  With proliferation of DNN-based applications, the confidentiality of DNN
model is an important commercial goal. Spatial accelerators, that parallelize
matrix/vector operations, are utilized for enhancing energy efficiency of DNN
computation. Recently, model extraction attacks on simple accelerators, either
with a single processing element or running a binarized network, were
demonstrated using the methodology derived from differential power analysis
(DPA) attack on cryptographic devices. This paper investigates the
vulnerability of realistic spatial accelerators using general, 8-bit, number
representation.
  We investigate two systolic array architectures with weight-stationary
dataflow: (1) a 3 $\times$ 1 array for a dot-product operation, and (2) a 3
$\times$ 3 array for matrix-vector multiplication. Both are implemented on the
SAKURA-G FPGA board. We show that both architectures are ultimately vulnerable.
A conventional DPA succeeds fully on the 1D array, requiring 20K power
measurements. However, the 2D array exhibits higher security even with 460K
traces. We show that this is because the 2D array intrinsically entails
multiple MACs simultaneously dependent on the same input. However, we find that
a novel template-based DPA with multiple profiling phases is able to fully
break the 2D array with only 40K traces. Corresponding countermeasures need to
be investigated for spatial DNN accelerators.
