LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing

Dev Mehta; Lily Dukette; William Folan; Olivia Kochol; Noah Solomon; Shahin Tajik; Fatemeh Ganji

cs.CRAug 26, 2026

LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing

Authors: Dev Mehta, Lily Dukette, William Folan, Olivia Kochol, Noah Solomon, Shahin Tajik, Fatemeh Ganji

Organizations: Worcester Polytechnic Institute

Abstract

The move of LLM inference to edge AI accelerators introduces new physical vulnerabilities. During execution, model parameters and intermediate inference states are repeatedly loaded into and processed on the chip, making them suscep- tible to physical side-channel attacks. In this work, by deploying laser voltage imaging, we show that one can extract LLM assets during inference, namely embeddings, attention, and quantized MLP weights, activations, and other inference states, from localized memories and compute subcircuits. To validate our claims, we perform an attack on an FPGA-based LLM accelerator. Since such accelerators reuse the same buffers and compute subcircuits across addresses, tiles, modules, and layers, reading asset values comes down to probing different memories during inference. We demonstrate full recovery of the targeted values; however, we also establish a methodology to recover asset values even if some weights or bits remain unread. We further derive lower bounds that relate imaging effort to asset dimensions and show that even direct recovery scales linearly with the size of the targeted asset

Figures & tables

Figure 1: Model and inference-state assets are repeatedly staged in the same classes of memory and compute structures. Direct bit-level reads provide exact anchors, while missing numerical entries or individual bits can be completed using linear input-output relations or recovered downstream states. Here, $L$ denotes the number of transformer layers, $d_{\mathrm{model}}$ the hidden dimension, and $|V|$ the vocabulary size; $\Theta(\cdot)$ denotes asymptotic bound. $X$ is the module input, $W$ the model weights, $Y$ the module output, $f(\cdot)$ the known downstream computation, and $Z$ a later state derived from $Y$ .

Figure 2: Asset flow and on-chip storage during FPGA LLM inference. Model parameters and inference-state assets are repeatedly read from and written to reused memory and compute structures as inference proceeds across layers.

Design	Flip-flops	BRAM	URAM	Security-relevant implementation characteristic
LlamaF [ 43 , 25 ]	$\approx 171$ K	223	–	TinyLlama-scale embedded inference with quantized layer weights, scale factors, BRAM-cached activations, and pipelined matrix-vector computation.
Pushing up to the Limit [ 26 , 25 ]	$\approx 105$ K	$\approx 37$	10	LLaMA2-7B W4 inference on KV260 with a 4 GB external-memory budget, streamed weights, on-chip hidden state, and partial KV-cache storage.
Hummingbird [ 25 ]	25,422	59	18	LLaMA3-8B embedded inference with a 512-bit weight bus, 4-bit model weights, 8-bit KV cache, and time-multiplexed on-chip KV-cache buffering.
FlightLLM [ 44 ]	943K	1,252	792	U280 implementation with a large HBM-backed model, on-chip decode activations, and a buffer subsystem using 816 BRAMs and all 792 URAMs.

Table 1: Published FPGA LLM resource scales relevant to EOFM image planning.

Figure 3: EOFM results for FFs representing the input and output registers of the matrix multiplier. Green circles indicate input bits, while orange circles highlight the corresponding output bits for each evaluated input byte.

Figure 4: EOFM results for BRAM outputs. The left panel provides an overview of the selected BRAM region and the blue box denotes the field of view used for high-magnification EOFM. The remaining panels show the EOFM maps for representative data patterns.

Figure 5: EOFM results for a 16-bit BRAM configured with internal output registers. Orange circles denote active bit locations, while bounding boxes mark the physical output register logic. Purple boxes enclose 2-bit register pairs, and green boxes delineate single-bit edge registers. The 16-bit output is arranged across two 8-bit rows.

Figure 6: Representative 50% observation availability. The complete orange output arrays for 0xAA and 0x66 are artificially withheld in post-processing. All four panels originate from the EOFM captures in Figure 3 .

Figure 7: Joint recovery when both $W$ and $Y$ are incomplete. Eight bits of $W$ and eight bits of each downstream state are treated as unreadable. Applying the EOFM observations in the order 0xFF , 0x11 , 0x66 , and 0xAA reduces the candidate set from $256$ to $4$ , $4$ , $2$ , and finally one candidate.

Figure 8: Four missing input bits from the representation of 0x11 are introduced in post-processing. The complete orange downstream output remains available and uniquely selects the original input completion.

Figure 9: Photon-emission results for sparsely placed FFs forming the matrix-multiplier input registers. The top-left panel shows the Vivado floorplan, while the remaining panels show representative data values. Blue boxes mark FF locations and orange circles mark active logic ‘1’ states.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Shape and Substance: Dual-Layer Side-Channel Attacks on Local Vision-Language Models
Mar 26, 2026Eyal Hadad, Mordechai GuriPrivacy Protection in VLMs Adversarial Attacks on VLMs
Ben-Gurion University of the Negev, Israel Faculty of Computer and Information Science
Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
Oct 22, 2026Mrityunjay Shukla, Shubham Roy, Biswabandan PandaLLM Security LLM Inference Efficiency
Indian Institute of Technology Bombay, Mumbai, India
How Vulnerable Are Edge LLMs?
Mar 25, 2026Ao Ding, Hongzong Li, Zi Liang +5LLM Security
China University of Geoscience Beijing · Hong Kong University of Science and Technology · Hong Kong Polytechnic University +4

Mar 26, 2026J/K move · Enter open · S save

Shape and Substance: Dual-Layer Side-Channel Attacks on Local Vision-Language Models

Eyal Hadad, Mordechai Guri

Ben-Gurion University of the Negev, Israel Faculty of Computer and Information Science

Privacy Protection in VLMs Adversarial Attacks on VLMs

Open paper AskPDF arXiv

On-device Vision-Language Models (VLMs) promise data privacy via local execution. However, we show that the architectural shift toward Dynamic High-Resolution preprocessing (e.g., AnyRes) introduces an inherent algorithmic side-channel. Unlike static models, dynamic preprocessing decomposes images into a variable number of patches based on their aspect ratio, creating workload-dependent inputs. We demonstrate a dual-layer attack framework against local VLMs. In Tier 1, an unprivileged attacker can exploit significant execution-time variations using standard unprivileged OS metrics to reliably fingerprint the input's geometry. In Tier 2, by profiling Last-Level Cache (LLC) contention, the attacker can resolve semantic ambiguity within identical geometries, distinguishing between visually dense (e.g., medical X-rays) and sparse (e.g., text documents) content. By evaluating state-of-the-art models such as LLaVA-NeXT and Qwen2-VL, we show that combining these signals enables reliable inference of privacy-sensitive contexts. Finally, we analyze the security engineering trade-offs of mitigating this vulnerability, reveal substantial performance overhead with constant-work padding, and propose practical design recommendations for secure Edge AI deployments.

Abstract

LLM Security

Explore similar work

Shape and Substance: Dual-Layer Side-Channel Attacks on Local Vision-Language Models

Amplifying Latency and Cost of LLM Inference via Rowhammer Attack

How Vulnerable Are Edge LLMs?