# OMAD: On-device Mental Anomaly Detection for Substance and Non-Substance
Users

Emon Dey
Department of Information Systems
University of Maryland, Baltimore County (UMBC)
Baltimore, USA
Email<EMAIL_ADDRESS>Nirmalya Roy
Department of Information Systems
University of Maryland, Baltimore County (UMBC)
Baltimore, USA
Email<EMAIL_ADDRESS>
###### Abstract

Stay at home order during the COVID-19 helps flatten the curve but ironically,
instigate mental health problems among the people who have Substance Use
Disorders. Measuring the electrical activity signals in brain using off-the-
shelf consumer wearable devices such as smart wristwatch and mapping them in
real time to underlying mood, behavioral and emotional changes play striking
roles in postulating mental health anomalies. In this work, we propose to
implement a wearable, On-device Mental Anomaly Detection (OMAD) system to
detect anomalous behaviors and activities that render to mental health
problems and help clinicians to design effective intervention strategies. We
propose an intrinsic artifact removal model on Electroencephalogram (EEG)
signal to better correlate the fine-grained behavioral changes. We design
model compression technique on the artifact removal and activity recognition
(main) modules. We implement a magnitude-based weight pruning technique both
on convolutional neural network and Multilayer Perceptron to employ the
inference phase on Nvidia Jetson Nano; one of the tightest resource-
constrained devices for wearables. We experimented with three different
combinations of feature extractions and artifact removal approaches. We
evaluate the performance of OMAD in terms of accuracy, F1 score, memory usage
and running time for both unpruned and compressed models using EEG data from
both control and treatment (alcoholic) groups for different object recognition
tasks. Our artifact removal model and main activity detection model achieved
about $\approx$ 93% and 90% accuracy, respectively with significant reduction
in model size (70%) and inference time (31%).

###### Index Terms:

Substance Use Disorder, mental anomaly detection, EEG artifact, weight
pruning, resource constrained devices.

##  I Introduction

Coronavirus disease 2019 (COVID-19) is causing untold challenges to health
care providers and other societal entities. Considering the physical health
related issues, the older adults of 65 years and older, people who live in a
nursing home or long-term care facility, people with chronic lung, heart,
kidney and liver disease are most at risk. Specially when a respiratory
infection is severe, recovery can be prolonged with a general increase in
shortness of breath — even after lung function returns to normal [1].
Moreover, present lockdown ordeal is also contributing to another severe
health problem: mental disorder, mainly among the vulnerable populations who
have a Substance Use Disorders (SUD). Substance Abuse and Mental Health
Services Administration (SAMHSA) recognizes there are currently 57.8 million
Americans living with substance use disorders (National Survey on Drug Use and
Health, 2018) [2].

According to a report published in [3], a significant number of COVID-19
positive patients may have irregularities with their nervous system that
invokes more intensive research to determine the real implications of this
situation. In this respect, evidence of the COVID-19 effects on brain activity
is recorded in the MRI of some patients [4]. Motivated by this, we hypothesize
that a deep neural network-integrated edge device that can make decision on
individuals’ mental health problems, progressively tracking the brain signal
activity can be a useful tool to counter this implication. Deep learning
models can enable the Internet of Things (IoT) devices to interpret
unstructured data and intelligently provide feedback to both user and
environmental events. However, these works rely on deep networks with millions
or even billions of parameters, and the availability of GPUs with very high
computation capability [5]. This costly requirement of power, memory, and
advance computing components may become an impediment to implement deep models
on resource constrained devices [6].

Researchers have been developing various sophisticated techniques of model
compression for deep architectures with negligible compromise of accuracy. For
example, a sparse coding-based system to push neural network into the phone’s
DSP which is an upcoming feature of Google’s TensorFlow in partnership with
Qualcomm [7]. The CAE, a DNN-based spike compression model to significantly
reduce the data rate of spikes in large-scale neural recording experiments
[8]. If we look into the most recent approaches in the genre, it is
conceivable that fundamental theoretical concepts like entropy, game theory,
information theory are being incorporated and implemented. The adopted
compression and acceleration techniques in these models are sparse coding,
orthogonal batch scheduling, segmenting layers into heterogeneous processors
etc. The main aim of these methods is to explore the redundancy in the model
parameters and remove redundant and uncritical ones [9] for efficient
implementation of signal processing approaches and machine learning models on
the embedded and FPGA platforms and devices.

Considering this scope of applying model compression in detecting negative
impact of COVID-19 disease from brain activity, we proposed a wearable on-
device mental anomaly detection (OMAD) model to analyze on the EEG data of
both substance user and non-substance user. Primarily we have analyzed on
liquid substance user (alcohol) on a specific object recognition task. To get
a better set of signals for analysis, we have ensured artifact-free dataset by
extensive preprocessing steps. We removed the extrinsic type of artifacts
using notch filter and designed compressed machine learning models to identify
the physiological artifacts. We hypothesize that, an efficient mental behavior
anomaly detection approach can alleviate the condition of individuals with co-
occurring severe mental illness and substance use disorders, subsequently
reducing the rate of substance misuse. To the best our knowledge, it is the
first endeavor of incorporating model compression technique with mental
anomaly detection application. The major contributions of this work as
follows:

  * •

On-device Mental Anomaly detection (OMAD) model: We propose a wearable device
implementable machine learning model to detect mental behavior anomaly for
substance and non-substance users. We employ a magnitude-based weight pruning
technique to gain a wearable-friendly version of the model. Our compressed
model depicts over 90% accuracy after compression.

  * •

Wearable implementable artifact removal model: We design a light-weight
artifact removal model to get a smoothed version of the main EEG data. We’ve
collected our own artifact data for model training. This model is used to tag
possible artifacts on the main dataset. The same pruning technique is used to
reform the original model to a compressed one. We have achieved an approximate
75% reduced model for artifact removal.

  * •

Empirical evaluation on a resource constrained device: We have used three
different experimental settings to demonstrate analysis results. The metrics
used are accuracy, F1 score, model size requirement, and inference time for
both Multilayer Perceptron (MLP) and CNN based models on Nvidia Jetson Nano,
one of the most resource constrained devices available presently. OMAD
achieves approximately 70% reduction in model size and over 30% improved
inference time with an accuracy loss less than 3%.

##  II Related work

In this section, we discuss the EEG-based mental health detection approaches
and the various model compression-based techniques. We spot the main
differences between our approach and those.

###  II-A EEG based mental health detection

Detecting possible mental disorder among the COVID-19 patients is an ongoing
research topic, and researchers are still exploring to find suitable tools and
approaches for this purpose. The Electroencephalogram (EEG) based detection
system can be efficient because it records the respective brain activity of
any action [10]. There are numerous amount of works on determining different
kinds of mental states using EEG data. Some works related to checking the
activity of the paralyzed patients by acquiring their eye movement signals
[11]. Also, detecting opioid use disorder using the resting eye state in shown
in [12]. Such research works indicates if we can separate the brain signals
for similar activities between the control group and a substance user group,
it can further be stretched identifying anomalous behavioral activity and can
be a useful work for timely intervention. In our work, we have chosen the
people who are liquid substance user.

The recorded EEG signal possesses one major data preprocessing challenge due
to the various artifacts (EEG noises) in the signal. Different research works
worked with different kinds of signal artifact detection and removal. Removing
environmental artifacts is comparatively easy as it can be achieved with
selecting filters of different frequency ranges. However, to remove the
extrinsic artifacts, the preprocessing technique has to be more precise [13].
Highly optimized machine learning models are required for this task to
identify those artifacts in the whole dataset. Works based on eye blinking
detection [14], muscle movement [15], etc. show different models for efficient
detection and removal of those noises to make the main data smoother. In our
work, we have collected our own data for eye blinking and eyebrow-raising
detection as artifacts.

In our proposed approach, we have combined both the models of artifact
detection and mental anomaly detection based on EEG data in our work and also
demonstrated results using statistical classifiers, Multilayer Perceptron
(MLP) and Convolutional Neural Networks (CNN).

###  II-B Compression techniques

Developing a deep model based detection is not enough as we have to make the
model readily implementable to wearable devices so that real time intervention
can be possible. In order to do that we have to try to compress the deep model
without compromising much with the accuracy. In recent years researchers have
suggested various deep model compression techniques to make this field more
enriched. In [16, 17], network pruning and sharing based method is introduced.
The main concept behind that is to identify the most contributing nodes. If a
node can have an activation function value over a certain threshold, the node
will be counted as a valuable node. These selected nodes will be responsible
for the output of the future outcome of the model. Another popular approach
for compression is quantization and binarization. The core idea is that, in
normal computing system, each integer or floating point is represented as
32-bit or 64-bit number. If we can reduce the number of bits required for the
representation of the numbers, then eventually, the model size and computing
time can be minimized. The authors of [18, 19] have represented such
quantization-based methods and the main difference between their work, is
choice of quantization bit size. They have also implemented their work on some
hardwares like Nvidia Titan X [20], Snapdragon 400 [21], 800 [9] based mobile
phones etc.

Moreover, concepts like knowledge distillation [22], low rank matrix
factorization [23], etc. are getting so much traction in recent years. Having
the control of changing both the sparsity and scheduling of a deep model
persuades us to utilize magnitude-based weight pruning method in our work to
squeeze a multilayer perceptron model and an one-dimensional convolutional
network with a view to recognizing mental anomaly. The whole squeezed model is
implemented on one of the most resource constrained devices named Nvidia
Jetson Nano.

##  III Dataset Description

Our dataset description part is mainly divided into two parts. In the first
part we describe the process of data collection for artifact removal and in
the next part about the main dataset.

###  III-A Data collection for EEG artifact removal

EEG plays an important role in identifying brain activity, and behavior.
However, the recorded electrical activity always be contaminated with
artifacts and then affect the analysis of EEG signal. Artifacts are unwanted
signals which are mainly originated from environment noise, experimental error
and physiological artifacts. Signal artifacts are more significant while
collecting data in EEG form. Furthermore, the environmental noise and
experiment error, which come from external factors, are classified as
extrinsic artifacts, whereas the physiological signals from body itself (e.g.,
eye blink, muscle activity, heartbeat) can be categorized as intrinsic
artifacts. The extrinsic artifacts can be eliminated by a simple filter due to
the frequency of such artifacts are inconsistent with desired signals.
Nevertheless, the physiological artifacts are more difficult to be removed as
they require particular algorithms.
In our data collection, we have considered ‘eye blinking’ and ‘eyebrow
raising’ as the EEG artifacts and collected data with Emotiv Epoch EEG headset
with 14 channels. The 14 electrodes first have to be soaked with saline water
for better connection. When we interface the device with the data collection
software, we can see the type of connection between the skull and electrodes.
Green signals stands for best connection. We have collected 2 trials each from
3 subjects for two kinds of artifacts. Each trial consists of 10 seconds of
data, where first 3 and last 3 seconds are resting state and 4 to 7 seconds
contain eye blinking and eyebrow raising respectively. The sampling rate
chosen is 128 Hz. We have also applied a window size of 128 with 80 percent
overlap on the collected dataset.

###  III-B EEG data for substance and non-substance user

We have used the EEG dataset of UCI machine learning repository for two
different groups of control and alcoholic. This data was collected with 64
electrodes sampled at 256 Hz. There were 20 subjects (10 control and 10
alcoholic)in total, and each subject completed 10 trials. Each subject was
exposed to either a single stimulus (S1) or to two stimuli (S1 and S2) which
were pictures of objects chosen from the 1980 Snodgrass and Vanderwart picture
set [24]. A sample dataset is shown in table I.

TABLE I: Example of main EEG data | # co2a0000364.rd
---
# 120 trials, 64 chans, 416 samples
# 3.906000 msecs $\mu$V
# S1 obj, trial 0
# FP1 chan 0
0 | FP1 | 0 | -8.921
0 | FP1 | 1 | -8.433
0 | FP1 | 2 | -2.574
0 | FP1 | 3 | 5.239

The first four lines are header information. Line 1 contains the subject
identifier and indicates if the subject was an alcoholic (a) or control (c)
subject by the fourth letter. Line 4 identifies the matching conditions: a
single object shown (S1 obj), object 2 shown in a matching condition (S2
match), and object 2 shown in a non matching condition (S2 nomatch). Line 5
identifies the start of the data from sensor FP1. The four columns of data
are: the trial number, sensor position, sample number (0-255), and sensor
value (in micro volts).

##  IV OMAD System Architecture

The whole OMAD system is divided into two parts mainly. First we have
collected our own data to develop our artifact removal model. Then the main
data are used as the input to the model and further analysis is done based on
the output of the removal model. The main EEG data will first go through some
feature selection process before going to the artifact removal model. For
feature selection we have exploited two common processes named correlation
measurement and t-test. The graphical representation is given in fig 1. All of
the blocks in the diagram will be described in details in the subsequent
sections.

Figure 1: Workflow of the OMAD system.

The compression method used here is known as magnitude based weight pruning.
The big picture of this process is that, a neural network will be developed
first. Then, compression technique will be applied to the original model and
the testing and inference processes are carried out again. The evaluation
metrics value for these two different models are compared and if the
difference is at satisfactory level, the hyperparameters for this set are
selected as the resultant one. This process is visualized in fig 2.

Figure 2: Basic functioning procedure of a model compression algorithm.

##  V Methodology

In the following sections we articulate the approach adopted for artifact
removal and, model parameter selection. We also include detailed explanation
of our compression technique and information of our selected model parameters.

###  V-A Artifact removal procedure

To analyze the data collected for artifact removal described earlier, we have
developed a MLP based model. The only task of the model is to be able to
determine which of the data have come from noisy activity. After going through
the hyperparameter tuning process, the final model is a 3 layer MLP. Train
test ratio is 70:30. The highest test accuracy gained for the primary unpruned
model is 95.13%. Then it is subjected to magnitude based weight pruning
procedure and the accuracy after pruning is 92.78% but the model size is
reduced over 75%. The detailed results of the compressed artifact removal
model is tabulated in table II. The compression process will be elaborated in
later section. The main EEG dataset is then fed to this model and the output
of this model will be a binary classification; whether the signal is artifact
or not. The signals to which the artifact removal model assigns a tag as
artifacts, we’ll remove those from the main model. The rest of the signals
will then be used for further analysis of classifying the group type.

TABLE II: Analysis results of the artifact removal model Metrics/Model | Unpruned | Pruned
---|---|---
Model size (MB) | 1.75 | 0.54
Accuracy (%) | 95.13 | 92.78
Inference time (ms) (per mini batch) | 42 | 29

###  V-B Model parameters

We have carried out analysis using statistical classifiers, MLP and CNN based
models. In case of statistical classifier we have to extract the features
first, then we give them as input to the classifier. But in MLP and CNN, which
are end-to-end learning algorithms, we can directly feed the data into them.
It can do the features extraction in it’s layers. Our train-test split as
70:30. After extensive hyperparameter tuning, the parameters for the highest
test accuracy are listed in table III. Hyperparameters for MLP and CNN are
given in table IV.

TABLE III: MLP model hyperparameters Hyperparameters | Value
---|---
Epoch | 150
Optimizer | Adam
Learning rate | 0.001
Batch size | 64
Dropout | 0.4
TABLE IV: CNN model hyperparameters Hyperparameters | Value
---|---
Number of convolutional layers | 2
Number of fully connected layers | 2
Loss function | Binary cross entropy
Activation function | Softmax
Batch size | 64
Epoch | 150
Optimizer | Adam
Learning rate | 0.001
Kernel size | 3x1

In addition, the parameters for the statistical classifiers are:
Random forest : (n_estimators = 50, max_depth = 5).
SVM : (C = 1, kernel = rbf).

###  V-C Magnitude based weight pruning

This compression algorithm creates a list of all weights of each layer by
descending order and importance of the weights are determined by their
magnitude. In this function we can tweak some hyperparameters, they are:

  * •

Sparsity

  * •

Scheduling

The Sparsity term can be correlated as a threshold value. By using this
sparsity value, we can define how much nodes we want to prune or in other
words, how dense we want our model will be. In our case 50% sparsity is used.

The term scheduling is used to determine the starting step, the pruning
frequency and the end step. By using this, we can allow the model to reach a
certain accuracy level, then the pruning procedure will start and will start
to continue as the frequency defined in the function. The end step indicates
the point of final pruning action. The main difference between the ‘Dropout’
strategy and this pruning is that, in dropout we can’t control the node
elimination process. It just prunes the models in random manner. On the
contrary, in magnitude-based weight pruning action, all the pruning action can
be designed by the user. As a result, a more specific result with more
controlled system can be obtained.

###  V-D Implementation details

The coding part of this work is carried out using Tensorflow (version 1.14) as
deep learning library and Scikit-learn for implementation of statistical
classifiers. For the hardware implementation task, as a resource constrained
device, Nvidia Jetson Nano is used. It is one of the lowest configured based
on CPU, Memory and perfectly suitable for this kind of IoT based development.
In fig 3 a snapshot of the hardware setup is provided.

Figure 3: Experimental setup with Nvidia Jetson Nano.

The device specifications are provided in table V.

TABLE V: Nvidia Jetson Nano specifications GPU | 128-core Maxwell
---|---
CPU | Quad-core ARM<EMAIL_ADDRESS>GHz
Memory | 4 GB 64-bit LPDDR4 25.6 GB/s

##  VI Evaluation

We have divided our evaluation section into two major parts. In first part, we
show the comparison of statistical models with uncompressed MLP model on the
basis of accuracy and F1 score to understand the baseline performance with
this dataset. Then the performance of compressed MLP and CNN models with
respect to memory requirement and inference time will be compared in the
second part.

###  VI-A Comparison of statistical models with MLP

The results for two statistical classifiers (Random Forest (RF) and SVM) and a
7 layer MLP model are shown in three different setups. First, we have used all
the features and no artifact removal approach is applied. We can see the
results in table VI.

TABLE VI: Experimental results comparison among three different models with three separate settings Experimental settings/ Metrics |  | Using all features without
---
artifact removal
| Using all features with
---
artifact removal
| Using selected features with
---
artifact removal
RF | SVM | MLP (7 layers) | RF | SVM | MLP (7 layers) | RF | SVM | MLP (7 layers)
Accuracy (%) | 78.92 | 68.53 | 82.42 | 78.87 | 71.20 | 84.88 | 84.71 | 75.32 | 79.04
F1 score | 0.7977 | 0.6318 | 0.8015 | 0.7732 | 0.7001 | 0.8229 | 0.8114 | 0.7091 | 0.7768

If we closely analyze the result values for this setup, it is clear that MLP
with 7 layers has the leverage. The model tends to do better with increasing
number of layers but the relation is not linear. After going through
experiments, this number of layers proved to be more stable. Random forest may
not have the highest accuracy but is also doing good.

Secondly, we have applied the artifact removal model output with all the
features. The results are also given in table VI. Here, we can see the similar
result as the previous one and the accuracy and F1 score have increased as a
matter of fact. So, the effect of artifact removal is evident here.

In our third setting, we have fed the selected features after correlation
check and t-test. The output are placed in table VI. Surprising results can be
noticed in the third setting. Random forest classifier surpasses the 7 layer
MLP in this case. The reason behind this can be, as we have applied feature
selection and artifact removal together, the statistical classifier gets a
better scenario to make prediction and due to lack of some features MLP shows
some less accuracy. It is acceptable because being a self feature extracting
architecture, deep learning models is expected to do better with more number
of features whereas statistical learning based classifiers has the upper hand
with previously extracted and fewer number of features. Overall, the highest
accuracy is achieved by all the features with artifacts removed. So, we can
conclude saying that artifact removal is an important aspect and in case of
deep learning the feature selection is less effective in our case.

###  VI-B Evaluation of the compressed models

The analysis results of both MLP (7 layer) and CNN are carried out on their
pruned and unpruned forms. The values of model size and inference time are
listed for every model. The comparison of those models based on accuracy and
F1 score can be found in fig 4. It can be noticed that the accuracy drop is
less than 3% in all of the compressed models. In fig 5, we can also see a
clear difference on the model size between the pruned and unpruned model. To
be specific, in case on MLP there is a 35% reduction in the model size which
is 70% in case of CNN. Significant improvement can also be seen in inference
time also. A 23% faster inference can be noticed in MLP and the value is 31%
in case of CNN.

(a)  (b)

Figure 4: (a) Accuracy and (b) F1 score comparison between pruned and unpruned
models of MLP and CNN (with artifact removal).

(a)  (b)

Figure 5: (a) Model size (MB) and (b) inference time (ms) comparison between
pruned and unpruned models of MLP and CNN.

An empirical analysis on the dependency of model size and latency on the
percentage of the sparsity is depicted in fig 6. Analyzing the trend and after
going through some trade off between accuracy and latency, we have finalized
50% sparsity in the best setting for our experiment.

Figure 6: Model size and latency trend with respect to sparsity percentage.

##  VII Conclusion and Future Work

In this work, we have demonstrated a EEG data based on-device mental behaviour
anomaly detection (OMAD) model for substance and non-substance user groups. We
have also deployed a light-weight MLP based artifact removal model trained on
our own collected data. The main EEG data are fed to this model and the
suspected artifact data points are removed. The higher testing accuracy
(92.78%) of the model ensures a better segregation between artifact and
important brain signals. From evaluation results, it is evident that artifact
removal can help with more accurate results. From the analytic results of the
compressed models, we can claim to achieve over 70% reduction of model size
with less than 3% loss in accuracy for CNN. Also, we have managed to gain 31%
faster inference time for the same compressed CNN model. In future, we want to
implement this model on EEG data of gaseous substance user and apply more
sophisticated model compression techniques for analysis. Recent trends of
segmenting deep model like distributed training, federated learning can also
come up with interesting results. Also, we want to explore a signal processing
driven approach to represent the analysis results based on alpha, beta, gamma
and theta frequency components.

## Acknowledgment

This research is partially supported by the NSF CAREER Award # 1750936, ONR
under grant N00014-18-1-2462, and Alzheimer’s Association, Grant/Award #
AARG-17-533039.

## References

  * [1] Effects of covid-19 long term.  https://www.healthline.com/health-news/what-we-know-about-the-long-term-effects-of-covid-19#Who-is-most-at-risk? Accessed: 2020-05-18.
  * [2] Drug abuse control.  https://www.samhsa.gov/grants/grant-announcements/fg-20-006.  Accessed: 2020-05-18.
  * [3] Effects on brain aarp.  https://www.aarp.org/health/conditions-treatments/info-2020/covid-19-brain-symptoms.html.  Accessed: 2020-05-18.
  * [4] Effects on brain.  https://www.wired.com/story/what-does-covid-19-do-to-your-brain/.  Accessed: 2020-05-18.
  * [5] Kaiming Nan, Sicong Liu, Junzhao Du, and Hui Liu.  Deep model compression for mobile platforms: A survey.  Tsinghua Science and Technology, 24(6):677–693, 2019.
  * [6] Jie Tang, Dawei Sun, Shaoshan Liu, and Jean-Luc Gaudiot.  Enabling deep learning on iot devices.  Computer, 50(10):92–96, 2017.
  * [7] Nicholas D Lane, Sourav Bhattacharya, Akhil Mathur, Petko Georgiev, Claudio Forlivesi, and Fahim Kawsar.  Squeezing deep learning into mobile and embedded devices.  IEEE Pervasive Computing, 16(3):82–88, 2017.
  * [8] Tong Wu, Wenfeng Zhao, Edward Keefer, and Zhi Yang.  A lightweight deep compressive model for large-scale spike compression.  In 2018 IEEE Biomedical Circuits and Systems Conference (BioCAS), pages 1–4. IEEE, 2018.
  * [9] Nicholas D Lane, Sourav Bhattacharya, Petko Georgiev, Claudio Forlivesi, and Fahim Kawsar.  An early resource characterization of deep learning on wearables, smartphones and internet-of-things devices.  In Proceedings of the 2015 international workshop on internet of things towards applications, pages 7–12, 2015.
  * [10] Michael X Cohen.  Where does eeg come from and what does it mean?  Trends in neurosciences, 40(4):208–218, 2017.
  * [11] Xiao Jiang, Gui-Bin Bian, and Zean Tian.  Removal of artifacts from eeg signals: a review.  Sensors, 19(5):987, 2019.
  * [12] Grace Y Wang, Rob Kydd, Trecia A Wouldes, Maree Jensen, and Bruce R Russell.  Changes in resting eeg following methadone treatment in opiate addicts.  Clinical Neurophysiology, 126(5):943–950, 2015.
  * [13] Joel L Whitton, Frank Lue, and Harvey Moldofsky.  A spectral method for removing eye movement artifacts from the eeg.  Electroencephalography and clinical neurophysiology, 44(6):735–741, 1978.
  * [14] Peter Anderer, Stephen Roberts, Alois Schlögl, Georg Gruber, Gerhard Klösch, Werner Herrmann, Peter Rappelsberger, Oliver Filz, Manel J Barbanoj, Georg Dorffner, et al.  Artifact processing in computerized analysis of sleep eeg–a review.  Neuropsychobiology, 40(3):150–157, 1999.
  * [15] Oliver Rösler and David Suendermann.  A first step towards eye state prediction using eeg.  Proc. of the AIHLS, 2013.
  * [16] Song Han, Jeff Pool, John Tran, and William Dally.  Learning both weights and connections for efficient neural network.  In Advances in neural information processing systems, pages 1135–1143, 2015.
  * [17] Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf.  Pruning filters for efficient convnets.  arXiv preprint arXiv:1608.08710, 2016.
  * [18] Jiaxiang Wu, Cong Leng, Yuhang Wang, Qinghao Hu, and Jian Cheng.  Quantized convolutional neural networks for mobile devices.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4820–4828, 2016.
  * [19] Yunchao Gong, Liu Liu, Ming Yang, and Lubomir Bourdev.  Compressing deep convolutional networks using vector quantization.  arXiv preprint arXiv:1412.6115, 2014.
  * [20] Yong-Deok Kim, Eunhyeok Park, Sungjoo Yoo, Taelim Choi, Lu Yang, and Dongjun Shin.  Compression of deep convolutional neural networks for fast and low power mobile applications.  arXiv preprint arXiv:1511.06530, 2015.
  * [21] Akhil Mathur, Tianlin Zhang, Sourav Bhattacharya, Petar Velickovic, Leonid Joffe, Nicholas D Lane, Fahim Kawsar, and Pietro Lió.  Using deep data augmentation training to address software and hardware heterogeneities in wearable and smartphone sensing devices.  In 2018 17th ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN), pages 200–211. IEEE, 2018.
  * [22] Geoffrey Hinton, Oriol Vinyals, and Jeff Dean.  Distilling the knowledge in a neural network.  arXiv preprint arXiv:1503.02531, 2015.
  * [23] Xiangyu Zhang, Jianhua Zou, Xiang Ming, Kaiming He, and Jian Sun.  Efficient and accurate approximations of nonlinear convolutional networks.  In Proceedings of the IEEE Conference on Computer Vision and pattern Recognition, pages 1984–1992, 2015.
  * [24] Joan G Snodgrass and Mary Vanderwart.  A standardized set of 260 pictures: norms for name agreement, image agreement, familiarity, and visual complexity.  Journal of experimental psychology: Human learning and memory, 6(2):174, 1980.


11institutetext: National Integrated Centre for Evaluation (NiCE)
Nanyang Technological University, Singapore
11email<EMAIL_ADDRESS>22institutetext: TTControl GmbH, Vienna,
Austria
22email<EMAIL_ADDRESS>Slovak University of Technology,
Bratislava, Slovakia
33email<EMAIL_ADDRESS>
33email<EMAIL_ADDRESS>
# Side-Channel Analysis of OpenVINO-based Neural Network Models

Dirmanto Jap 11 0000-0002-3149-9401 Jakub Breier 22 0000-0002-7844-5267 Zdenko
Lehocký 33 Shivam Bhasin 11 0000-0002-6903-5127 Xiaolu Hou 33
0000-0002-4512-6921

###### Abstract

Embedded devices with neural network accelerators offer great versatility for
their users, reducing the need to use cloud-based services. At the same time,
they introduce new security challenges in the area of hardware attacks, the
most prominent being side-channel analysis (SCA). It was shown that SCA can
recover model parameters with a high accuracy, posing a threat to entities
that wish to keep their models confidential.

In this paper, we explore the susceptibility of quantized models implemented
in OpenVINO, an embedded framework for deploying neural networks on embedded
and Edge devices. We show that it is possible to recover model parameters with
high precision, allowing the recovered model to perform very close to the
original one. Our experiments on GoogleNet v1 show only a 1% difference in the
Top 1 and a 0.64% difference in the Top 5 accuracies.

###### Keywords:

Neural networks Side-channel analysis attacks OpenVINO.

##  1 Introduction

The rapid advancement in artificial intelligence (AI) and machine learning
(ML) technologies has spread into various critical domains for our everyday
lives, such as healthcare, finance, automotive, and more. Among the myriad AI
frameworks available, OpenVINO [15] (Open Visual Inference and Neural Network
Optimization) stands out as a powerful open-source toolkit. OpenVINO enables
developers to optimize and deploy deep learning models on heterogeneous
computing platforms, especially targeting edge and embedded devices.

Embedded devices, equipped with neural network accelerators offer great
benefits in terms of efficiency and performance. However, they also introduce
new security challenges, particularly related to hardware attack vectors such
as side-channel analysis (SCA) attacks [2]. SCA attacks exploit information
leakage from the physical implementation of a system rather than
vulnerabilities in the algorithm itself [18]. These attacks can reveal
sensitive data, such as neural network parameters and architecture, through
indirect means such as power consumption, electromagnetic emissions, or
execution time analysis [3]. This complements model stealing/extraction
attacks that have been a well-research topic within the past decade [21]. The
assumption for these attacks is that the creator of the model invested
significant resources into preparing the training data (obtaining the initial
data, labeling, and pre-processing it), and also into training the model.
Thus, to have a competitive advantage, they prefer to keep the details of the
model confidential. Apart from that, protecting the model parameters
effectively prevents white-box adversarial attacks.

There are two main directions the attacker can take when extracting the model
[21]:

  1. 1.

obtaining the exact model parameters,

  2. 2.

approximating the model behavior.

When it comes to the first direction, recovering the exact model parameters
has been shown possible by fault injection attacks, but only for one layer of
a network obtained by transfer learning [5]. The goal of model extraction by
the means of SCA attacks ultimately leads to the same [3], however, as the
bit-width of the variables used for storing model parameters is generally up
to $64$ bits, the noise makes it very hard to determine the exact values from
the SCA leakage. The majority of the literature in this direction thus focuses
on approximating the model behavior, generally aimed at creating a substitute
model exhibiting similar behavior to the original one.

Our contribution. In this paper, we focus on investigating SCA attacks on
neural networks implemented on embedded devices using OpenVINO. These models
are implemented in a quantized manner, thus the model parameters are normally
stored in $8-$bit variables, making them more efficient in terms of storage
and computational complexity, which is crucial for embedded implementations.
For our experiments, we utilized an OpenVINO implementation of GoogleNet v1
with $\approx 6.7977$ M parameters. The SCA attack allowed us to reconstruct
the model that exhibits very similar accuracies to the original one. More
specifically, the difference in Top $1$ accuracy is $1\%$ and in Top $5$
accuracy it is just $0.64\%$.

Organization. The rest of the paper is organized as follows. Section 2
provides the background on the basic concepts utilized in this paper such as
neural networks and SCA attacks, and gives an overview of the related work.
Section 3 presents the methodology for extracting the model parameters using
side channels. Section 4 details our evaluation and highlights the results.
And finally, Section 5 concludes this work and provides potential future
directions.

Disclosure. OpenAI’s ChatGPT-4 was used to improve the clarity and readability
of this manuscript. After using this tool, the authors reviewed and edited the
content as needed and take full responsibility for the manuscript’s content.

##  2 Background and Related Work

###  2.1 Neural Networks

Neural networks (NNs) are a fundamental concept in the field of artificial
intelligence and machine learning, inspired by the structure and function of
the human brain [16]. NNs can recognize patterns, learn from data, and make
decisions with minimal human intervention. They have become important in a
wide range of applications, including image and speech recognition, natural
language processing, and autonomous systems. They are supervised ML algorithms
– labeled dataset is used to train their model parameters with an optimization
algorithm called (stochastic) gradient descent [11].

Their structure includes an input layer that receives the initial data for
processing, one or more hidden layers (if there are more, we talk about deep
neural networks (DNNs)), where the data is transformed through various weights
and biases, and an output layer, which produces the result such as
classification or prediction.

The original design of an NN, a multilayer perceptron, has been adjusted to
fit specific problems.On the other hand, convolutional neural networks (CNNs)
can adaptively learn spatial hierarchies of features, making them effective
for image recognition tasks [17]. Another type, recurrent neural networks
(RNNs) are capable of capturing temporal dependencies by using cycles within
the network, allowing them to analyze sequential data such as time series or
natural language.

###  2.2 Quantized Neural Networks

Conventional NNs rely on high-precision floating-point arithmetic, utilizing
either $32-$bit or $64-$bit variables. While such precision helps to achieve
state-of-the-art performance, it requires substantial resources and memory
bandwidth. Such a requirement limits their deployment in resource-constrained
devices like mobile phones, embedded systems, and edge devices.

Quantized neural networks (QNNs) address this limitation by using lower
precision for the weights and activations in the network [13]. QNNs utilize
low bit-width numbers such as $8-$bit or $4-$bit integers, or even binary
values. The quantization significantly reduces memory requirements for storing
the model and also the amount of computation required, resulting in faster
computation and smaller power consumption.

The quantization can either be uniform, where all values are evenly
distributed across the available range, or non-uniform which allows for a more
tailored approach based on the data distribution. Despite the reduced number
precision, QNNs often achieve accuracies comparable to their high-precision
counterparts, especially when quantization-aware training and tuning are used.

###  2.3 OpenVINO Framework

OpenVINO [15] is an open-source software toolkit for optimizing and deploying
DNN models, mostly on Intel devices but currently also on ARM processors. It
supports a wide range of different platforms from edge to cloud, working with
models in TensorFlow, PyTorch, ONNX, TensorFlow Lite, and PaddlePaddle model
formats.

In this paper, we also utilize the Neural Network Compression Framework (NNCF)
[15]. NNCF provides a suite of post-training and training-time algorithms for
optimizing the inference of neural networks in OpenVINO.

###  2.4 Side-Channel Analysis Attacks

SCA is a method originally proposed for recovering secret information from
cryptographic implementations [14]. Classical cryptanalysis methods focus on
analyzing the weaknesses in the algorithms, utilizing techniques such as
differential and linear cryptanalysis. As these are well-studied and
understood, the new algorithms are always evaluated against them, rendering
cryptanalytic attacks ineffective for a full-round cipher. However, as of now,
there is no cryptographic algorithm inherently resistant to SCAs that analyze
the information leakage during the physical operation of the cryptographic
device. Such leakage can come in various forms such as power consumption,
electromagnetic emanation, timing of the execution, and even acoustic leakage.

SCAs can recover the secret key very efficiently, sometimes requiring only a
single measurement [1]. There are generally two types of attacks: simple and
differential. The simple attacks only utilize one or a few leakage traces for
the attack. They can be either used as a starting point for the differential
attacks, to determine the cipher rounds and round operations in block ciphers,
or for a full attack, which is normally the case for public key algorithms
[18]. Differential attacks, on the other hand, utilize higher numbers of
measurements and utilize statistical methods to correlate the processed data
and the leakage.

Leakage models are used to describe and quantify the information leaked from
the implementation under test through side channels during its execution.
These models help in understanding, analyzing, simulating, and mitigating
side-channel attacks. The main models used in SCA are as follows:

  * •

Hamming weight model: assumes that the information leaked is proportional to
the number of bits set to 1 in the data being processed. It is commonly used
when the underlying implementation is of software character.

  * •

Hamming distance model: assumes that the information leaked is proportional to
the number of bit transitions (changes 1$\to$0 or 0$\to$1) between two
consecutive states of the data.

  * •

Stochastic model: goes further than the previous two and assumes that every
bit of the analyzed variable leaks differently.

We give a more thorough explanation of leakage models in Section 3.2.

###  2.5 Related Work – SCAs on Neural Networks

In the first part of this section, we will focus on various attacks on NNs, in
the second part we will outline some of the possible defenses.

####  2.5.1 Attacks.

The first comprehensive work in this area by Batina et al. [3] explored how
neural networks can be reverse-engineered using electromagnetic (EM) analysis.
The paper demonstrated that a passive, non-invasive attacker can extract model
details such as activation functions, number of layers, neurons, output
classes, and weights from neural networks by analyzing EM signals. The
experiments were conducted on an ARM Cortex-M3 microcontroller, showing the
feasibility of such attacks on widely used hardware platforms.

Wang et al. [24] investigated the vulnerability of in-memory computing (IMC)
systems to side-channel attacks. By simulating power traces of IMC macros, the
researchers demonstrated that attackers can reverse-engineer neural network
models, extracting details like layer types and convolution kernel sizes
without prior knowledge.

Gao et al. [10] presented a novel attack method called DeepTheft, which
targets DNN models deployed in Machine Learning as a Service (MLaaS)
environments. By exploiting the Running Average Power Limit (RAPL)-based power
side channel, the work demonstrated that it is possible to accurately recover
complex DNN model architectures, including detailed layer-wise
hyperparameters, even with low sampling rates.

Ryu et al. [22] introduced a novel attack method called Gamma-Knife. This
attack leverages software-based power side channels to extract the
architecture of neural networks without requiring physical access or high-
precision measuring equipment. By utilizing statistical metrics, the Gamma-
Knife attack can accurately determine key architectural details such as filter
size, depth of convolutional layers, and activation functions. The researchers
demonstrated the effectiveness of this attack on popular neural networks like
VGGNet, ResNet, GoogleNet, and MobileNet, achieving an accuracy of
approximately $90\%$.

Nagarajan et al. [20] investigated the vulnerabilities of spiking neural
networks (SNNs) to power SCAs. The authors demonstrated that different
synaptic weights and neuron parameters in SNNs produce distinct power and
spike timing signatures, making them susceptible to SCAs. Through eight unique
attacks, they showed that an adversary can reverse-engineer the specifications
of an SNN.

####  2.5.2 Countermeasures.

Dubey et al. [9] proposed a novel hardware design that incorporates masking
techniques. This design includes masked adder trees for fully connected layers
and masked Rectifier Linear Units for activation functions. Experiments on a
SAKURA-X FPGA board show that the proposed protection significantly increases
the latency and area cost but effectively mitigates first-order differential
power analysis attacks.

In [8], the authors proposed using modular arithmetic to make neural networks
more compatible with masking techniques. They demonstrated this approach on
binarized neural networks (BNNs) and developed novel masking gadgets using
Domain-Oriented Masking (DOM). Their implementation on an FPGA showed that
this method can achieve similar latency while reducing flip-flop (FF) and
lookup table (LUT) costs by $34.2\%$ and $42.6\%$, respectively, compared to
state-of-the-art protected implementations. They verified the first-order
side-channel security of their design with up to 1 million traces.

Breier et al. [4] proposed a method to protect neural networks from side-
channel attacks by making the timing analysis of activation functions more
difficult. The authors introduced a desynchronization technique that adds
random delays to the computation of activation functions, effectively hiding
the dependency on the input and activation type. They experimentally verified
the effectiveness of this countermeasure on a 32-bit ARM Cortex-M4
microcontroller, showing that it significantly reduces side-channel
information leakage. The overhead of this method varies depending on the
number of neurons, with an example overhead of $2.8\%$ to $11\%$ for a fully
connected layer with $4,096$ neurons in the VGG-19 network

As the topic of SCA on NNs is comprehensive and the number of papers in this
area increases every year, we suggest interested readers to explore one of the
recently published surveys for a full overview of the state-of-the-art [2, 6,
19].

##  3 Methodology

###  3.1 Binary Representation of Numbers in Memory

When a value $\boldsymbol{v}$ is processed by a computational device, it is
represented as a binary string. For integer values, $\boldsymbol{v}$ is
encoded using two’s complement representation. For floating-point values, the
IEEE 754 standard is employed.

For example, the two’s complement representations for integers between $-8$
and $7$ are shown in Table 1.

7 | 0111 | -1 | 1111
---|---|---|---
6 | 0110 | -2 | 1110
5 | 0101 | -3 | 1101
4 | 0100 | -4 | 1100
3 | 0011 | -5 | 1011
2 | 0010 | -6 | 1010
1 | 0001 | -7 | 1001
0 | 0000 | -8 | 1000
Table 1: Two’s complement encoding for integers between $-8$ and $7$.

A $32$-bit (single precision) floating-point representation, following the
IEEE 754 standard, comprises $1$ sign bit, $8$ exponent bits, and $23$
fraction bits (also known as the significand or mantissa). The sign bit
indicates the number’s sign: $0$ for positive and $1$ for negative. The
exponent is encoded using a biased representation with a bias of $127$,
enabling the exponent to represent both positive and negative values. The
actual exponent is calculated by subtracting $127$ from the $8$-bit exponent.
The mantissa encodes the significant digits of the number, incorporating an
implicit leading bit of $1$, which is assumed but not stored. Specifically,
the binary string $b_{31}b_{30}\cdots b_{0}$ represents the integer given by

$(-1)^{b_{31}}\times 2^{b_{30}b_{29}\dot{b}_{23}-127}\times
1.b_{22}b_{21}\dots b_{0},$

where the exponent $b_{30}b_{29}\dots b_{23}$ represents the integer given by

$2^{8\times b_{30}}+2^{7\times b_{29}}+\dots+2^{b_{23}}$

and $1.b_{22}b_{21}\dots b_{0}$ represents the number

$1+\frac{1}{2^{b_{22}}}+\frac{1}{2^{2\times b_{21}}}\dots+\frac{1}{2^{23\times
b_{0}}}.$

For example, the binary string

$01000001001101100000000000000000$

has sign bit $0$, exponent

$10000010=130$

and mantissa

$01101100000000000000000.$

This mantissa represents

$1.011011_{2}=1+\frac{1}{4}+\frac{1}{8}+\frac{1}{32}+\frac{1}{64}=1.421875.$

The number the binary string represents is then given by

$(-1)^{0}\times 2^{130-127}\times 1.421875=11.375.$

###  3.2 Leakage Models

In SCA, the leakage model characterizes the relationship between the
computational leakage and the secret value $\boldsymbol{v}$ processed by the
device. Suppose

$\boldsymbol{v}=v_{n-1}v_{n-2}\dots v_{1}v_{0}\in{\mathbb{F}}_{2}^{n}$

is represented as a binary string of length $n$ in the computer memory. The
Hamming weight of $\boldsymbol{v}$, denoted HW$(\boldsymbol{v})$, is given by
the number of bits that are equal to $1$ in $\boldsymbol{v}$. For example,

$\text{HW}(110)=2,\quad\text{HW}(000)=0,\quad\text{HW}(110101)=4.$

Let $\varepsilon\sim\mathcal{N}(0,\sigma^{2})$ denote the noise in the
leakage, modeled as a normal distribution with mean $0$ and variance
$\sigma^{2}$.

A Hamming weight leakage model [12, Section 4.2] suggests that the leakage
$\mathcal{L}(\boldsymbol{v})$ is given by

$\mathcal{L}(\boldsymbol{v})=\text{HW}(\boldsymbol{v})+\varepsilon.$

A stochastic leakage model [12, Section 4.3] expresses the leakage as

$\mathcal{L}(\boldsymbol{v})=\sum_{s=0}^{n-1}\alpha_{s}v_{s}+\varepsilon,$ (1)

where $\alpha_{s}$ ($s=0,1,\dots,n-1$) are real numbers. These numbers
$\alpha_{s}$ are referred to as the coefficients of the stochastic leakage
model.

###  3.3 Correlation Power Analysis

We employ the correlation power analysis (CPA) methodology originally devised
for cryptographic implementation attacks [18]. CPA focuses on calculating
Pearson’s correlation coefficient between observed leakages and hypothetical
leakages derived from a guessed secret value. The correct secret value is
anticipated to yield the highest correlation coefficient, indicating a closer
match between actual and modeled leakages.

Next, we outline the application of this approach to recover the secret weight
and bias values of QNNs. Let $w$ denote a secret value, and let

$w_{1},w_{2},\dots,w_{N}$

be all the possible values of the secret weight. For $8-$bit QNNs,

$w_{1},w_{2},\dots,w_{N}$

are given by

$-127,-126,\dots,-2,-1,0,1,2\dots,126,127$

and $N=256$. During the inference phase, the weight value $w$ is multiplied
with a neuron input, and the resulting product is utilized for subsequent
computations. To recover the value of $w$, our focus lies on this
multiplication operation. We assume the attacker has knowledge of the neuron
input:

  * •

When $w$ belongs to the first hidden layer, the neuron input can be inferred
from the NN input, which is known to the attacker.

  * •

For inner layers, we anticipate the attacker first recovering parameters from
preceding layers and subsequently computing the input of the inner layer using
the recovered parameters.

Let $x$ represent the neuron input multiplied by $w$, yielding the product
$\boldsymbol{v}$.

In our experiments, we simulate actual leakage using stochastic leakage models
with different coefficients. We assume that the attacker either uses the
Hamming leakage model or possesses profiling capabilities to correctly
identify these coefficients for the stochastic leakage model.

For the attack procedure, we first provide the network with randomly generated
$M$ inputs to obtain random neuron inputs $x$, denoted by

$x_{1},x_{2},\dots,x_{M}.$

Subsequently, the leakage associated with the product $\boldsymbol{v}$ is
simulated according to the predefined leakage model.

Let $l_{i}$ denote the leakage corresponding to the input value $x_{i}$ for
$i=1,2,\dots,M$. In this case, $l_{i}$ simulates the leakage of

$\boldsymbol{v}_{i}:=x_{i}\times w.$

The simulation follows a stochastic leakage model (Equation 1) with pre-
defined coefficients and random noise.

Next, we make hypotheses of the value $\boldsymbol{v}$: For each possible
value, or hypothesis, of $w$, $w_{1},w_{2},\dots,w_{N}$ and each input value
of $x$, $x_{1},x_{2},\dots,x_{M}$, we compute the hypothetical value of the
product:

$\hat{\boldsymbol{v}}_{ij}=w_{i}\times x_{j}.$

We then calculate the hypothetical leakage, $\mathcal{H}_{ij}$, of this
hypothetical product $\hat{\boldsymbol{v}}_{ij}$ using the attacker’s leakage
model. This leakage model can either be the Hamming weight model or a profiled
stochastic leakage model, assumed to match the one used for simulating
leakages.

For example, if the Hamming weight leakage model is employed for the attack,
the hypothetical leakage of $\hat{\boldsymbol{v}}_{ij}$ is given by

$\mathcal{H}_{ij}=\text{HW}(\hat{\boldsymbol{v}}_{ij}).$

With CPA, we compute the Pearson correlation between the simulated leakage and
the hypothetical leakage for each weight hypothesis using the formula:

$r_{i}:=\frac{\sum_{j=1}^{M}(\mathcal{H}_{ij}-\overline{\mathcal{H}_{i}})(l_{j}-\overline{l})}{\sqrt{\sum_{j=1}^{M}(\mathcal{H}_{ij}-\overline{\mathcal{H}_{i}})^{2}}\sqrt{\sum_{j=1}^{M}(l_{j}-\overline{l})^{2}}},\quad
i=1,2,\dots,N.$

Here,

$\overline{\mathcal{H}_{i}}=\frac{1}{M}\sum_{j=1}^{M}\mathcal{H}_{ij}$

is the averaged hypothetical leakage for weight hypothesis $w_{i}$, and

$\overline{l}=\frac{1}{M}\sum_{j=1}^{M}l_{j}$

is the averaged simulated leakage.

In case the hypothesis of the weight value, $w_{i}$, is correct, we expect the
corresponding coefficient $r_{i}$ to have a high absolute value. Our guessed
weight is then given by

$w_{\text{guessed}}=w_{i_{0}},\quad\text{where}\quad
i_{0}=\operatorname*{arg\,max}_{i}|r_{i}|.$

Furthermore, in case multiple weight hypotheses achieve the highest absolute
value of $r_{i}$, we select the one with the smallest absolute difference
between the hypothetical and simulated leakages:

$w_{\text{guessed}}=w_{i_{0}},\quad\text{where}\quad
i_{0}=\operatorname*{arg\,min}_{i:w_{i}\text{ achieves the highest absolute
value of
}r_{i}}\left\lvert\sum_{j=1}^{M}(\mathcal{H}_{ij}-l_{j})\right\rvert.$

The attack to recover bias values is similar. Instead of focusing on the
multiplication operation, we concentrate on the addition operation, which adds
the bias to the product of weights and neuron inputs. We assume the attacker
has already recovered the weight values in the given layer. With knowledge of
the neuron inputs, the attacker can compute the value added to the secret
bias.

##  4 Evaluation

In this section, we will report the results for our experimental evaluation.
We conducted a simulation for weight and bias recovery and presented the
results. We then extended the work and report the findings for full QNN model.

###  4.1 Evaluation Scenarios

We first conducted the experiment on the recovery of weight and bias in the
neural network. For the experimental evaluation, the leakage simulations were
conducted employing stochastic leakage models with varying bit coefficients
$\alpha_{s}$ (see Equation 1).

We considered two distinct leakage settings, each with different bit
coefficients for the stochastic leakage model. Additionally, we examined two
attack settings: the first assumes that the attacker does not have the full
capability to profile the device and thus uses a Hamming weight leakage model,
which may be inaccurate in this context; the second assumes that the attacker
could profile the exact bit coefficients for the stochastic leakage model.

Preliminary tests were conducted on several boards to profile the leakage
behavior. Upon profiling, we observed the common variances of the bit
coefficients for the stochastic leakage model, which will then be used and
adopted in our experiments. The following three scenarios were considered:

  * •

Scenario 1: The bit coefficients for the stochastic leakage model are randomly
generated from a normal distribution with mean $1$ and variance $0.09$. In
this setting, there are deviations between each bit coefficient. However, they
are closer to the Hamming weight leakage model. Here, we consider an attacker
who cannot profile the device and use a Hamming weight leakage model for
recovery of the weights and biases.

  * •

Scenario 2: The bit coefficients for the stochastic leakage model are randomly
generated from a normal distribution with mean $1$ and with a higher variance
value of $1$. Similarly, for the attack, the attacker does not know the exact
bit coefficient values and assumes a Hamming weight leakage model.

  * •

Scenario 3: The bit coefficients for the stochastic leakage model are randomly
generated from a normal distribution with mean $1$, with a similar higher bit
variance of $1$. In this scenario, the attacker is assumed to have accurately
profiled the leakage and identified the correct bit coefficient values and, as
such, can build a more precise leakage model for the key recovery attack.

After setting the leakage model bit coefficients, we generate the simulated
side-channel traces. For our experiment, our main focus will be on
investigating the impact of varying bit coefficients of the leakage model. As
such, we will be fixing the noise level. The noise in the leakage model,
$\varepsilon\sim\mathcal{N}(0,0.5)$, follows a normal distribution with mean
$0$ and variance $0.5$. This ensures a fair comparison of all the attack
scenarios.

Using this setting, we generate a set of simulated traces. We simulate weight
and bias recovery using CPA with $100,000$ traces for one simulated attack,
i.e. $M=100,000$ following the notations from Section 3. For the recovery of
weights, a total of $250$ attacks were conducted, with randomly generated
weight values for each attack. Similarly, $250$ attacks were performed for the
recovery of biases, with randomly generated bias values for each attack.

We record the accuracy as the rate at which the correct weight or bias is
successfully recovered. We denote the average error as the absolute difference
between the actual weight or bias and the recovered value. The results for
each weight and each bias under different scenarios are reported as follows:

  * •

Scenario 1: We achieved accuracy $80.7\%$ with average error $1.86$ for weight
recovery and accuracy $29.6\%$ with error $0.19$ for bias recovery.

  * •

Scenario 2: We achieved accuracy $33.5\%$ with average error $1.04$ for weight
recovery and accuracy $7.6\%$ with error $26014.7$ for bias recovery.

  * •

Scenario 3: We achieved accuracy $46.7\%$ with average error 2 for weight
recovery and accuracy $100\%$ for bias recovery.

As observed from the results, when the variance of the bit coefficient is low,
the Hamming weight leakage model proves sufficient, as indicated by the high
accuracy in weight recovery. For bias recovery, although the accuracy is not
high, the low average error can be attributed to targeting the addition
operation rather than the multiplication operation, as is the case with weight
recovery.

Interestingly, when the attacker can profile the bit coefficients, even with
high variance, the accuracy for weight recovery decreases, but perfect
accuracy is achieved for bias recovery. Nonetheless, for high variance in the
bit coefficient, the use of the Hamming weight leakage model results in poor
performance.

###  4.2 Application to Full Networks

After analyzing the results for weight and bias recovery, we would like to
evaluate the attack on full network. To evaluate the attack’s performance on
complete networks, we simulated the recovery of existing quantized neural
networks and assessed the test accuracy.

As the target model, we consider quantized GoogleNet v1 model [23] from
OpenVINO Model
Zoo111https://github.com/openvinotoolkit/nncf/blob/develop/docs/ModelZoo.md,
on the ImageNet dataset. GoogleNet, also known as Inception v1, is a deep
convolutional neural network that was developed by Google for the ImageNet
Large-Scale Visual Recognition Challenge (ILSVRC) 2014. It introduced the
Inception module, which allows the network to capture multi-scale features
while maintaining computational efficiency. The network has $\approx 6.7977$ M
parameters, its high-level architecture is depicted in Figure 1. As such, it
is a decent target for evaluating our model extraction approach.

ImageNet is a large-scale visual database designed for use in visual object
recognition research [7]. It contains over $14$ million images that have been
hand-annotated to indicate the objects present in them. These images are
organized according to the WordNet hierarchy, which includes more than
$20,000$ categories, such as “balloon” or “strawberry.”

Figure 1: Architecture of GoogleNet v1.

We considered the recovery of the quantized GoogleNet v1 model under 3
scenarios presented earlier. For each scenario, we repeat the procedure 5
times. We reported the results in Table 2. We report the top 1 and top 5
accuracy (%) using the accuracy checker from OpenVINO. As a comparison, we
also reported the same accuracies for the original GoogleNet v1 model.

Model | Top 1 Accuracy (%) | Top 5 Accuracy (%)
---|---|---
GoogleNet v1 (Original) | 62.36 | 84.91
GoogleNet v1 Scenario 1 | 61.36 | 84.27
GoogleNet v1 Scenario 2 | 0.10 | 0.50
GoogleNet v1 Scenario 3 | 59.29 | 84.74

Table 2: Top 1 and Top 5 Accuracy for Original and Reconstructed Model on
ImageNet dataset

As can be seen from Table 2, we observe that the recovered model from Scenario
1 and 3 performs almost similarly to the original GoogleNet model. This makes
sense since the leakage model quite matches the leakage behavior. However, for
Scenario 2, when the attacker is using the Hamming weight leakage model when
targeting leakage with high variance for their bit coefficients, the
performance degrades significantly.

In this case, the observed results indicate that the leakage model plays a
crucial role in the success of the model recovery. As an attacker, the main
target is then to develop a leakage model closer to the actual leakage.
However, this task is not trivial, and without profiling, the attacker can
only rely on the standard Hamming weight model. As such, solving this issue
will be a main priority for future work.

##  5 Conclusion

In this paper, we presented an SCA attack on quantized neural network models
implemented in the OpenVINO framework. These models are meant to be deployed
in embedded devices, thus allowing the attacker physical access to realize the
side-channel measurements. Moreover, the quantization, restricting the model
variables to be stored in $8-$bit variables, greatly increases the precision
of the parameter recovery. Our results show that for GoogleNet v1, the top
model recovered by the SCA attack achieves similar accuracy to the original
model, differing by $1\%$ in Top $1$ and by only $0.64\%$ in Top $5$
accuracies.

### Acknowledgement

This project has received funding from the European Union’s Horizon 2020
Research and Innovation Programme under the Programme SASPRO 2 COFUND Marie
Sklodowska-Curie grant agreement No. 945478. This research is funded by the
European Commission, under the Horizon Europe project aerOS, grant number
101069732.

This research is supported by the National Research Foundation, Singapore, and
Cyber Security Agency of Singapore under its National Cybersecurity Research &
Development Programme (Development of Secured Components & Systems in Emerging
Technologies through Hardware & Software Evaluation < NRF-NCR25-DeSNTU-0001
>). Any opinions, findings and conclusions or recommendations expressed in
this material are those of the author(s) and do not reflect the view of
National Research Foundation, Singapore and Cyber Security Agency of
Singapore.

## References

  * [1] Valentina Banciu, Elisabeth Oswald, and Carolyn Whitnall.  Reliable information extraction for single trace attacks.  In 2015 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 133–138. IEEE, 2015.
  * [2] Lejla Batina, Shivam Bhasin, Jakub Breier, Xiaolu Hou, and Dirmanto Jap.  On implementation-level security of edge-based machine learning models.  In Security and Artificial Intelligence: A Crossdisciplinary Approach, pages 335–359. Springer, 2022.
  * [3] Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek.  $\\{$CSI$\\}$$\\{$NN$\\}$: Reverse engineering of neural network architectures through electromagnetic side channel.  In 28th USENIX Security Symposium (USENIX Security 19), pages 515–532, 2019.
  * [4] Jakub Breier, Dirmanto Jap, Xiaolu Hou, and Shivam Bhasin.  A desynchronization-based countermeasure against side-channel analysis of neural networks.  In International Symposium on Cyber Security, Cryptology, and Machine Learning, pages 296–306. Springer, 2023.
  * [5] Jakub Breier, Dirmanto Jap, Xiaolu Hou, Shivam Bhasin, and Yang Liu.  Sniff: reverse engineering of neural networks with fault attacks.  IEEE Transactions on Reliability, 71(4):1527–1539, 2021.
  * [6] Hervé Chabanne, Jean-Luc Danger, Linda Guiga, and Ulrich Kühne.  Side channel attacks for architecture extraction of neural networks.  CAAI Transactions on Intelligence Technology, 6(1):3–16, 2021.
  * [7] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009.
  * [8] Anuj Dubey, Afzal Ahmad, Muhammad Adeel Pasha, Rosario Cammarota, and Aydin Aysu.  Modulonet: Neural networks meet modular arithmetic for efficient hardware masking.  IACR Transactions on Cryptographic Hardware and Embedded Systems, pages 506–556, 2022.
  * [9] Anuj Dubey, Rosario Cammarota, and Aydin Aysu.  Maskednet: The first hardware inference engine aiming power side-channel protection.  In 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pages 197–208. IEEE, 2020.
  * [10] Yansong Gao, Huming Qiu, Zhi Zhang, Binghui Wang, Hua Ma, Alsharif Abuadbba, Minhui Xue, Anmin Fu, and Surya Nepal.  Deeptheft: Stealing dnn model architectures through power side channel.  arXiv preprint arXiv:2309.11894, 2023.
  * [11] Ian Goodfellow, Yoshua Bengio, and Aaron Courville.  Deep learning.  MIT press, 2016.
  * [12] Xiaolu Hou and Jakub Breier.  Cryptography and Embedded Systems Security.  Springer Nature Switzerland, 2024.
  * [13] Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El-Yaniv, and Yoshua Bengio.  Quantized neural networks: Training neural networks with low precision weights and activations.  Journal of Machine Learning Research, 18(187):1–30, 2018.
  * [14] Paul Kocher, Joshua Jaffe, and Benjamin Jun.  Differential power analysis.  In Advances in Cryptology—CRYPTO’99: 19th Annual International Cryptology Conference Santa Barbara, California, USA, August 15–19, 1999 Proceedings 19, pages 388–397. Springer, 1999.
  * [15] Alexander Kozlov, Ivan Lazarevich, Vasily Shamporov, Nikolay Lyalyushkin, and Yury Gorbachev.  Neural network compression framework for fast model inference.  arXiv preprint arXiv:2002.08679, 2020.
  * [16] Yann LeCun, Yoshua Bengio, and Geoffrey Hinton.  Deep learning.  nature, 521(7553):436–444, 2015.
  * [17] Zewen Li, Fan Liu, Wenjie Yang, Shouheng Peng, and Jun Zhou.  A survey of convolutional neural networks: analysis, applications, and prospects.  IEEE transactions on neural networks and learning systems, 33(12):6999–7019, 2021.
  * [18] Stefan Mangard, Elisabeth Oswald, and Thomas Popp.  Power analysis attacks: Revealing the secrets of smart cards, volume 31.  Springer Science & Business Media, 2008.
  * [19] Maria Méndez Real and Ruben Salvador.  Physical side-channel attacks on embedded neural networks: A survey.  Applied Sciences, 11(15):6790, 2021.
  * [20] Karthikeyan Nagarajan, Rupshali Roy, Rasit Onur Topaloglu, Sachhidh Kannan, and Swaroop Ghosh.  Scann: Side channel analysis of spiking neural networks.  Cryptography, 7(2):17, 2023.
  * [21] Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber.  I know what you trained last summer: A survey on stealing machine learning models and defences.  ACM Computing Surveys, 55(14s):1–41, 2023.
  * [22] Dohyun Ryu, Yerim Kim, and Junbeom Hur.  $\gamma$-knife: Extracting neural network architecture through software-based power side-channel.  IEEE Transactions on Dependable and Secure Computing, 2023.
  * [23] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich.  Going deeper with convolutions.  In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015.
  * [24] Ziyu Wang, Fan-hsuan Meng, Yongmo Park, Jason K Eshraghian, and Wei D Lu.  Side-channel attack analysis on in-memory computing architectures.  IEEE Transactions on Emerging Topics in Computing, 12(1):109–121, 2023.