The Limits of SEMA on Distinguishing Similar Activation Functions of Embedded Deep Neural Networks

Artificial intelligence (AI) is progressing rapidly, and in this trend, edge AI has been researched intensively. However, much less work performed around the security of AI. Machine learning models are a mass intellectual property, an optimized network very valuable. Trained machine need to be black boxes as well because they may give away information about training data outside world. As selecting appropriate activation functions enable fast accurate deep neural networks active area research, it important conceal used architecture well. There research on use physical attacks such side-channel attack (SCA) areas other than cryptography. The SCA highly effective against artificial due its property device computing close user. We studied previously proposed method retrieve box implemented by using simple electromagnetic analysis (SEMA) improved signal processing procedure for further noisy measurements. SEMA identifies directly observing distinctive (EM) traces that correspond operations function. This requires few executions inputs also little implementation dependency functions. distinguished eight similar with EM measurements examined versatility limits attack. In work, multilayer perceptron, evaluated Arduino Uno.