Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the vulnerabilities of edge AI accelerators used for LLM inference, revealing that model parameters and intermediate states can be extracted through physical side-channel attacks. Utilizing laser voltage imaging, the authors successfully extracted embeddings, attention weights, and quantized MLP activations from an FPGA-based LLM accelerator, demonstrating the feasibility of such attacks in practical scenarios. The research not only showcases full recovery of targeted values but also establishes a methodology for asset recovery even when some data remains unread, highlighting a critical security concern in edge AI implementations.
Extracting LLM assets from edge AI chips is not just possible; it's alarmingly straightforward with laser voltage imaging, exposing a significant security vulnerability in current AI deployments.
The move of LLM inference to edge AI accelerators introduces new physical vulnerabilities. During execution, model parameters and intermediate inference states are repeatedly loaded into and processed on the chip, making them suscep- tible to physical side-channel attacks. In this work, by deploying laser voltage imaging, we show that one can extract LLM assets during inference, namely embeddings, attention, and quantized MLP weights, activations, and other inference states, from localized memories and compute subcircuits. To validate our claims, we perform an attack on an FPGA-based LLM accelerator. Since such accelerators reuse the same buffers and compute subcircuits across addresses, tiles, modules, and layers, reading asset values comes down to probing different memories during inference. We demonstrate full recovery of the targeted values; however, we also establish a methodology to recover asset values even if some weights or bits remain unread. We further derive lower bounds that relate imaging effort to asset dimensions and show that even direct recovery scales linearly with the size of the targeted asset