AI 硬件安全
LLMscope Reads Model Weights and Inference State on FPGAs Using Laser Voltage Imaging
A WPI team demonstrates how to recover quantized weights, activations, and other LLM assets from FPGA registers and block RAM. The attack requires physical access to the chip and replayable states, and the experiments did not fully extract a commercial large language model.
A team at Worcester Polytechnic Institute has introduced LLMscope, which applies laser voltage imaging (LVI) to physical side-channel attacks against edge LLM accelerators. Using electro-optical frequency mapping (EOFM), the researchers direct a modulated laser at the back side of a chip and use reflection changes caused by local voltages to locate and decode bits stored in flip-flops and block RAM. During inference, these structures hold embeddings, quantized MLP weights, activations, attention intermediates, and the KV cache, so encrypted storage or secure loading does not guarantee that data will not leak while it is being processed.
The experiments were conducted on a Xilinx Kintex-7 FPGA. The team used replayable inputs to create stable, periodic contrasts and successfully recovered data directly from dense registers and BRAM configured for 8-bit and 16-bit values. When some bits could not be imaged, LLMscope represented the observed inputs, outputs, and weights as linear constraints. In the small 2×2 matrices used for testing, even with eight bits hidden in both the weights and outputs, 421 of 508 masking cases—82.87%—allowed the original matrix to be uniquely reconstructed. When the matrix was known, downstream state recovered every one of 856 missing-input configurations.
The key finding is that the data path can be reused. FPGAs repeatedly route different addresses, tiles, and model layers through the same physical buffers, so an attacker does not need to relocate the circuitry for every parameter. Scaling costs remain substantial, however. The paper estimates that imaging a 4,096-element FP16 activation would require at least 832 images at the observed capture width. At five minutes per image, that amounts to nearly 69 hours. Fully traversing a 4,096×4,096 4-bit projection over a 512-bit data path would require at least 131,072 replayed states.
This is therefore neither remote model theft nor a demonstrated method for fully cloning a large commercial accelerator. The attack requires expensive optical equipment, access to the back side of the chip, stable timing, and controllable or replayable execution. The primary validation also covers only one FPGA and small matrix data paths. The engineering question worth tracking is whether package shielding, optical sensors, randomized data placement, and randomized execution timing can block this type of measurement without negating the efficiency benefits of edge inference.