Embedded devices with neural network accelerators offer great versatility for
their users, reducing the need to use cloud-based services. At the same time,
they introduce new security challenges in the area of hardware attacks, the
most prominent being side-channel analysis (SCA). It was shown that SCA can
recover model parameters with a high accuracy, posing a threat to entities that
wish to keep their models confidential. In this paper, we explore the
susceptibility of quantized models implemented in OpenVINO, an embedded
framework for deploying neural networks on embedded and Edge devices. We show
that it is possible to recover model parameters with high precision, allowing
the recovered model to perform very close to the original one. Our experiments
on GoogleNet v1 show only a 1% difference in the Top 1 and a 0.64% difference
in the Top 5 accuracies.

本文研究了在嵌入式设备和边缘设备上部署神经网络的嵌入式框架 OpenVINO 中实现的量化模型的易受攻击性，通过实验证明可以高精度地恢复模型参数，使恢复的模型与原始模型非常接近。在 GoogleNet v1 上的实验结果显示，在 Top 1 准确度上仅有 1% 差异，在 Top 5 准确度上仅有 0.64% 的差异。

基于 OpenVINO 的神经网络模型的侧信道分析

Side-Channel Analysis of OpenVINO-based Neural Network Models

Due to the ever-growing demands for electronic chips in different sectors the
semiconductor companies have been mandated to offshore their manufacturing
processes. This unwanted matter has made security and trustworthiness of their
fabricated chips concerning and caused creation of hardware attacks. In this
condition, different entities in the semiconductor supply chain can act
maliciously and execute an attack on the design computing layers, from devices
to systems. Our attack is a hardware Trojan that is inserted during mask
generation/fabrication in an untrusted foundry. The Trojan leaves a footprint
in the fabricated through addition, deletion, or change of design cells. In
order to tackle this problem, we propose Explainable Vision System for Hardware
Testing and Assurance (EVHA) in this work that can detect the smallest possible
change to a design in a low-cost, accurate, and fast manner. The inputs to this
system are Scanning Electron Microscopy (SEM) images acquired from the
Integrated Circuits (ICs) under examination. The system output is determination
of IC status in terms of having any defect and/or hardware Trojan through
addition, deletion, or change in the design cells at the cell-level. This
article provides an overview on the design, development, implementation, and
analysis of our defense system.

在半导体制造过程中，硬件特洛伊可能会通过添加、删除或更改设计单元的方式在设计计算层上执行攻击。本研究提出了一种称为 EVHA 的系统，它可以通过显式视觉系统在低成本、高准确度和快速的方式下检测元件级别的芯片缺陷和硬件特洛伊。