Convolution Neural Networks (CNNs) are widely used in various domains. Recent
advances in dataflow-based CNN accelerators have enabled CNN inference in
resource-constrained edge devices. These dataflow accelerators utilize inherent
data reuse of convolution layers to process CNN models efficiently. Concealing
the architecture of CNN models is critical for privacy and security. This paper
evaluates memory-based side-channel information to recover CNN architectures
from dataflow-based CNN inference accelerators. The proposed attack exploits
spatial and temporal data reuse of the dataflow mapping on CNN accelerators and
architectural hints to recover the structure of CNN models. Experimental
results demonstrate that our proposed side-channel attack can recover the
structures of popular CNN models, namely Lenet, Alexnet, and VGGnet16.

通过利用卷积神经网络模型结构的空间和时间数据复用，以及架构提示信息，提出一种利用存储器侧通道信息来恢复数据流加速器中卷积神经网络模型结构的攻击方法。实验结果表明，该侧通道攻击可以恢复流行的卷积神经网络模型 Lenet、Alexnet 和 VGGnet16 的结构。