In a groundbreaking study, researchers have demonstrated a technique to steal artificial intelligence (AI) models without hacking the devices running them. Using electromagnetic signals, they successfully replicated a Google Edge Tensor Processing Unit (TPU) model with a staggering 99.91% accuracy. This revelation exposes a critical vulnerability in AI systems and highlights the urgent need for robust countermeasures.
Stealing AI Models: A New Frontier
AI models are valuable assets that require significant resources to develop. However, this study shows they can be stolen without prior knowledge of the software or architecture behind them.
“AI models are expensive to create, and we don’t want people to steal them,” says Aydin Aysu, associate professor of electrical and computer engineering at North Carolina State University and co-author of the study. “When a model is stolen, not only is the intellectual property compromised, but the model itself becomes more vulnerable to targeted attacks as third parties study its weaknesses.”
The risks extend beyond intellectual property theft. According to Ashley Kurian, the study’s lead author and a Ph.D. student at NC State, model stealing attacks undermine competitive advantages, jeopardize sensitive data embedded in AI systems, and erode trust in the technology.
How the Technique Works
The researchers focused on extracting the hyperparameters of an AI model—a key aspect of its architecture and functionality—running on a Google Edge TPU, a commercially available chip widely used in edge devices.
Electromagnetic Signature Extraction
To replicate the model, the team placed an electromagnetic probe on the TPU chip while it processed data. The probe captured real-time changes in the chip’s electromagnetic field, creating a “signature” of the AI model’s processing behavior.
“The electromagnetic data essentially gives us a signature of the AI’s behavior,” Kurian explains. “That’s the easy part.”
Reverse Engineering the Model
The researchers compared the extracted signature to a database of known model signatures generated on identical devices. By breaking the model into individual layers—sequential operations performed by the AI—they identified each layer’s characteristics through a systematic comparison process.
- Layer-by-Layer Matching: Starting with the first layer, the team matched the electromagnetic signature against a collection of 5,000 first-layer signatures in their database. Once the first layer was identified, the process was repeated for subsequent layers until the entire model was reverse-engineered.
- Efficiency Through Simplification: Rather than recreating the entire electromagnetic signature of the model, which would be computationally overwhelming, the researchers focused on smaller, manageable segments.
With this method, the team successfully replicated the architecture and high-level features of the model, creating a nearly identical functional copy.
Why It Matters
The implications of this vulnerability are far-reaching. AI models are increasingly deployed in edge devices such as smartphones, IoT systems, and autonomous vehicles. The demonstrated technique shows that as long as attackers have access to the device running the AI and another device with identical specifications, they can replicate the model with minimal effort.
“This method could be used to steal AI models running on many different devices,” Kurian warns.
Beyond financial losses, stolen models pose heightened security risks. Attackers can use replicated models to identify weaknesses, launch adversarial attacks, or embed malicious behaviors in cloned systems.
Protecting AI Models: The Next Step
Now that this vulnerability has been exposed, the researchers emphasize the need for countermeasures to safeguard AI systems.
“Defining and demonstrating the problem is only the first step,” Aysu says. “The next step is to develop and implement strategies to protect against it.”
Potential countermeasures include:
- Electromagnetic Shielding: Preventing signal leakage from AI processing units.
- Encryption and Obfuscation: Securing processing behaviors to make reverse engineering more difficult.
- Dynamic Model Architectures: Regularly updating model behaviors to reduce predictability.
A Call to Action
The researchers disclosed the vulnerability to Google, which underscores the broader need for industry-wide vigilance. As AI becomes more integrated into everyday life, ensuring the security of these systems is paramount.
Their work, supported by the National Science Foundation, lays the groundwork for further research into AI protection. Presented at the Conference on Cryptographic Hardware and Embedded Systems, this study is a stark reminder that innovation in AI must be paired with equally advanced security measures.
As AI continues to transform industries, safeguarding the integrity and security of these systems will be critical to their success. This research serves as both a warning and a call to action for developers, organizations, and policymakers to prioritize security in the rapidly evolving landscape of artificial intelligence.
