  Analog compute-in-memory (CIM) systems are promising for deep neural network
(DNN) inference acceleration due to their energy efficiency and high
throughput. However, as the use of DNNs expands, protecting user input privacy
has become increasingly important. In this paper, we identify a potential
security vulnerability wherein an adversary can reconstruct the user's private
input data from a power side-channel attack, under proper data acquisition and
pre-processing, even without knowledge of the DNN model. We further demonstrate
a machine learning-based attack approach using a generative adversarial network
(GAN) to enhance the data reconstruction. Our results show that the attack
methodology is effective in reconstructing user inputs from analog CIM
accelerator power leakage, even at large noise levels and after countermeasures
are applied. Specifically, we demonstrate the efficacy of our approach on an
example of U-Net inference chip for brain tumor detection, and show the
original magnetic resonance imaging (MRI) medical images can be successfully
reconstructed even at a noise-level of 20% standard deviation of the maximum
power signal value. Our study highlights a potential security vulnerability in
analog CIM accelerators and raises awareness of using GAN to breach user
privacy in such systems.
