long as 1 AU, while our bound applies
up to a few kpc. Furthermore, since the high-energy cosmic rays are likely of
extragalactic origin, the total boosted relic neutrino flux on Earth could
receive sizable contributions from scatterings in the intergalactic medium and
therefore be significantly larger than estimated here. We leave this analysis
for future investigation.

Our limit from TXS 0506+056 is more stringent than the KATRIN bound for
neutrino masses where the lightest neutrino mass is $m_{\nu}\gtrsim$ 0.04 eV,
and the future projections improve it for any value of the neutrino masses. As
expected, when the neutrino masses are higher, our constraint on the local
relic overdensity becomes more stringent. This is due to the fact that it
takes less energy transfer to boost the relic neutrinos to high energies, and
the cosmic ray proton flux decreases at higher energy. This also explains why
the IH bound is more stringent than the NH one, as in the IH case, the sum of
neutrino masses will be higher for a determined lightest neutrino mass.

It should be stressed that for sufficiently large neutrino overdensities in
the Milky Way extending over $D_{\rm eff}=10$ kpc, the mass of the neutrino
halo could exceed the total mass of the Milky Way inferred from observations.
Therefore, we impose an upper limit on the maximum neutrino overdensity in the
Milky Way from the requirement that the neutrino halo mass must not exceed
$M_{\rm MW}\lesssim 10^{13}M_{\odot}$, shown as an orange line in Fig. 2. For
TXS 0506+056, the total mass of the host galaxy is uncertain, but the limit
would be close to the current one obtained from cosmic rays for $M_{\rm
TXS}\lesssim 10^{14}M_{\odot}$. We emphasize, however, that the total mass of
the neutrino halo will strongly depend on the radial dependence of the
neutrino density profile, and the extension of the neutrino overdense region,
which may not be equivalent to $D_{\rm eff}$, so the orange line in the figure
should be taken with a grain of salt. These aspects are left for detailed
investigation in future work.

We also note that for sufficiently small neutrino masses ($\sim 10^{-4}$ eV),
the mathematical treatment for the boosted flux would include modifications
due to the finite C$\nu$B temperature Lunardini  _et al._ (2013). This is,
however, not relevant for the derivation of our limits, as in the regime where
the lightest neutrino is too light, the contribution of the heavier neutrinos
dominates the limit. In the case of a reduced effective neutrino mass arising
from matter effects in overdensities induced by neutrino self-interactions,
our bounds would apply to the effective mass of neutrinos within the cluster.

It should also be noted that an indirect limit on the relic neutrino
overdensity arises from Pauli exclusion principle, which disfavor relic
neutrino overdensities larger than $\eta\gtrsim 10^{6}$ Bauer and Shergold
(2023); Aker  _et al._ (2022b).

This work focuses on the phenomenological implications of the boosted relic
neutrino flux at very high energies. We find that the boosted relic neutrino
flux is maximal at lower neutrino energies, see Fig. 3. This prediction on the
neutrino flux is unique in the region between the cosmic neutrino background,
neutrinos from BBN Khatri and Sunyaev (2011); Ivanchik and Yurchenko (2018),
and the thermal neutrino flux from the Sun Haxton and Lin (2000); Vitagliano
_et al._ (2017). However, the flux at these energies is too small to be
discerned, comparable to the diffuse extragalactic neutrino background
observed by IceCube.

Figure 3: Upper plot: All flavour flux of relic neutrinos boosted by Milky Way
cosmic ray protons at Earth, for different values of the local neutrino
overdensity in the Milky Way. The neutrino mass is taken to be $m_{\nu}=0.1$
eV. For comparison, we show the expected flux from thermal solar neutrinos
Vitagliano  _et al._ (2017), the measured flux from nuclear solar neutrinos
Bahcall (1964), diffuse supernova neutrino background Bisnovatyj-Kogan and
Seidov (1982); Krauss  _et al._ (1984); Horiuchi  _et al._ (2009), atmospheric
Seckel  _et al._ (1991); Ingelman and Thunman (1996); Richard  _et al._
(2016), and the diffuse extragalactic neutrino background Murase  _et al._
(2016); Aartsen  _et al._ (2016a, 2020). We also show the current upper limits
on the cosmogenic neutrino flux at very high-energies from Auger Aab  _et al._
(2015), IceCube Aartsen  _et al._ (2016b) and ANITA Gorham  _et al._ (2018).
Lower plot: All flavour flux of boosted relic neutrinos from TXS 0506+056 (see
main text for details).

##  IV Conclusions

We have derived upper limits on the local relic neutrino overdensity and the
relic neutrino overdensity in TXS 0506+056, from the consideration that a
fraction of the relic neutrinos in the Milky Way and TXS 0506+056 is boosted
to high energies due to scatterings with cosmic ray protons. The boosted relic
neutrinos can reach the energies of the diffuse extragalactic neutrino
background and cosmogenic neutrinos, but their flux is very small. However, if
an overdensity of relic neutrinos is present in the Milky Way or in TXS
0506+056, this flux might be detectable due to a differentiated spectral shape
w.r.t. the already measured high-energy neutrino fluxes. The non-observation
of such excess allows an upper limit to be placed on the relic neutrino
density. For a lightest neutrino mass of $m_{\nu}\sim 0.1$ eV, we obtain an
upper limit on the local relic neutrino overdensity of $\eta_{\nu}\sim
10^{13}$, which is close to the previously most robust upper limit from
KATRIN, and valid over much larger physical scales. For these masses, we also
find an upper limit on the neutrino overdensity of TXS 0506+056 of
$\eta_{\nu}\sim 10^{10}$, stronger than the bound from KATRIN. We also note
that TXS 0506+056 is unlikely to be the only neutrino-emitting quasar.
Considering the combined impact of various sources in the Universe may
increase the total boosted relic neutrino flux reaching Earth by orders of
magnitude. We leave this task for future investigation.

Detecting relic neutrinos is a challenging but crucial task to obtain insights
into the cosmological model of the Universe and the neutrino mass generation
mechanism. We have discussed the possibility of detecting a boosted component
of relic neutrinos by cosmic ray scatterings with high-energy neutrino
experiments. We have shown that this detection requires either an improvement
in the sensitivity of current neutrino experiments of $\sim 10$ orders of
magnitude or an overdensity of relic neutrinos of $\eta_{\nu}\gtrsim 10^{10}$
induced by strong gravitational effects near supermassive black holes or by
some BSM mechanism. Although both possibilities remain abject to our view, our
result constitutes the strongest bound on the relic neutrino overdensity in a
galaxy derived to date and opens a new future avenue for the direct detection
of the cosmic neutrino background.

##  V ACKNOWLEDGEMENTS

We are grateful to Chris Cappiello, Juan Manuel Cano, Miguel Escudero, Jérôme
Vandecasteele, Carlos Argüelles and Matheus Hostert for useful discussions. MC
and GH are supported by the Collaborative Research Center SFB1258 and by the
Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under
Germany’s Excellence Strategy - EXC-2094 - 390783311. GH is also supported by
the the U.S. Department of Energy under the award number DE-SC0020250 and DE-
SC0020262. IMS is supported by the U.S. Department of Energy Office of
Science, Office of High Energy Physics, under Award Number DE-SC0020262.

## References

  * Dolgov  _et al._ (1997) A. D. Dolgov, S. H. Hansen, and D. V. Semikoz, Nucl. Phys. B 503, 426 (1997), arXiv:hep-ph/9703315 .
  * Mangano  _et al._ (2005) G. Mangano, G. Miele, S. Pastor, T. Pinto, O. Pisanti, and P. D. Serpico, Nucl. Phys. B 729, 221 (2005), arXiv:hep-ph/0506164 .
  * Vitagliano  _et al._ (2020) E. Vitagliano, I. Tamborra, and G. Raffelt, Rev. Mod. Phys. 92, 45006 (2020), arXiv:1910.11878 [astro-ph.HE] .
  * Aker  _et al._ (2022a) M. Aker _et al._ (KATRIN), Nature Phys. 18, 160 (2022a), arXiv:2105.08533 [hep-ex] .
  * Weinberg (1962) S. Weinberg, Phys. Rev. 128, 1457 (1962).
  * Cocco  _et al._ (2007) A. G. Cocco, G. Mangano, and M. Messina, JCAP 06, 015 (2007), arXiv:hep-ph/0703075 .
  * Blennow (2008) M. Blennow, Phys. Rev. D 77, 113014 (2008), arXiv:0803.3762 [astro-ph] .
  * Long  _et al._ (2014) A. J. Long, C. Lunardini, and E. Sabancilar, JCAP 08, 038 (2014), arXiv:1405.7654 [hep-ph] .
  * Baracchini  _et al._ (2018) E. Baracchini _et al._ (PTOLEMY), (2018), arXiv:1808.01892 [physics.ins-det] .
  * Akita  _et al._ (2021) K. Akita, S. Hurwitz, and M. Yamaguchi, Eur. Phys. J. C 81, 344 (2021), arXiv:2010.04454 [hep-ph] .
  * Alvey  _et al._ (2022) J. Alvey, M. Escudero, N. Sabti, and T. Schwetz, Phys. Rev. D 105, 063501 (2022), arXiv:2111.14870 [hep-ph] .
  * Bauer and Shergold (2023) M. Bauer and J. D. Shergold, JCAP 01, 003 (2023), arXiv:2207.12413 [hep-ph] .
  * Perez-Gonzalez and Sen (2023) Y. F. Perez-Gonzalez and M. Sen, (2023), arXiv:2308.05147 [hep-ph] .
  * Cheipesh  _et al._ (2021) Y. Cheipesh, V. Cheianov, and A. Boyarsky, Phys. Rev. D 104, 116004 (2021), arXiv:2101.10069 [hep-ph] .
  * Nussinov and Nussinov (2022) S. Nussinov and Z. Nussinov, Phys. Rev. D 105, 043502 (2022), arXiv:2108.03695 [hep-ph] .
  * Apponi  _et al._ (2022) A. Apponi _et al._ (PTOLEMY), Phys. Rev. D 106, 053002 (2022), arXiv:2203.11228 [hep-ph] .
  * Weiler (1982) T. J. Weiler, Phys. Rev. Lett. 49, 234 (1982).
  * Fargion  _et al._ (1999) D. Fargion, B. Mele, and A. Salis, Astrophys. J. 517, 725 (1999), arXiv:astro-ph/9710029 .
  * Ibe and Kaneta (2014) M. Ibe and K. Kaneta, Phys. Rev. D 90, 053011 (2014), arXiv:1407.2848 [hep-ph] .
  * Brdar  _et al._ (2022) V. Brdar, P. S. B. Dev, R. Plestid, and A. Soni, Phys. Lett. B 833, 137358 (2022), arXiv:2207.02860 [hep-ph] .
  * Das  _et al._ (2022) A. Das, Y. F. Perez-Gonzalez, and M. Sen, Phys. Rev. D 106, 095042 (2022), arXiv:2204.11885 [hep-ph] .
  * Asteriadis  _et al._ (2023) K. Asteriadis, A. Q. Triviño, and M. Spinrath, Int. J. Mod. Phys. A 38, 2350139 (2023), arXiv:2208.01207 [hep-ph] .
  * Yin (2019) W. Yin, Chin. Phys. C 43, 045101 (2019), arXiv:1706.07028 [hep-ph] .
  * Hara and Sato (1980) T. Hara and H. Sato, Progress of Theoretical Physics 64, 1089 (1980).
  * Hara and Sato (1981) T. Hara and H. Sato, Prog. Theor. Phys. 65, 477 (1981).
  * Aartsen  _et al._ (2018) M. G. Aartsen _et al._ (IceCube), Science 361, 147 (2018), arXiv:1807.08794 [astro-ph.HE] .
  * Smirnov and Xu (2022) A. Y. Smirnov and X.-J. Xu, JHEP 08, 170 (2022), arXiv:2201.00939 [hep-ph] .
  * Aker  _et al._ (2022b) M. Aker _et al._ (KATRIN), Phys. Rev. Lett. 129, 011806 (2022b), arXiv:2202.04587 [nucl-ex] .
  * Tsai  _et al._ (2022) Y.-D. Tsai, J. Eby, J. Arakawa, D. Farnocchia, and M. S. Safronova, (2022), arXiv:2210.03749 [hep-ph] .
  * Bringmann and Pospelov (2019) T. Bringmann and M. Pospelov, Physical Review Letters 122 (2019), 10.1103/physrevlett.122.171801.
  * Cappiello  _et al._ (2019) C. V. Cappiello, K. C. Y. Ng, and J. F. Beacom, Phys. Rev. D 99, 063004 (2019), arXiv:1810.07705 [hep-ph] .
  * Greisen (1966) K. Greisen, Phys. Rev. Lett. 16, 748 (1966).
  * Zatsepin and Kuz’min (1966) G. T. Zatsepin and V. A. Kuz’min, Soviet Journal of Experimental and Theoretical Physics Letters 4, 78 (1966).
  * Cronin  _et al._ (1997) J. W. Cronin, S. P. Swordy, and T. K. Gaisser, Sci. Am. 276, 32 (1997).
  * Plotko  _et al._ (2023) P. Plotko, A. van Vliet, X. Rodrigues, and W. Winter, Astrophys. J. 953, 129 (2023), arXiv:2208.12274 [astro-ph.HE] .
  * Wang  _et al._ (2022) J.-W. Wang, A. Granelli, and P. Ullio, Phys. Rev. Lett. 128, 221104 (2022), arXiv:2111.13644 [astro-ph.HE] .
  * Ansoldi  _et al._ (2018) S. Ansoldi _et al._ (MAGIC), Astrophys. J. Lett. 863, L10 (2018), arXiv:1807.04300 [astro-ph.HE] .
  * Winter  _et al._ (2020) W. Winter, S. Gao, X. Rodrigues, A. Fedynitch, A. Palladino, and M. Pohl, PoS ICRC2019, 1032 (2020), arXiv:1909.06289 [astro-ph.HE] .
  * Formaggio and Zeller (2012) J. A. Formaggio and G. P. Zeller, Rev. Mod. Phys. 84, 1307 (2012), arXiv:1305.7513 [hep-ex] .
  * Richard  _et al._ (2016) E. Richard _et al._ (Super-Kamiokande), Phys. Rev. D 94, 052001 (2016), arXiv:1510.08127 [hep-ex] .
  * Aartsen  _et al._ (2016a) M. G. Aartsen _et al._ (IceCube), Astrophys. J. 833, 3 (2016a), arXiv:1607.08006 [astro-ph.HE] .
  * Aartsen  _et al._ (2020) M. G. Aartsen _et al._ (IceCube), Phys. Rev. Lett. 125, 121104 (2020), arXiv:2001.09520 [astro-ph.HE] .
  * Aab  _et al._ (2015) A. Aab _et al._ (Pierre Auger), Phys. Rev. D 91, 092008 (2015), arXiv:1504.05397 [astro-ph.HE] .
  * Aartsen  _et al._ (2016b) M. G. Aartsen _et al._ (IceCube), Phys. Rev. Lett. 117, 241101 (2016b), [Erratum: Phys.Rev.Lett. 119, 259902 (2017)], arXiv:1607.05886 [astro-ph.HE] .
  * Gorham  _et al._ (2018) P. W. Gorham _et al._ (ANITA), Phys. Rev. D 98, 022001 (2018), arXiv:1803.02719 [astro-ph.HE] .
  * Kotera (2021) K. Kotera (GRAND), PoS ICRC2021, 1181 (2021), arXiv:2108.00032 [astro-ph.HE] .
  * Abbasi  _et al._ (2021) R. Abbasi _et al._ (IceCube-Gen2), PoS ICRC2021, 1183 (2021), arXiv:2107.08910 [astro-ph.HE] .
  * Ringwald and Wong (2004) A. Ringwald and Y. Y. Y. Wong, JCAP 12, 005 (2004), arXiv:hep-ph/0408241 .
  * Mertsch  _et al._ (2020) P. Mertsch, G. Parimbelli, P. F. de Salas, S. Gariazzo, J. Lesgourgues, and S. Pastor, JCAP 01, 015 (2020), arXiv:1910.13388 [astro-ph.CO] .
  * Zimmer  _et al._ (2023) F. Zimmer, C. A. Correa, and S. Ando, JCAP 11, 038 (2023), arXiv:2306.16444 [astro-ph.CO] .
  * Hotinli  _et al._ (2023) S. C. Hotinli, N. Sabti, J. North, and M. Kamionkowski, Phys. Rev. D 108, 103504 (2023), arXiv:2306.15715 [astro-ph.CO] .
  * Stephenson  _et al._ (1998) G. J. Stephenson, Jr., J. T. Goldman, and B. H. J. McKellar, Int. J. Mod. Phys. A 13, 2765 (1998), arXiv:hep-ph/9603392 .
  * Gondolo and Silk (1999) P. Gondolo and J. Silk, Phys. Rev. Lett. 83, 1719 (1999), arXiv:astro-ph/9906391 .
  * Ferrer  _et al._ (2023) F. Ferrer, G. Herrera, and A. Ibarra, JCAP 05, 057 (2023), arXiv:2209.06339 [hep-ph] .
  * Cline  _et al._ (2023) J. M. Cline, S. Gao, F. Guo, Z. Lin, S. Liu, M. Puel, P. Todd, and T. Xiao, Phys. Rev. Lett. 130, 091402 (2023), arXiv:2209.02713 [hep-ph] .
  * Abbasi  _et al._ (2022) R. Abbasi _et al._ (IceCube), Science 378, 538 (2022), arXiv:2211.09972 [astro-ph.HE] .
  * Roy Choudhury and Choubey (2018) S. Roy Choudhury and S. Choubey, JCAP 09, 017 (2018), arXiv:1806.10832 [astro-ph.CO] .
  * Chacko  _et al._ (2020) Z. Chacko, A. Dev, P. Du, V. Poulin, and Y. Tsai, JHEP 04, 020 (2020), arXiv:1909.05275 [hep-ph] .
  * Di Valentino  _et al._ (2021) E. Di Valentino, S. Gariazzo, and O. Mena, Phys. Rev. D 104, 083504 (2021), arXiv:2106.15267 [astro-ph.CO] .
  * Franco Abellán  _et al._ (2022) G. Franco Abellán, Z. Chacko, A. Dev, P. Du, V. Poulin, and Y. Tsai, JHEP 08, 076 (2022), arXiv:2112.13862 [hep-ph] .
  * Lunardini  _et al._ (2013) C. Lunardini, E. Sabancilar, and L. Yang, JCAP 08, 014 (2013), arXiv:1306.1808 [astro-ph.HE] .
  * Khatri and Sunyaev (2011) R. Khatri and R. A. Sunyaev, Astron. Lett. 37, 367 (2011), arXiv:1009.3932 [astro-ph.CO] .
  * Ivanchik and Yurchenko (2018) A. V. Ivanchik and V. Y. Yurchenko, Phys. Rev. D 98, 081301 (2018), arXiv:1809.03349 [astro-ph.CO] .
  * Haxton and Lin (2000) W. C. Haxton and W. Lin, Phys. Lett. B 486, 263 (2000), arXiv:nucl-th/0006055 .
  * Vitagliano  _et al._ (2017) E. Vitagliano, J. Redondo, and G. Raffelt, JCAP 12, 010 (2017), arXiv:1708.02248 [hep-ph] .
  * Bahcall (1964) J. N. Bahcall, Phys. Rev. Lett. 12, 300 (1964).
  * Bisnovatyj-Kogan and Seidov (1982) G. S. Bisnovatyj-Kogan and Z. F. Seidov, Astron. Zh. 59, 213 (1982).
  * Krauss  _et al._ (1984) L. M. Krauss, S. L. Glashow, and D. N. Schramm, Nature (London) 310, 191 (1984).
  * Horiuchi  _et al._ (2009) S. Horiuchi, J. F. Beacom, and E. Dwek, Phys. Rev. D 79, 083013 (2009), arXiv:0812.3157 [astro-ph] .
  * Seckel  _et al._ (1991) D. Seckel, T. Stanev, and T. K. Gaisser, Astrophys. J. 382, 652 (1991).
  * Ingelman and Thunman (1996) G. Ingelman and M. Thunman, Phys. Rev. D 54, 4385 (1996), arXiv:hep-ph/9604288 .
  * Murase  _et al._ (2016) K. Murase, D. Guetta, and M. Ahlers, Phys. Rev. Lett. 116, 071101 (2016), arXiv:1509.00805 [astro-ph.HE] .


# Revealing CNN Architectures via Side-Channel Analysis in Dataflow-based
Inference Accelerators

Hansika Weerasena, and Prabhat Mishra

###### Abstract

Convolution Neural Networks (CNNs) are widely used in various domains. Recent
advances in dataflow-based CNN accelerators have enabled CNN inference in
resource-constrained edge devices. These dataflow accelerators utilize
inherent data reuse of convolution layers to process CNN models efficiently.
Concealing the architecture of CNN models is critical for privacy and
security. This paper evaluates memory-based side-channel information to
recover CNN architectures from dataflow-based CNN inference accelerators. The
proposed attack exploits spatial and temporal data reuse of the dataflow
mapping on CNN accelerators and architectural hints to recover the structure
of CNN models. Experimental results demonstrate that our proposed side-channel
attack can recover the structures of popular CNN models, namely Lenet,
Alexnet, and VGGnet16.

###### Index Terms:

Neural network, CNN accelerator, side-channels.

##  I Introduction

Convolution Neural Networks (CNNs) [1] are Deep Neural Networks (DNNs) that
incorporate convolution (Conv) layers specialized in processing
multidimensional data. CNNs are used in a wide range of applications, such as
image and video recognition, classification, and analysis. These neural
networks operate in two main phases: training and inference. The training
phase involves a time-consuming process of learning weights in the neural
network, while inference uses the pre-trained neural network to perform fast
predictions. Resource-constrained edge devices perform inference in the device
rather than sending data to a centralized server for inference. These edge
devices can range from mobile phones to remote offline sensor networks.

Edge artificial intelligence (AI) has the benefit of overcoming edge-to-server
communication bottlenecks, high availability without depending on the
internet, real-time insights, and reduced storage. AI at edge needs inference
of pre-trained CNN models on resource-constrained devices with energy and area
constraints. General-purpose central processing units (CPUs) or graphics
processing units (GPUs) can be used for the purpose of training and inference
of CNNs. Although central CPUs or GPUs are used in training these CNNs at
servers, dataflow-based accelerators are preferred for inference at edge
devices. Dataflow is a computing scheme that utilizes inherent data reuse of
Conv layers to achieve efficient CNN inference performance. Dataflow-based CNN
accelerators save energy and execution time by reducing the cost of main
memory accesses by introducing a local memory hierarchy inside the accelerator
[2]. Dataflows can be categorized into multiple taxonomies [2] depending on
the data type that is kept stationary. This paper explores two widely used
dataflows: weight-stationary (WS) and output-stationary (OS). These dataflow
accelerators can be designed using Application Specific Integrated Circuit
(ASIC) as well as Field-Programmable Gate Array (FPGA). ASIC-based
accelerators are preferred in edge inference since they are energy efficient
while providing adequate computational flexibility.

These CNN models need to be run on various edge devices with diverse hardware,
software, and firmware developed by different vendors. Supply chain
vulnerability can lead to security concerns for these edge devices with
accelerators. For example, hardware Trojans can be inserted during the design
as well as fabrication phase of an ASIC-based accelerator with the malicious
intent of leaking sensitive information without being detected at the post-
silicon verification stage or during runtime [3]. In many application
scenarios, the structure of a CNN model should be kept confidential for the
following reasons. (1) CNN model can be a company’s proprietary and critical
intellectual property. (2) Knowing the network model leads to designing and
launching efficient adversarial attacks [4]. (3) User privacy can be
compromised in a shared accelerator if the model type is leaked. Different
types of side-channel analysis (memory, timing, electromagnetic emanation) are
used in recovering CNN structures from GPU/CPUs [5, 6, 7, 8, 9]. GPUs/CPUs use
a temporal computing paradigm where centrally controlled processing units can
only fetch data from the memory hierarchy. On the other hand, dataflow-based
accelerators have a spatial computing paradigm where transfer between
individually controlled processing units is possible. Due to the inherent
difference in computing paradigm and underlying architecture, existing side-
channel attacks on GPU/CPU-based accelerators cannot be directly applied to
dataflow-based accelerators. Furthermore, existing memory-based side-channel
attacks [10] on CNN processing focus on main memory to accelerator memory
transfer, which leads to reverse-engineering a large set of possible CNN
structures for a single CNN model. For example, [10] gives 24 possible
structures for Alexnet [11].

In this paper, we try to answer a fundamental question:  is it possible for an
adversary to exploit inherent data reuse of dataflow-based CNN inference
accelerators via memory side-channels to accurately recover architectures of
CNN models? Our proposed research needs to answer two major challenges in
developing such an attack: (1) how to exploit different dataflow patterns to
converge a large number of potential structures to a few, although different
layer structures can result in the same side-channel values, (2) how to
develop a generalized approach to recover structures from different input,
output, layer sizes and their mapping on the accelerator? CNN consists of a
sequence of Conv, fully-connected (FC), and pooling layers. Due to the
prevalence of Conv layers and their inherent data reuse, CNN accelerators
focus on accelerating convolution layers. Therefore, our study primarily
focuses on extracting Conv layer structure while recovering the entire CNN
architecture. Specifically, this paper makes the following important
contributions.

  * •

We define a threat model to gather memory-based side-channel information from
a dataflow-based CNN inference accelerator.

  * •

We propose a framework to recover the structure of Conv and FC layers from
weight-stationary and output-stationary dataflow-based CNN inference
accelerators with local forwarding.

  * •

We propose a method to recover pooling layer parameters from a pooling module
inside the CNN accelerator.

  * •

Experimental results demonstrate that our approach can fully recover CNN
architectures from popular CNN models (Lenet [12], Alexnet [11], VGG-16 [13]).

The rest of the paper is organized as follows. Section II presents background
on CNN and dataflow-based accelerators. Section III outlines the threat model.
Section IV describes our proposed approaches for extracting CNN architectures.
Section V presents the experimental results. Finally, Section VI concludes the
paper.

##  II Background and Related Work

###  II-A Convolutional Neural Networks (CNN)

Figure 1: Convolution layer parameters, semantics and operation: A $R\times
R\times C$ filter is applied on same size neighborhood of ifmap of size
$X\times Y\times C$ to calculate single value in ofmap of size
$X^{\prime}\times Y^{\prime}\times K$.

CNN mainly consists of three types of layers: convolutional, pooling, and
fully-connected (FC) layers [1]. Convolution layers dominate the computations
in CNN (about 90% [14]). A convolution layer takes an input activation/input
feature map (ifmap) and does 2-D convolution using a set of filters with
weights to obtain an output feature map (ofmap). Applying different filters
results in extracting different embedded features from the ifmap. Figure 1
illustrates a typical convolution operation with $K$ convolution filters of
size $R$ and having $C$ input channels. It shows how the first element of
ofmap is calculated by the sum of element-wise multiplication between a filter
of size $R\times R\times C$ and the same size neighborhood of ifmap. Stride
and padding are two other vital parameters of a convolution layer. Stride
($St$) represents the number of values a filter moves horizontally or
vertically during a convolution operation. Padding ($Pd$) is the number of
additional values around the edges of the ifmap before applying the
convolution filter. All convolution layers follow the relationship in Equation
1. The same relationship holds for $Y$ and $Y^{\prime}$.

$X^{\prime}=((X-R+2Pd)/St)+1$ (1)

In an FC layer, all the values of ifmap are connected to all the values of
ofmap. In other words, a single ofmap value is composed using the weighted sum
of all the ifmap values. The pooling layer is typically used after conv layer
to reduce the dimensionality of the feature map. Max pooling and average
pooling are two frequently used pooling operations [15]. Conv and FC layer
execution can be viewed as a set of multiply and accumulate (MAC) operations,
and modern accelerators perform a large number of MAC operations in parallel.

###  II-B Dataflow-based CNN Accelerators

Different highly-parallel computing paradigms are used in the processing of
CNNs, namely temporal and spatial architectures [2]. CPUs/GPUs are categorized
as temporal architectures, which have a large number of centrally controlled
processing elements (PEs) with arithmetic and logic units. They can fetch data
from the memory hierarchy but cannot communicate with each other. GPUs and
CPUs use kernel-based accelerations by mapping FC and Conv layers to matrix
operations. On the other hand, dataflow-based accelerators fall into spatial
architectures where each PE has its own control logic and register. Dataflow-
based accelerators use effective mapping of MAC operations to minimize main
memory access, which results in low power and better execution time.

The CNN accelerators considered in this study process the CNN layer by layer
[10]. In other words, the accelerator loads ifmap/weights of a particular
layer to the global buffer, processes it, and writes ofmap of the layer back
to the main memory. Dataflow determines how the data is moved and processed
through the accelerator architecture to perform MAC operation needed for a CNN
layer. Dataflow mapping refers to how MAC operations are assigned to each
processing element in each cycle. Dataflow-based CNN accelerators try to get
maximum data reuse efficient dataflow mapping. A typical architecture [16, 10]
of a dataflow-based CNN inference accelerator used in edge devices is shown in
Figure 4. The controller, interconnects, global buffer (GB), and PE arrays can
be identified as critical components of a CNN accelerator.

A typical CNN accelerator supports three separate Network-on-Chip
(NoC)/interconnects [17, 18] for two reasons: (1) different data types
(weights/ifmaps/ofmaps) need different data transmission patterns (unicast,
multicast, and broadcast), and (2) enables high-speed data transfer and
pipelined operation. Dataflow defines how PEs and interconnects are arranged.
There are weight-stationary (WS) [19, 20, 17] and output-stationary (OS) [21]
dataflow based architectures with subtle differences. Our study focuses on the
dataflow aspect of the accelerator by using a generic WS (section II-B1) and
OS (section II-B2) dataflow architecture with input forwarding.

####  II-B1 Weight Stationary Dataflow

Figure 2: WS($m,n$) architecture: weight-stationary dataflow with n processing
element (PE) arrays and m PEs per array, with separate interconnects for
weight/input reads and partial sum reads and writes from/to Global Buffer
(GB). Neighboring PEs in an array has input-forwarding connections.

As the name suggests, once a weight value is read to a PE, a WS dataflow does
all the MAC operations involving that weight before reading a new value to a
PE. Figure 2 shows an architecture of a weight-stationary dataflow that reuses
weights temporarily and input activations spatially. It has $n$ PE arrays,
each with $m$ PEs and denoted by the notation WS($m,n$). This accelerator has
unicast NoC for weight, PE array-wise multicast supported NoC for inputs,
another interconnect for partial sum reads, and a fixed accumulation tree NoC
with adders similar to [17]. There are separate adder trees per array, and an
adder tree will accumulate/sum up all weight activation products of an array
in the preceding cycle. The resulting value is a partial sum (psum) for a one
ofmap entry. This architecture can process multiple filters simultaneously
using separate PE arrays per filter. This architecture minimizes ifmap reads
by spatial reuse in two ways: (1) PE array-wise multicast shares the same
input values across multiple PE arrays where each PE array calculates for a
different filter, and (2) forwarding connection in a PE array can share
activation values between two cycles occurring due to the stride of the
filter. This weight-stationary architecture has flexibility in mapping,
depending on the layer, the in-between forwarding connections between PEs can
be switched on/off. Mapping of the layer to the PEs is optimized for maximum
PE utilization and minimizing input reads. For example, if $m=4$ and $n=1$,
the first row of two channels of $2\times 2\times 2$ CNN filter can be mapped
as shown in Figure 3(a). If the filter size is $4\times 4\times 2$, only one
channel row of the filter is mapped in the first cycle as shown in Figure
3(b). Both of the examples have a stride of one.

####  II-B2 Output Stationary Dataflow

An output-stationary dataflow accumulates psums corresponding to one ofmap
value in the internal register of a PE until it is fully calculated. In other
words, a PE is mapped to a single value of ofmap until that value is fully
calculated. Similar to the WS dataflow architecture discussed in Figure 2, it
has $n$ PE arrays, each with $m$ PEs and denoted by the notation OS($m,n$),
but with the following modifications. Instead of the internal register keeping
weights stationary, it accumulates psums. This accelerator has unicast NoC for
inputs, single value broadcast supported NoC for weights, and separate
interconnect to write outputs to the GB. One PE array will accumulate sums
relevant to one row of ofmap so that forwarding links between PEs in the array
can have maximum utilization. Due to the broadcast of a single weight, every
PE calculates MAC relevant to one input channel in a cycle. In the first
cycle, the accelerator multicasts the same weight to all the PEs and unicasts
relevant activations to each PE. After doing MAC operations and accumulating
the partial sum to the internal registry, different weight is broadcast in the
second cycle. After the local forwarding of inputs, the remaining inputs are
unicast relevant to the previous partial sum. Figure 3(c) shows a layer
mapping with one filter with parameters $\\{R=2,C=2,st=1,pd=0\\}$, ifmap of
$\\{X=5,Y=5,C=2\\}$, and ofmap of $\\{X^{\prime}=4,Y^{\prime}=4,K=1\\}$ to a
$m=4$ and $n=1$ output stationary accelerator. As we can see, there is only
one input read (I[1,1,5]) in the second cycle due to spatio-temporal
forwarding of inputs (I[1,1,2] and I[1,1,3]) from the previous cycle.

Figure 3: Dataflow mapping and data reads for the first two cycles for three
scenarios: (a) mapping of $2\times 2\times 2$ filter into WS($4,1$), (b)
mapping of $4\times 4\times 2$ filter into WS($4,1$), and (c) mapping of
$2\times 2$ filter into OS($4,1$) with $st=1$ and $pd=0$ and ifmap of
$\\{X=5,Y=5,C=2\\}$, and ofmap of $\\{X^{\prime}=4,Y^{\prime}=4,K=1\\}$.

###  II-C Related Work

There are many efforts on leaking DNN/CNN architectures using side-channel
attacks. Timing and memory side channels have been used to recover DNN models
in [7, 10, 5, 6]. An attack to recover compact DNN models from GPU using
timing, memory, power, and kernel side channels is proposed in [6]. They
assume the attacker knows power consumption, memory footprint, and latency for
backward and forward propagation for different batch sizes. Hu et al. [5]
propose a method to find DNN architecture by eavesdropping into off-chip data
transfer between CPU and GPU and exploiting the entire DNN execution stack
(the DNN library, Hardware abstraction, and Hardware). Another side-channel
attack on analyzing main memory to accelerator memory access trace and
execution time is discussed in [10]. The adversary can control the input to
the accelerator and derive a set of potential models for the currently running
DNN model. For example, they propose 24 possible structures for Alexnet. Wei
et al. [7] exploit context switching of GPU to recover DNN models. This attack
is made in the training stage because they can exploit multiple uses of the
same layers over training time. Apart from memory and timing side channels,
attacks are proposed on cache side channels to recover DNN models [8, 22, 23].
A few attacks can be seen using power [24] and electromagnetic side channels
[9, 25] to recover CNN model structures. These studies validate that
recovering DNN/CNN architecture is a critical security concern. To the best of
our knowledge, our paper is the first study on recovering CNN model
architecture using memory side channels of dataflow-based CNN inference
accelerators.

##  III Threat Model and Problem Formulation

Figure 4 illustrates an overview of a typical dataflow-based CNN accelerator
with layer-by-layer execution described in section II-B. If we zoom into the
processing of one layer, first, the host CPU loads ifmap/weights to the GB.
These ifmaps/weights are stored as arrays in memory, which means they are
stored in contiguous memory locations, and GB preserves the order. The PE
arrays are designed in a pipelined manner to do MAC operations in each cycle.
Each PE in the PE array has a local registry to hold or accumulate certain
data elements to reuse in MAC operations. The controller is responsible for
loading weights/inputs/psums to individual PEs in each cycle. The controller
first calculates memory requests for the next cycle depending on the dataflow
supported by the accelerator and layer parameters. Then, it issues memory
requests to the global buffer. The global buffer uses interconnects between GB
and PE arrays for data transfer.

The threat model assumes the adversary gathers the following memory side-
channel information regarding the execution of each layer CNN: (1) the total
number of weight/input reads and output writes, (2) the number of weight/input
reads, output writes each cycle of execution until a targeted event ($e$) that
depends on the dataflow (the concrete definition of $e$ in WS and OS dataflow
are stated in section IV-C and IV-D respectively.), and (3) output stationary
dataflow needs the virtual address of weight reads in the first two cycles.
Here, an input read means reading of a single value from an ifmap and an
output write means writing of a single value to an ofmap. Depending on the
adversary’s capabilities, there are several ways to obtain these three pieces
of information. The adversary can exploit unprotected communication between
accelerator components. Information (1) and (2) can be obtained by snooping
interconnects from GB to PE arrays ( a in Figure 4). Since these accelerators
use separate interconnects for each data type, it is easy to distinguish and
count GB accesses that can be snooping on the interconnects. Alternatively,
the adversary can obtain information (1) and (2) along with (3) by snooping
the unprotected bus between the controller to GB ( b in Figure 4). If there is
a pooling layer, for the recovery pooling layer parameters, the adversary
needs to find the number of pooling operations ($N_{pool}$). $N_{pool}$ can be
recovered using the number of output writes to DRAM from GB ( c in Figure 4)
during the layer execution. Snooping of these buses ( a, b and c) can be done
either through physical probing of buses or through a hardware Trojan.
Alternatively, a compromised accelerator firmware or host operating system can
steal relevant side-channel ((1), (2), and $N_{pool}$) information by
accessing performance counters.

Figure 4: Overview of a typical CNN accelerator. The controller,
interconnects, global buffer (GB), and processing element (PE) arrays are the
critical components. Unprotected communication can be snooped to extract side-
channel data.

Our threat model also assumes that the adversary knows the accelerator
architecture (number of PE arrays, number of PEs in an array, and the
bandwidth of interconnects for each data type) as well as the dataflow mapping
of each accelerator described in Section II-B. We also assume the adversary
knows the ifmap parameters ($X,Y,C$) of the first layer. In the layer-by-layer
recovery of CNN, knowing the previous layer ofmap parameters can be directly
used as ifmap parameters for the next layer. In other words, knowing the ifmap
parameters of the first layer and recovering the parameters of that layer
indirectly finds the ifmap parameters of the second layer. The proposed attack
is passive, where the adversary can only snoop on the side-channel information
but cannot alter dataflow mapping or data communication inside the
accelerator. Furthermore, the adversary does not need to know the training or
testing data of the CNN model.

##  IV Extracting CNN Architecture using Side-Channel Analysis

Algorithm 1 shows an overview of the attack for recovering potential CNN
structures from a dataflow-based accelerator. Lines 3-9 elaborate layer-by-
layer side-channel data collection, which needs recognizing layer boundaries
(line 5) discussed in Section IV-A. In each side-channel variable, the
Superscript ($j$ or $k$) specifies the layer number relevant to the variable.
Lines 10-14 elaborate layer-by-layer structure recovery. The first dimension
of the $layers$ 2D array (line 10) contains the number of layers ($j$) in CNN,
and the second dimension contains possible structures for each layer. In
layer-wise structure recovery, as the first step, the layer type is identified
(line 12), which is discussed in Section IV-B. Then the side-channel
information is used to recover each layer’s parameters (line 14). It is
important to notice that if there are multiple potential structures for the
previous layer, the algorithm tries ifmap parameters ($X,Y,C$) of all of them
to recover potential structures for the current layer (loop at line 13).
Finally, the adversary flatten the 2D array $layers$ to multiple 1D arrays
satisfying $ifmap_{j}=ofmap_{j-1}$ to get all the potential structures of the
CNN model (line 15).

Algorithm 2 zooms into recovering individual layer structures. Depending on
the layer type, the layer recovery procedure calls different functions (line
3, 5 and 8). The most crucial and difficult task is to recover Conv layer. The
subscript in $recoverConv_{DF}$ highlights that the recovery of the Conv layer
depends on the dataflow. Therefore, recovery of Conv from WS dataflow and OS
dataflow are elaborated in Section IV-C and IV-D, respectively. The function
$recoverConv_{DF}$ returns a list of potential structures ($H$) but the
conditional filters used in recovering Conv layers in WS and OS dataflows
ensure that $H$ is a list with a few solutions or one solution (Section V
shows Conv layer recovery in popular benchmarks converging to one structure).
The recovery of FC (line3) and pooling (line 8) layers are discussed in
Section IV-E and IV-F, respectively. Table I outlines the notations used in
these algorithms. Figure 5 presents a high-level overview of our proposed
side-channel attack.

Figure 5: Overview of the proposed side-channel attack to recover CNN model.
The adversary collects layer-by-layer side-channel information, and utilizes
them to recover layer-by-layer CNN structure. Algorithm 1 Recovering potential
CNN structures

1:Input: First ifmap parametes, {$X^{1},Y^{1},C^{1}$}

2:Output: Potential CNN architectures

3:j = 1 $\triangleright$ to count the number of layers

4:while processing of the CNN do

5: while IdentifyLayerBoundary() do

6: $W^{j}_{r},I^{j}_{r},O^{j}_{w}\leftarrow$ collect total R/W counts

7: $w^{j},i^{j},o^{j}\leftarrow$ collect cycle-wise R/W counts until event $e$

8: $N^{j}_{pool}\leftarrow$ collect No. of pooling operations

9: j ++

10:$layers=[]$ $\triangleright$ empty 2D array

11:for k=1 to j do

12: type $\leftarrow$
IdentifyLayerType($W^{k}_{r},I^{k}_{r},O^{k}_{w},N^{k}_{pool}$)

13: for number of layer structures in layers[k-1] do

14: $layers[k]$ $\cup$
recoverLayer($W^{k}_{r}$,$I^{k}_{w}$,$O^{k}_{w}$,$w^{k}$,$i^{k}$,$o^{k}$,
$X^{k}$,$Y^{k}$,$C^{k}$,$type$)

15:Return Flatten 2D array $layers$ to multiple 1D arrays satisfying
$ifmap_{j}=ofmap_{j-1}$ to get all potential structures.

Algorithm 2 Recovering layer parameters

1:function recoverLayer($W_{r},I_{r},O_{w},w,i,o,X,Y,C,type$)

2: if type = FC then

3: layer $\leftarrow$ recoverFC($W_{r},I_{r},O_{w}$)

4: if type = Conv then

5: H $\leftarrow$ $recoverConv_{DF}$($W_{r},O_{w},w,i,o,X,Y,C$)

6: if Conv layer has pooling then

7: for h in H do

8: h $\cup$ recoverPooling($N_{pool},X^{\prime},Y^{\prime},K$)

9: layer $\leftarrow H$

10: retrun layer

TABLE I: Table of notations. $n$ |  Number of PE arrays in an accelerator
---|---
$m$ |  Number of PEs per array in an accelerator
$W_{r}$ |  Total no. of weight reads for the layer execution.
$I_{r}$ |  Total no. of input reads for the layer execution.
$O_{w}$ |  Total no. of output reads for the layer execution.
$t_{e}$ |  Cycle number of the targeted event $e$.
$w$ |  Array of no. of weight reads at each cycle.
$i$ |  Array of no. of input reads at each cycle.
$o$ |  Array of no. of output writes at each cycle.
$i[t]$ |  Number of input reads at $t^{th}$ cycle.
$w[t]$ |  Number of weight reads at $t^{th}$ cycle.
$\&(dt)$ |  Virtual address of data $dt$ in global buffer.
$H$ |  Possible parameter sets for a Conv Layer.
$ceil(x)$ |  Round-up number x to nearest integer.

###  IV-A Identification of Layer Boundary

We present two ways to identify layer boundaries in a dataflow-based
accelerator. The first method is to use the Read-After-Write (RAW) dependency
of ifmap current layer and ofmap of the previous layer. Dataflow accelerators
have sequential execution of the layers. Therefore, upon a successful layer
execution, the ofmap is written back to the hosts’ main memory (DRAM) and read
it back to GB in the next layer as ifmap. This event can be identified using
the memory trace as a RAW dependency on the same memory address. This needs an
adversary needs to collect or actively observe the memory trace (address and
cycle) between the GB and DRAM of the host. Similar to collecting previous
side-channel information, this can be done by snooping the memory bus between
GB to DRAM ( c in Figure 4).

The second method is by identifying the configuration phase between layers.
However, this approach is applicable in accelerators that have some
reconfigurability. Since each layer differs, there is a configuration phase to
dataflow mapping at each layer. Most CNN accelerators use a separate low-
bandwidth bus ( d in Figure 4) to send these configurations. Therefore,
looking at active periods in that network is a simple way to identify
boundaries. For example, the WS dataflow-based accelerator configures (on/off)
forward links between PEs configured at each layer’s beginning. The adversary
can listen to this control message to identify layer boundaries.

###  IV-B Identification of Layer Type

The adversary needs to separate between FC, Conv, and Pooling layers. Because
of no data reusability in FC layers, the total number of weight reads
($W_{r}$) in a layer is equal to the multiplication between the total number
of input reads ($I_{r}$) and output writes ($O_{w}$). This relationship is
used to distinguish an FC layer from a Conv layer. If there is a pooling layer
after the execution of Conv layer, CNN accelerators run the Conv layer
together with the pooling layer using a separate pooling module as shown in
Figure 4 (They are not processed as two separate layers). An adversary can
detect a pooling layer by observing a difference between the number of outputs
written to the global buffer and those written to DRAM inside the layer
boundary.

###  IV-C Recovery of Conv Layer from Weight-Stationary Dataflow

There are five parameters ($R,C,K,St,Pd$) that define a Conv layer. Since the
number of input channels ($C$) is known from ifmap parameters, an adversary
needs to find four parameters ($R,K,St,Pd$) for successful Conv layer
recovery. Algorithm 3 describes the attack steps for recovering a Conv layer
from the WS dataflow based architecture outlined in Section II-B. We refer to
the $1^{st}$ cycle relative to each layer which is the first cycle with data
transfer between GB to PE arrays. Here we define the targeted event for the
cycle-to-cycle data collection as the cycle $t_{e}$ where $i[1]=i[t_{e}]$. In
other words, the adversary collects data reads/writes between the first cycle
and the next ones with the same number of reads in the first cycle. This
collects the number of data reads/writes accountable for the one row of the
output feature map.

Algorithm 3 Recovering Conv Layer from WS dataflow

1:function $recoverConv_{ws}$($W_{r},O_{w},w,i,o,X,Y,C$)

2: $H\leftarrow$ solve Equation 2 $\in\mathbb{Z}^{+}$

3: $n_{a}\leftarrow w[1]/i[1]$

4: $X^{\prime}\leftarrow t_{e}-1$

5: for $\\{R,K\\}$ in H do

6: if $R\leq w[1]/n_{a}$ and $(w[1]/n_{a})\%R\neq 0$ then

7: remove $\\{R,K\\}$

8: $st\leftarrow i[2]/max((m//R),1)$

9: if $st\notin\mathbb{Z}^{+}$ or $st>R$ then

10: remove $\\{R,K\\}$

11: $pd\leftarrow$ substitute $\\{R,st\\}$ and $X,X^{\prime}$ to Equation 1

12: if $pd\notin\mathbb{Z}^{+}$ or $pd>R$ then

13: remove $\\{R,K,st\\}$

14: $Y^{\prime}\leftarrow$ substitute $\\{R,st\\}$ and $Y,pd$ to Equation 1

15: if $O_{w}\neq X^{\prime}\times Y^{\prime}\times K$ then

16: remove $\\{R,K,st,pd\\}$

17: return $H$

Due to the inherent feature of a WS dataflow, a single weight value is read
only once:

$W_{r}=R^{2}\times C\times K$ (2)

Solving of Equation 2 with known $C$ in positive integer ($\mathbb{Z}^{+}$)
domain provides potential solutions ($H$) for {R,K} values of the layer
parameters (line 2). Then the adversary calculates $n_{a}$, the number of
active PE arrays in the accelerator. Most of the time, the number of filters
($K$) is greater than the number of PE arrays ($n$) of the accelerator
architecture, then $n_{a}=n$. Due to the targeted event of data collection,
the number of cycles between reveals the width of the output feature map
($X^{\prime}$) (line 4). Even when $R>m$ and folding is supported, the number
of cycles up to the event minus one reflects the value of $X^{\prime}$. Then
the adversary iterates (lines 5 - 16) through the potential {$R,K$} values and
uses architectural hints and side-channel information to filter out
incompatible {$R,K$}. The first condition (line 6) applies when the potential
value of $R$ is smaller than the active PE array length ($w[1]/n_{a}$). As
discussed in Section II-B, the adversary uses the dataflow-mapping property of
the accelerator to minimize input reads by only fully mapping filter rows. For
example, if the PE array length is 12 ($m=12$) and $R,K$ are 5 and 4, the
layer is mapped as two 10 MACs across two channels by utilizing only 10 PEs,
not 12 Macs followed by 8. Line 6 checks the condition ($(w[1]/n_{a})\%R\neq
0$) and filter out solutions.

The adversary calculates the stride ($st$) of the respective potential $R$
(line 8). Since the forward links between PEs are used to forward ifmap values
from the previous cycle, the number of new input reads for the current cycle
is always an integer multiple of stride. At line 8, $m//R$ ( // is the integer
division) gives out the number of channels of a filter mapped to the PE array
when $m\geq R$. If $m<R$ and folding is used, only one channel is mapped to a
PE array. Taking the maximum, consider both conditions ($m\geq R$ and $m<R$ ).
The second cycle has input forwarding, and $i[2]$ is the number of new input
reads after input forwarding. Therefore, dividing $i[2]$ by the number of
channels mapped to one PE array is the stride for the selected $R$. The
condition at line 9 checks if the previously calculated $st$ is in the integer
domain and is less than the filter size ($R$). Then adversary can use Equation
1 to calculate $pd$ and check if $pd$ is in the integer domain and it is less
than filter width ($R$). Line 14 calculates $Y^{\prime}$ using the Equation 1
from previously found values ($R,Y,st,pd$). The final condition asserts
whether the side-channel information $O_{w}$ equals expected output writes
($X^{\prime}\times Y^{\prime}\times K$). The returned $H$ has potential
solutions for the layer’s parameters $\\{R,K,C,st,pd\\}$. In WS dataflow,
$O_{w}$ is equal to the difference between the number of partial sum reads and
writes ($psum_{w}-psum_{r}$). The section V-C provides a case study on the
second Conv layer of Alexnet, which converges into one solution.

###  IV-D Recovery of Conv Layer from Output-Stationary Dataflow

Algorithm 4 outlines the attack steps for recovering Conv layer parameters
from the OS dataflow-supported architecture described in the Section II-B.
Here we define the targeted event for the cycle-to-cycle data collection as
the cycle where the first ofmap value is written. In other words, the
adversary collects the cycle-to-cycle data from the first cycle to the cycle
where the first output is written. In an OS dataflow, there are no partial
outputs/sums. In other words, an ofmap value is written only after it is fully
calculated. The intuition behind the targeted event selection is to find the
number of weight reads responsible for fully calculating one ofmap value.

Algorithm 4 Recovering Conv Layer from OS dataflow

1:function $recoverConv_{os}$($W_{r},O_{w},w,i,o,X,Y,C$)

2: $eq\leftarrow R^{2}C=t_{e}-1$

3: $R\leftarrow$ solve $eq$ for $R$ in $\mathbb{Z}^{+}$

4: $st\leftarrow$ &[$w_{1}$] - &[$w_{2}$]

5: for $pd=0$ to $R-1$ do

6: $X^{\prime}\leftarrow$ substitute $R,st,pd,X$ for Equation 1

7: $Y^{\prime}\leftarrow$ substitute $R,st,pd,Y$ for Equation 1

8: if $X^{\prime},Y^{\prime}\notin\mathbb{Z}^{+}$ then continue
$\triangleright$ Not a solution

9: $K\leftarrow$ substitute $\\{X^{\prime},Y^{\prime}\\}$ to Equation 3

10: if $K\in\mathbb{Z}^{+}$ and $\\{X^{\prime},Y^{\prime},R,K,C\\}$ satisfy
Eq. 4 then

11: $H\leftarrow$ $H\cup$ $\\{R,K,C,st,pd\\}$

12: return $H$

When we consider one ofmap value, it is generated from an accumulation of
multiplications between a single filter of width and height of $R$ with $C$
channels. In other words, the total responsible weight reads for a single
value in ifmap is $R^{2}C$. Our selection of the targeted event ensures that
the ($t_{e}-1$) equals $R^{2}C$ (line 2). Since the architecture reads one
weight in a cycle, the relationship in line 2 holds. Solving this relationship
in the $\mathbb{Z}^{+}$ domain gives the value of R. Because of the forwarding
connections at each PE in the PE array, the difference between the virtual
address of weight reads from the controller gives the value of stride (line
4). Lines 5 to 11 iterate through all possible $pd$ values. This loop
termination considers that padding cannot exceed the filter width ($R$). Lines
6 and 7 calculate the width ($X^{\prime}$) and height ($Y^{\prime}$) of the
ofmap for the selected $pd$. The condition at line 8 checks if the calculated
$X^{\prime},Y^{\prime}$ is in $\mathbb{Z}^{+}$ domain; if not, we move to the
next $pd$ value in the loop. In an OS dataflow, the number of total output
written ($O_{w}$) to the GB:

$O_{w}=X^{\prime}\times Y^{\prime}\times K$ (3)

Line 9 substitutes previously calculated $\\{X^{\prime},Y^{\prime}\\}$ to the
above equation and finds $K$. Line 9 checks for two conditions: (1) whether
$K$ is in $\mathbb{Z}^{+}$ domain, and (2) does the relationship stated in
Equation 4 holds for the potential value set
$\\{X^{\prime},Y^{\prime},R,K,C\\}$?

$W_{r}=(ceil(\frac{X^{\prime}}{m})\times ceil(\frac{Y^{\prime}}{n}))R^{2}CK$
(4)

All PEs in this OS architecture conducts MAC operations relevant to one output
channel due to the broadcasting of weights. Therefore, the psum accumulated at
each registry is also relevant to a single output channel. When we zoom into
Equation 4, $(ceil(\frac{X^{\prime}}{m})\times ceil(\frac{Y^{\prime}}{n}))$
gives the number of tiles needed to calculate all ofmap values of a single
output channel. For example, if we process a layer with
($X^{\prime},Y^{\prime}=12,K=1$) in an OS($12,4$) architecture. The first tile
calculates ofmap values for the first four rows and the second and third tiles
for the middle four rows and last four rows, respectively. From the first line
of the algorithm, $R^{2}C$ gives weight reads for one tile. So, the number of
tiles per single output channel $\times$ weight reads per tile $\times$ number
of output channels gives the total weight reads. Section V-D shows a case
study on the second Conv layer of Alexnet that converged into one solution.

###  IV-E Extraction of FC Layer Parameters

An FC layer can be considered a Conv layer with a filter size equal to the
size of the input, effectively connecting all neurons to each other.
Therefore, extracting FC layer parameters is relatively straightforward
compared to extracting Conv layer parameters. An FC layer has only two
parameters, which are input neuron size and output neuron size. FC layer
parameters can be found independent of dataflow and underneath accelerator
architecture by only looking at total data reads and writes for the layer. The
total number of input reads in a layer ($I_{r}$) equals the number of input
neurons in an FC layer. Similarly, the total number of output writes ($O_{w}$)
equals the number of output neurons. Additionally, a dense FC layer has
$W_{r}=I_{r}\times O_{w}$ relationship.

###  IV-F Extraction of Pooling Layer Parameters

Our methodology to extract pooling layers from max or average pooling depends
on three assumptions based on typical pooling operations on CNNs. (1) Usually,
the stride is greater than 1 [2]. (2) Max and average pooling typically does
not use padding. (3) CNNs tend to use small pooling filter sizes because large
pooling filters tend to overfit models by losing information. The pooling
operation does not change the number of output channels ($K$). Algorithm 5
outlines the steps to recover pooling layer parameters
($\\{R_{pool},st_{pool}\\}$) from side-channel information.

Algorithm 5 Recovering pooling layer

1:function recoverPooling($N_{pool},X^{\prime},Y^{\prime},K$)

2: for $R_{pool}=2$ to $X^{\prime}$ do

3: for $st_{pool}=R_{pool}$ to $1$ do

4: $X_{pool}\leftarrow((X^{\prime}-R_{pool})/st_{pool}+1)$

5: $Y_{pool}\leftarrow((Y^{\prime}-R_{pool})/st_{pool}+1)$

6: if $N_{pool}/K=X_{pool}\times Y_{pool}$ then

7: return $\\{R_{pool},st_{pool}\\}$

The loop at line 2 searches for pooling layers for increasing filter sizes,
which gives more dominance to small pool layers. The second loop (line 3)
ensures the attack first tries to match a non-overlapping pooling layer and
increases the overlapping in subsequent iterations. Line 4 and 5 calculates
the ofmap width ($X_{pool}$) and height ($Y_{pool}$) after pooling. Finally,
the condition at line 6 checks if the monitored $N_{pool}$ satisfies the
calculated {$X_{pool},Y_{pool}$} values to find the pooling layer parameters.

##  V Experiments

###  V-A Experimental Setup

We performed modifications on top of the cycle-accurate Stonne [26]
accelerator simulator to model the WS dataflow described in Section II-B1 and
an in-house cycle-accurate simulator to model the OS dataflow described in
Section II-B2. We gathered the side-channel information using the global
buffer of the simulator. We provide adequate bandwidth for interconnects of
each data type (input, output, weight) in each simulation so that any data
loads will happen in one cycle. We model a simple pooling module in both
accelerators to mimic pooling operations and extract the number of pooling
operations. We model three concrete weight-stationary accelerator
architectures from the architecture described in Section II-B: WS($4,4$),
WS($12,4$), and WS($24,10$). Similarly, we use three output stationary
dataflow accelerators: OS$(4,4)$, OS$(10,4)$, and OS$(20,10)$. We attacked and
recovered popular CNN models: a 5-layer Lenet, an 8-layer AlexNet, and a
16-layer VGGnet-16 to evaluate the proposed CNN model recovery attack. Table
II shows an overview of our experimental setup.

TABLE II: Number of potential structures recovered from Lenet, Alexnet, and
VGGnet-16 using our method and comparison with [10] that exploit DRAM to GB
memory access.

CNN model | Lenet | Alexnet | VGGnet-16
---|---|---|---
| Number of layers
---
(Conv/Pool/FC)
3/2/2 | 5/3/3 | 13/5/3
| Conv layer filter sizes
---
| 5x5
---
2x2
| 11x11
---
5x5, 3x3
| 1x1
---
3x3
Number of potential structures |  WS(4,4) | 1 | 1 | 1
WS(12,4) | 1 | 1 | 1
WS(24,10) | 1 | 1 | 1
OS(4,4) | 1 | 1 | 1
OS(10,4) | 1 | 1 | 1
OS(20,10) | 1 | 1 | 1
[10] | 9 | 24 | -

###  V-B Results

As shown in Table II, we can fully recover CNN parameters for Lenet, Alexnet,
and VGGnet-16 for both WS and OS dataflow accelerators of two sizes. The layer
boundaries of WS dataflow are identified by monitoring the configuration phase
and OS dataflow by observing RAW dependency of feature maps. The CNN structure
has converged into one solution, which highlights that for each Conv layers
Algorithm 3 and 4 converged to one solution ($size(H)=1$) for the respective
layer parameters. This is because our method can recover exact values for some
parameters ($X^{\prime}$ in WS and $R$ and $st$ in OS) and use them with
multiple condition checks to converge to the potential structure.

TABLE III: Side channel data ($I_{r},O_{w},W_{r}$) for all fully connected
layers of Alexnet on OS and WS dataflows.

Layer | FC1 | FC2 | FC3
---|---|---|---
Input reads | 9216 | 4096 | 4096
Weight reads | 37748736 | 16777216 | 4096000
Output writes | 4096 | 4096 | 1000

Since no approaches exist on dataflow architectures to recover CNN models, we
compare our results with [10], which uses the DRAM to GB memory access
patterns and execution time of layers on an FPGA-based accelerator to recover
CNN models. They were able to recover six potential structures for Lenet and
24 potential structures for Alexnet. Since our approach exploits inherent
dataflow patterns and data reuse that leak critical characteristics of layers,
our solution converged into one correct structure in both cases across all
architectures. Table III and IV shows side-channel data on all FC and pooling
layers of Alexnet. The side-channel data of FC and pooling layers do not
depend on the specific dataflow architecture of the accelerator. Section V-C
and V-D provide two case studies using Alexnet to provide insight into the
recovery procedure of Conv layers.

TABLE IV: Side channel data ($N_{pool}$) for all pooling layers of Alexnet
running on the pooling module.

Layer | Pool 1 | Pool 2 | Pool 3
---|---|---|---
Number of pool op. | 69984 | 43264 | 9216

###  V-C Case Study: Alexnet with Weight-Stationary Dataflow

Figure 6: Dataflow mapping at 1st and 2nd cycle of Alexnet Conv2 layer in
WS(12,4) accelerator (only 1st PE array is shown).

Table V shows the side-channel information used to recover all five Conv
layers of Alexnet in the WS($12,4$) accelerator. The attack needs only a
relatively small number of cycle-wise data to be collected. For example, the
targeted event cycle in the second Conv layer is 55, while the total is
2395801 cycles. The rest of the section zooms in on recovering the second Conv
layer of Alexnet using Algorithm 3.

TABLE V: Side-channel information for all five Conv layers on Alexnet running
on WS($12,4$) and the number of cycles.

Layer |  | Weight
---
reads
| psum
---
reads
| psum
---
writes
| Event
---
cycle
| Total
---
cycles
Conv1 | 614400 | 44603136 | 44789760 | 27 | 11197441
Conv2 | 34848 | 9292800 | 9583200 | 55 | 2395801
Conv3 | 884736 | 12395136 | 12460032 | 13 | 3115009
Conv4 | 1327104 | 18625152 | 18690048 | 13 | 4672513
Conv5 | 884736 | 12416768 | 12460032 | 13 | 3115009

The second Conv layer of Alexnet has 256 filters ($K=256$) with parameters
$\\{R=5,C=96,st=1,pd=2\\}$. This layer takes a input feature map of size
$\\{X=27,Y=27,C=96\\}$ and output a feature map of paramaters
$\\{X^{\prime}=27,Y^{\prime}=27,K=256\\}$. According to the dataflow mapping
described in Section II-B, this layer is mapped as two rows (row size = 5) of
filter representing two input channels in one PE array. There are four such PE
arrays representing different filters. Figure 6 shows the mapping of dataflow
in the first two cycles in the first PE array with ten active PEs (the diagram
does not show unmapped and idle PE(1,11) and PE(1,12)). The mapping of weights
maximizes the input forwarding between two consecutive cycles (there are only
two new input reads and eight forwarding in second cycle). The other three PE
arrays load weights of filter 2-4 in the same relative order and use the same
ifmap values provided to the first PE array through array-wise multicast.

Figure 7: Cycle-wise number of data reads/writes until the targeted event of
Alexnet Conv2 layer in WS(12,4).

Execution of the Conv2 of Alexnet in WS($12,4$) results in $W_{r}=34848$,
$psum_{r}=9292800$, and $psum_{w}=9583200$. The rest of the section goes
through the Algorithm 3 to recover Conv2 parameters of Alexnet. Figure 7 shows
the cycle-by-cycle number of GB reads/writes of different data types. The set
H with potential (R,K) values = {(2,1600), (4,400), (5,256), (8,100), (10,64),
(16,25), (20,16), (40,4), (80,1)}. Then the number of active PE arrays can be
calculated as $n_{a}=40/10=4$. Since the targeted event occurs in the 27th
cycle, $X^{\prime}$ is 27. Then let’s look at each condition and what
potential values are filtered out. The first condition (line 6) applies to the
first five elements of $H$ where $R\leq 10$. From these five values, (4,400)
and (8,100) are filtered out from $H$. For example $(w^{1}/n_{a})\%R$ is
$10\%4=2$ for (4,400).

When considering the next two conditions in lines 9 and 12, Table VI shows
$st$ and $pd$ values generated according to the algorithm. $i[2]=2$ is from
side channels, which is used to calculate $st$ for each value remaining in set
$H$. When we look at the table, only (5,256) satisfy both conditions. It is
important to notice that potential $R\geq 10$ fails the $pd>R$ condition. When
we consider the final condition and the remaining value of set H (5,256):
$X^{\prime}\times Y^{\prime}\times K=186624$, which is equal to
$O_{w}=psum_{w}-psum_{r}$. Therefore, we can successfully recover Alexnets’
Conv2 layer parameters.

TABLE VI: Checking conditions 2 and 3 of Algorithm 3 for Conv2 of Alexnet on
WS($12,4$) dataflow accelerator.

(R,K) | (2,1600) | (5,256) | (10,64) | (16,25) | (20,16) | (40,4) | (80,1)
---|---|---|---|---|---|---|---
max(m//R,1) | 6 | 2 | 1 | 1 | 1 | 1 | 1
st | 4/6 | 1 | 2 | 2 | 2 | 2 | 2
pd | - | 2 | 35/2 | 41/2 | 45/2 | 65/2 | 105/2
x/✓ | x | ✓ | x | x | x | x | x

###  V-D Case Study: Alexnet with Output-Stationary Dataflow

Figure 8: Dataflow mapping at 1st and 2nd cycle of Alexnet Conv1 layer in
OS($10,4$) accelerator (only 1st PE array is shown). Figure 9: Cycle-wise
number of data reads/writes until the targeted event of Alexnet Conv1 layer in
OS(10,4).

Table VII shows the side-channel information used to recover all the five
convolution layers of Alexnet in the OS($10,4$) accelerator. The attack needs
only a small number of cycle-wise data to be collected. For example, the
targeted event cycle in the second Conv layer is 363, while the total is
2927233 cycles. The remainder of the section describes how to recover the
second Conv layer of Alexnet using Algorithm 4.

TABLE VII: Side-channel information for all Conv layers on Alexnet running on
OS($10,4$)

Layer |  | Weight
---
reads
| Output
---
writes
| Event
---
cycle
| Total
---
cycles
Conv1 | 2927232 | 290400 | 363 | 2927233
Conv2 | 12902400 | 186624 | 2400 | 12902401
Conv3 | 7077888 | 64896 | 2304 | 7077889
Conv4 | 10616832 | 64896 | 3456 | 10616833
Conv5 | 7077888 | 43264 | 3456 | 7077889

The first Conv layer of Alexnet has 96 filters ($K=96$) with parameters
$\\{R=11,C=3,st=4,pd=0\\}$. This layer takes an input feature map of size
$\\{X=227,Y=227,C=3\\}$ and outputs a feature map of parameters
$\\{X^{\prime}=55,Y^{\prime}=55,K=96\\}$. Figure 8 shows dataflow mapping in
the first two cycles: the first ten entries of the first row of the ofmap are
accumulated in the first row of the PE array. Similarly, the subsequent three
rows of the ofmap are mapped into the next three PE arrays in order. The
weight reads in consecutive cycles are done to maximize input forwarding. For
example, the reading of the $W[1,1,5]$ in the second cycle after $W[1,1,1]$ in
the first cycle results in only one input read from GB ($I[1,1,41]$) for that
PE array. Only four input reads from GB in the second cycle for all four PE
arrays.

Execution of the Conv1 of Alexnet in OS($10,4$) results in $W_{r}=2927232$ and
$O_{w}=290400$. The rest of the section goes through the Algorithm 4 to
recover Conv1 parameters of Alexnet. Figure 9 shows the cycle-by-cycle number
of GB reads/writes of different data types. The cycle of the targeted event
($t_{e}$) is 364. Therefore, $R^{2}C=363$ (line 1). Solving this in the
$\mathbb{Z}^{+}$ domain gives $R=11$. The virtual address difference between
weight reads in the first (W[1,1,5]) and second (W[1,1,1]) cycle is 4, which
is equal to the stride. When we consider the two conditions in lines 8 and 10,
Table VIII shows $X^{\prime}/Y^{\prime}$ and $K$ values generated according to
the algorithm for each potential $pd$ value (0-10). As shown in the table,
only $pd=0$ passes all the conditions. $pd=0$ also satisfies Equation 4 (
$2927232=(ceil(55/10)\times ceil(55/4))11^{2}\times 3\times 96$ )). Therefore,
we can successfully recover Alexnets’ Conv1 layer parameters.

TABLE VIII: Checking conditions 1 and 2 of Algorithm 4 for Conv1 of Alexnet on
OS($10,4$) dataflow accelerator.

pd | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10
---|---|---|---|---|---|---|---|---|---|---|---
X’/Y’ | 55 | 55.5 | 56 | 56.5 | 57 | 57.5 | 58 | 58.5 | 59 | 59.5 | 60
K | 96 | - | 92.6 | - | 89.3 | - | 86.3 | - | 83.4 | - | 80.6
x/✓ | ✓ | x | x | x | x | x | x | x | x | x | x

###  V-E Applicability and Limitations

Our proposed attack works on any concrete configuration of abstract WS and OS
dataflow architectures outlined in Section II. For this study, we assumed
there is no bandwidth limitation on interconnect for each datatype. After
relaxing this assumption, a minor modification in Algorithm 3 in WS dataflow
or 4 in OS dataflow can generate the same results. For example, if weight NoC
has a bandwidth limitation of 10 on the processing of the Conv layer in
WS($12,4$), as elaborated in Figure 7, four cycles would be spent on the
initial weight memory read. We can identify the initial four memory reads by
either lagging of psum writes by three cycles or idling input interconnect for
three cycles. Another assumption we made was the accumulation of
multiplication on one PE array in WS dataflow happens in one cycle. If we
relax this assumption and set q cycles for accumulating a psum write in a PE
array, every psum write will lag by extra $q-1$ cycles. A minor modification
of calculating the event cycle as $t_{e}-q$ can fix this. Our approach can be
applied to folding-supported WS architectures since our attack uses side-
channel information independent of folding. Our attack on WS dataflow can be
extended to any WS accelerator with input forwarding as MAERI [17]. Our attack
on OS dataflow can be extended to other OS architectures with input forwarding
[21, 27] to recover CNN models.

In this paper, we develop a methodology for recovering CNN models from weight-
stationary and output-stationary dataflow architectures with input forwarding.
The underlying abstract methodology can be extended to recover CNN models from
other dataflow architectures using different local forwarding data-type (e.g.,
Neuflow [28]) and different dataflow taxonomies (input-stationary and row
stationary [29]) by (1) defining a targeted event/events to collect cycle-wise
number of data reads and writes, (2) collecting total reads and writes
responsible for a layer, and (3) exploiting spatial and temporal data reuse in
(1) and (2) with architectural details. Our approach cannot be directly
applied to recover CNN structures with sparse FC and Conv layers such as
Squeezenet [30]. Our study on recovering CNN architectures highlights that
memory access patterns should not be exposed to adversaries to avoid the
leaking of CNN model architectures through dataflow-based CNN accelerators.

##  VI conclusion

Artificial intelligence at edge devices is becoming increasingly ubiquitous
with the abundance of data. Convolution neural networks (CNN) are executed
using dataflow-based CNN accelerators due to energy efficiency. These
accelerators use dataflows coupled with architectural designs to maximize
different types of data reuse in CNN layers to efficiently perform inference
using CNN models. This paper proposes an end-to-end memory-based side-channel
attack that exploits dataflow patterns with the help of architectural hints to
recover CNN model structures. Extensive evaluation of multiple architectures
on weight stationary and output stationary dataflows demonstrates that our
proposed method can fully recover well-known benchmark CNN models running in
these CNN accelerators. This work also highlights the importance of concealing
memory access patterns in dataflow-based inference accelerators.

## Acknowledgments

This work was partially supported by National Science Foundation (NSF) grant
SaTC-1936040.

## References

  * [1] J. Gu, Z. Wang, J. Kuen, L. Ma, A. Shahroudy, B. Shuai, T. Liu, X. Wang, G. Wang, J. Cai _et al._ , “Recent advances in convolutional neural networks,” _Pattern recognition_ , vol. 77, pp. 354–377, 2018.
  * [2] V. Sze, Y.-H. Chen, T.-J. Yang, and J. S. Emer, “Efficient processing of deep neural networks: A tutorial and survey,” _Proceedings of the IEEE_ , vol. 105, no. 12, pp. 2295–2329, 2017.
  * [3] P. Mishra, S. Bhunia, and M. Tehranipoor, _Hardware IP security and trust_. Springer, 2017.
  * [4] A. Chakraborty, M. Alam, V. Dey, A. Chattopadhyay, and D. Mukhopadhyay, “Adversarial attacks and defences: A survey,” _arXiv preprint arXiv:1810.00069_ , 2018.
  * [5] X. Hu, L. Liang, L. Deng, S. Li, X. Xie, Y. Ji, Y. Ding, C. Liu, T. Sherwood, and Y. Xie, “Neural network model extraction attacks in edge devices by hearing architectural hints,” _arXiv preprint arXiv:1903.03916_ , 2019.
  * [6] N. K. Jha, S. Mittal, B. Kumar, and G. Mattela, “Deeppeep: Exploiting design ramifications to decipher the architecture of compact dnns,” _ACM Journal on Emerging Technologies in Computing Systems (JETC)_ , vol. 17, no. 1, pp. 1–25, 2020.
  * [7] J. Wei, Y. Zhang, Z. Zhou, Z. Li, and M. A. Al Faruque, “Leaky dnn: Stealing deep-learning model secret with gpu context-switching side-channel,” in _2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)_. IEEE, 2020, pp. 125–137.
  * [8] M. Isakov, L. Bu, H. Cheng, and M. A. Kinsy, “Preventing neural network model exfiltration in machine learning hardware accelerators,” in _2018 Asian Hardware Oriented Security and Trust Symposium (AsianHOST)_. IEEE, 2018, pp. 62–67.
  * [9] H. Yu, H. Ma, K. Yang, Y. Zhao, and Y. Jin, “Deepem: Deep neural networks model recovery through em side-channel information leakage,” in _2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)_. IEEE, 2020, pp. 209–218.
  * [10] W. Hua, Z. Zhang, and G. E. Suh, “Reverse engineering convolutional neural networks through side-channel information leaks,” in _2018 55th ACM/ESDA/IEEE Design Automation Conference (DAC)_. IEEE, 2018, pp. 1–6.
  * [11] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” _Communications of the ACM_ , vol. 60, no. 6, pp. 84–90, 2017.
  * [12] Y. Le Cun, L. D. Jackel, B. Boser, J. S. Denker, H. P. Graf, I. Guyon, D. Henderson, R. E. Howard, and W. Hubbard, “Handwritten digit recognition: Applications of neural network chips and automatic learning,” _IEEE Communications Magazine_ , vol. 27, no. 11, pp. 41–46, 1989.
  * [13] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” _arXiv preprint arXiv:1409.1556_ , 2014.
  * [14] J. Cong and B. Xiao, “Minimizing computation in convolutional neural networks,” in _Artificial Neural Networks and Machine Learning–ICANN 2014: 24th International Conference on Artificial Neural Networks, Hamburg, Germany, September 15-19, 2014. Proceedings 24_. Springer, 2014, pp. 281–290.
  * [15] I. Goodfellow, Y. Bengio, and A. Courville, _Deep learning_. MIT press, 2016.
  * [16] R. Machupalli, M. Hossain, and M. Mandal, “Review of asic accelerators for deep neural network,” _Microprocessors and Microsystems_ , vol. 89, p. 104441, 2022.
  * [17] H. Kwon, A. Samajdar, and T. Krishna, “Maeri: Enabling flexible dataflow mapping over dnn accelerators via reconfigurable interconnects,” _ACM SIGPLAN Notices_ , vol. 53, no. 2, pp. 461–475, 2018.
  * [18] Y.-H. Chen, T.-J. Yang, J. Emer, and V. Sze, “Eyeriss v2: A flexible accelerator for emerging deep neural networks on mobile devices,” _IEEE Journal on Emerging and Selected Topics in Circuits and Systems_ , vol. 9, no. 2, pp. 292–308, 2019.
  * [19] V. Gokhale, J. Jin, A. Dundar, B. Martini, and E. Culurciello, “A 240 g-ops/s mobile coprocessor for deep neural networks,” in _Proceedings of the IEEE conference on computer vision and pattern recognition workshops_ , 2014, pp. 682–687.
  * [20] S. Chakradhar, M. Sankaradas, V. Jakkula, and S. Cadambi, “A dynamically configurable coprocessor for convolutional neural networks,” in _Proceedings of the 37th annual international symposium on Computer architecture_ , 2010, pp. 247–257.
  * [21] Z. Du, R. Fasthuber, T. Chen, P. Ienne, L. Li, T. Luo, X. Feng, Y. Chen, and O. Temam, “Shidiannao: Shifting vision processing closer to the sensor,” in _Proceedings of the 42nd Annual International Symposium on Computer Architecture_ , 2015, pp. 92–104.
  * [22] M. Yan, C. Fletcher, and J. Torrellas, “Cache telepathy: Leveraging shared resource attacks to learn dnn architectures,” in _USENIX Security Symposium_ , 2020.
  * [23] Y. Liu and A. Srivastava, “Ganred: Gan-based reverse engineering of dnns via cache side-channel,” in _Proceedings of the 2020 ACM SIGSAC Conference on Cloud Computing Security Workshop_ , 2020, pp. 41–52.
  * [24] Y. Xiang, Z. Chen, Z. Chen, Z. Fang, H. Hao, J. Chen, Y. Liu, Z. Wu, Q. Xuan, and X. Yang, “Open dnn box by power side-channel attack,” _IEEE Transactions on Circuits and Systems II: Express Briefs_ , vol. 67, no. 11, pp. 2717–2721, 2020.
  * [25] L. Batina, S. Bhasin, D. Jap, and S. Picek, “Csi nn: Reverse engineering of neural network architectures through electromagnetic side channel,” 2019.
  * [26] F. Muñoz-Martínez, J. L. Abellán, M. E. Acacio, and T. Krishna, “Stonne: Enabling cycle-level microarchitectural simulation for dnn inference accelerators,” in _2021 IEEE International Symposium on Workload Characterization (IISWC)_. IEEE, 2021, pp. 201–213.
  * [27] B. Moons, R. Uytterhoeven, W. Dehaene, and M. Verhelst, “14.5 envision: A 0.26-to-10tops/w subword-parallel dynamic-voltage-accuracy-frequency-scalable convolutional neural network processor in 28nm fdsoi,” in _2017 IEEE International Solid-State Circuits Conference (ISSCC)_. IEEE, 2017, pp. 246–247.
  * [28] C. Farabet, B. Martini, B. Corda, P. Akselrod, E. Culurciello, and Y. LeCun, “Neuflow: A runtime reconfigurable dataflow processor for vision,” in _CVPR 2011 workshops_. IEEE, 2011, pp. 109–116.
  * [29] Y.-H. Chen, T. Krishna, J. S. Emer, and V. Sze, “Eyeriss: An energy-efficient reconfigurable accelerator for deep convolutional neural networks,” _IEEE journal of solid-state circuits_ , vol. 52, no. 1, pp. 127–138, 2016\.
  * [30] F. N. Iandola, S. Han, M. W. Moskewicz, K. Ashraf, W. J. Dally, and K. Keutzer, “Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size,” _arXiv preprint arXiv:1602.07360_ , 2016.