BarraCUDA: Edge GPUs do Leak DNN Weights

Peter Horvath, Lukasz Chmielewski, Masaryk University, Léo Weissbart, Lejla Batina, Yuval Yarom

34th USENIX Security Symposium · Day 1

This article delves into BarraCUDA, a groundbreaking side-channel attack meticulously detailed in a paper presented at USENIX Security. The research, spearheaded by Peter Horvath and a team from Radboud University, Ruhr University Bochum, and Masaryk University, definitively answers a critical question in hardware security: Are proprietary implementations of neural networks on GPUs vulnerable to parameter extraction using side-channel analysis? Their affirmative findings expose a significant vulnerability in popular Nvidia Jetson devices, which are widely deployed in edge computing applications ranging from autonomous vehicles to intelligent cameras.

AI review

This is the real deal — first demonstrated extraction of actual DNN weights from production GPUs via EM side-channel. Not architecture recovery, not layer counting, but the actual trained parameters that represent the IP. The partial-sum insight is elegant, the engineering to make CEMA work against GPU noise is substantial, and the implications for edge AI deployments are immediate.