Power Side-Channel Membership Inference Attack on Embedded Machine Learning

Sahan Sanjaya; Prabhat Mishra

cs.CROct 7, 2026

Power Side-Channel Membership Inference Attack on Embedded Machine Learning

Authors: Sahan Sanjaya, Prabhat Mishra

Organizations: Department of Computer & Information Science & Engineering, University of Florida, USA

Abstract

Membership inference attacks (MIAs) threaten the privacy of machine learning (ML) training data by determining whether a sample was used to train a target model. Existing MIAs rely on model outputs, ranging from prediction probabilities to predicted labels, an assumption that can be restrictive for on-device ML systems with limited or inaccessible outputs. However, suppressing model outputs does not eliminate the data-dependent computations that produce them, which may remain observable through physical side channels. We present PSCMIA, a power side-channel membership inference attack against embedded ML models that can infer membership directly from power traces without requiring prediction probabilities or even the predicted labels. We evaluate PSCMIA across multiple datasets (MNIST, FMNIST, CIFAR10, CINIC10), fully connected (FC) and convolutional neural network (CNN) architectures, and two embedded platforms (STM32F3, XMEGA). PSCMIA achieves ROC-AUC values of up to 0.907 on FC models. For CNN models, the ROC-AUC gap between PSCMIA and probability vector-based shadow MIA ranges from 0.006 to 0.116. Across the FC and CNN evaluations, PSCMIA outperforms label-only MIA in 11 of 16 model-dataset-hardware configurations, demonstrating that physical execution can expose membership information even when conventional model outputs are unavailable through unintended power side-channel leakage.

Figures & tables

Panel of Figure 1 — Fig. 1 : Member and non-member distributions for true and trace-predicted output properties. The top panel shows that the selected model exhibits membership-dependent differences in software-computed properties. The bottom panel shows that power-trace-based probes preserve part of this separation, supporting the hypothesis that power traces leak information correlated with the output-probability distribution-derived signals used by output-based membership inference attacks.

Fig. 2 : Overview of PSCMIA that consists of two stages. During profiling, shadow models are used to construct the membership inference attack model. During the attack phase, the trained attack model is used to infer the membership of target samples.

		FC			CNN
Dataset	Train Size	Quant.	Train Acc.	Test Acc.	Quant.	Train Acc.	Test Acc.
MNIST	2000	8-bit	100.00	92.15	8/2/8-bit	99.93	95.35
FMNIST	2000	8-bit	99.85	83.23	8/2/8-bit	99.86	81.74
CIFAR10	2000	8-bit	85.28	25.45	8/2/8-bit	83.75	32.35
CINIC10	2000	8-bit	93.90	19.00	8/2/8-bit	78.79	24.13

TABLE I : Overview of dataset and target models. For each dataset, we train FC and CNN BitNetMCU target models using 2,000 training samples. We report the model quantization configuration and the measured training and test accuracy.

	MNIST				FMNIST				CIFAR10				CINIC10
Metric	Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA
	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA
ROC-AUC	0.6582	0.5281	0.6193	0.6186	0.6804	0.6016	0.6795	0.6477	0.8794	0.8137	0.7958	0.7952	0.9445	0.8960	0.9065	0.8925
FPR	0.7090	0.3185	0.1010	0.4885	0.7215	0.4715	0.4340	0.5330	0.1920	0.2355	0.2540	0.2435	0.1365	0.2000	0.1445	0.1760
Recall	0.9365	0.3545	0.1505	0.6505	0.9775	0.6260	0.6815	0.7445	0.8010	0.7795	0.6870	0.7215	0.8930	0.9035	0.8060	0.8415
TPR@1%FPR	0.0155	0.0305	0.0140	0.0300	0.0265	0.0515	0.0365	0.0145	0.1635	0.0905	0.0675	0.0885	0.3925	0.1730	0.1965	0.2180

TABLE II : Membership inference attack results across datasets using FC target models. We compare probability vector-based shadow MIA, label-only MIA, and PSCMIA on STM32F3 and XMEGA. Appendix A provides detailed per-class results.

	MNIST				FMNIST				CIFAR10				CINIC10
Metric	Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA		Shadow Model	Label Only	PSCMIA
	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA	Shadow Model	Label Only	STM32F3	XMEGA
ROC-AUC	0.6089	0.5111	0.5821	0.5784	0.6945	0.5681	0.6514	0.6588	0.7726	0.7285	0.7464	0.7668	0.8572	0.7978	0.7417	0.7757
FPR	0.5040	0.1040	0.0560	0.5165	0.6880	0.2300	0.1370	0.4875	0.3170	0.2420	0.2360	0.3010	0.2290	0.2125	0.2350	0.2995
Recall	0.6420	0.1405	0.0680	0.6060	0.9535	0.3750	0.2460	0.7010	0.7190	0.6210	0.5350	0.7490	0.7800	0.7265	0.5770	0.7315
TPR@1%FPR	0.0120	0.0235	0.0140	0.0240	0.0300	0.0455	0.0360	0.0215	0.0780	0.0870	0.0540	0.0050	0.0880	0.1315	0.0405	0.0475

TABLE III : Membership inference attack results across datasets using CNN target models. We compare probability vector-based shadow MIA, label-only MIA, and PSCMIA on STM32F3 and XMEGA. Appendix A provides detailed per-class results.

Target property	Model	Classification	Base Acc.	Acc.	Base BAcc.	BAcc.	F1	ROC-AUC	Top-2 Acc.
Probability-vector Shadow Model MIA	LR	Membership	0.500	0.878	0.500	0.878	0.880	0.944	–
Class prediction	LR	10 classes	0.111	0.522	0.100	0.520	0.517	0.929	0.805
Class prediction	ET	10 classes	0.111	0.622	0.100	0.620	0.617	0.955	0.872
Correctness prediction	LR	Binary	0.565	0.593	0.500	0.594	0.591	0.637	–
Correctness prediction	ET	Binary	0.565	0.616	0.500	0.598	0.596	0.650	–
Top-1 probability bin	LR	8 classes	0.194	0.193	0.125	0.283	0.180	0.698	0.428

TABLE IV: Discrete probability vector-property recovery from power traces. The first row reports a probability vector-based shadow model MIA sanity check. The remaining rows report performance for classifiers trained to recover discrete probability vector-derived properties only from power traces. Here, Base Acc. denotes the accuracy of always predicting the most frequent held-out class. Base BAcc. is

1/K

, where

K

is the number of target classes observed in both profiling and held-out evaluation.

Panel of Figure 7 — Fig. 3 : PSCMIA attack ROC-AUC across increasing target-model training dataset sizes, compared with Shadow-MIA.

Panel of Figure 8 — Fig. 4 : Layer-wise localization of membership-relevant POI using symmetric KL divergence. This shows that most of the POIs are in the region related to the argmax operation.

Train	Train	Test	Gen.	Shadow MIA	PSCMIA Pooled ROC-AUC
Size	Acc. (%)	Acc. (%)	Gap	Pooled AUC	STM32F3	XMEGA
200	100.00	70.40	29.60	0.8974	0.7936	0.7918
500	99.96	83.68	16.28	0.8345	0.7095	0.7442
1000	99.90	89.70	10.20	0.7238	0.6699	0.6768
2000	100.00	92.15	7.85	0.6582	0.6193	0.6186
5000	100.00	94.94	5.06	0.5681	0.5680	0.5632

TABLE V : Effect of target-model training-set size and generalization gap on MIA effectiveness for the MNIST FC model.

Fig. 5 : Transferability of PSCMIA across datasets on STM32F3. Rows indicate the source dataset used to train, while columns indicate the target dataset used for evaluation.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Attack	Dataset	ROC-AUC	FPR	TPR@1%FPR	Acc.
Shadow MIA [ 1 ]	MNIST	0.6582	0.7090	0.0155	0.6138
	FMNIST	0.6804	0.7215	0.0265	0.6280
	CIFAR10	0.8794	0.1920	0.1635	0.8045
	CINIC10	0.9445	0.1365	0.3925	0.8782
Label-only [ 11 ]	MNIST	0.5281	0.3185	0.0305	0.5180
	FMNIST	0.6016	0.4715	0.0515	0.5773

Appendix

TABLE VI : Membership inference attack results comparison for FC target models. We compare probability vector-based shadow MIA, label-only MIA, confidence-, loss-, entropy-, and correctness-based attacks, and PSCMIA across datasets. PSCMIA is evaluated on STM32F3 and XMEGA.

Attack	Dataset	ROC-AUC	FPR	TPR@1%FPR	Acc.
Shadow MIA [ 1 ]	MNIST	0.6089	0.5040	0.0120	0.5690
	FMNIST	0.6945	0.6880	0.0300	0.6328
	CIFAR10	0.7726	0.3170	0.0780	0.7010
	CINIC10	0.8572	0.2290	0.0880	0.7755
Label-only [ 11 ]	MNIST	0.5111	0.1040	0.0235	0.5182
	FMNIST	0.5681	0.2300	0.0455	0.5725

Appendix

TABLE VII : Membership inference attack results comparison for CNN target models. We compare probability vector-based shadow MIA, label-only MIA, confidence-, loss-, entropy-, and correctness-based attacks, and PSCMIA across datasets. PSCMIA is evaluated on STM32F3 and XMEGA.

Board	Model/Dataset	Attack	ROC-AUC	FPR	Recall	Acc.
STM32F3	FC / MNIST	LR	0.6113	0.1310	0.1925	0.5308
		ET	0.6193	0.1010	0.1505	0.5248
		RF	0.6165	0.1045	0.1475	0.5215
STM32F3	FC / FMNIST	LR	0.6708	0.4860	0.7290	0.6215
		ET	0.6795	0.4340	0.6815	0.6238
		RF	0.6736	0.3945	0.6125	0.6090

Appendix

TABLE VIII : PSCMIA performance of three representative attack classifiers: Logistic Regression (LR), Extra Trees (ET), and Random Forest (RF). All metrics are computed by pooling predictions across the ten target classes. Bold ROC-AUC indicates the best-performing classifier for each board-target-dataset configuration.

Defense	Model	ROC-AUC	FPR	Recall	TPR@1%FPR	Acc.
Without	MNIST-FC	0.6193	0.1010	0.1505	0.0140	0.5248
	FMNIST-FC	0.6795	0.4340	0.6815	0.0365	0.6238
	CIFAR10-FC	0.7958	0.2540	0.6870	0.0675	0.7165
	CINIC10-FC	0.9065	0.1445	0.8060	0.1965	0.8308
	MNIST-CNN	0.5821	0.0560	0.0680	0.0140	0.5060
	FMNIST-CNN	0.6514	0.1370	0.2460	0.0360	0.5545

Appendix

TABLE IX : Impact of suppressing the argmax-related power-trace segment on PSCMIA. “Without” denotes the original attack without leakage suppression, while “With” denotes PSCMIA after removing the argmax-related trace segment.

Board	Model	Dataset	Class-0	Class-1	Class-2	Class-3	Class-4	Class-5	Class-6	Class-7	Class-8	Class-9
STM32F3	FC	MNIST	0.5776	0.5682	0.5877	0.7035	0.6838	0.6132	0.5749	0.6649	0.6832	0.6624
STM32F3	FC	FMNIST	0.7140	0.5722	0.6939	0.5898	0.7181	0.6187	0.8078	0.6644	0.5871	0.5979
STM32F3	FC	CIFAR10	0.7631	0.8280	0.8538	0.8242	0.8500	0.8205	0.8307	0.8039	0.8031	0.7381
STM32F3	FC	CINIC10	0.8729	0.8940	0.9422	0.8915	0.9092	0.9079	0.9244	0.9083	0.8992	0.9011
STM32F3	CNN	MNIST	0.5373	0.6042	0.6351	0.6460	0.6080	0.5289	0.5463	0.5694	0.6241	0.6348
STM32F3	CNN	FMNIST	0.6965	0.5592	0.7555	0.6349	0.7527	0.5943	0.8637	0.5817	0.5631	0.5442

Appendix

TABLE X : Per-class ROC-AUC of PSCMIA using the Extra Trees (ET) attack model across target models, datasets, and devices.

Panel of Figure 18 — Fig. 6 : Robustness of PSCMIA to trace noise. Evaluated on CINIC10-FC on STM32F3

Panel of Figure 19 — Fig. 7 : Transferability of PSCMIA across datasets and target-model architectures on STM32F3 and XMEGA. Rows within each heatmap indicate the source dataset used to train the attack model, while columns indicate the target dataset used for evaluation.

Explore similar work

Feb 21, 2026cs.LG

LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings

Membership inference attacks (MIAs) threaten the privacy of machine learning models by revealing whether a data point was used during training. Existing MIAs often assume access to public datasets, shadow models, confidence scores or the training distribution, which makes them vulnerable to defenses like confidence masking. Label-only MIAs avoid these assumptions but require thousands of queries per sample. We propose a cost-effective label-only MIA framework based on transferability and model extraction. Querying the target

M

with active sampling, perturbation-based selection and synthetic data, we extract a surrogate

S

on which membership inference is performed offline. This shifts query overhead to a one-time extraction phase. It also removes the restriction that defines the label-only setting: the attacker controls

S

and can read its posteriors and training trajectory, so attacks that cannot be run against

M

can be run against

S

. On Location, Purchase and Texas, the strongest attack on

S

improves AUC over the direct attack on

M

0.9

5.6

and

5.0

percentage points, and improves the true positive rate at

1\%

false positive rate by

2.8\times

6.3\times

. We characterize how leakage transfer depends on surrogate fidelity, evaluate standard defenses, and report preliminary results on image datasets.

Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday

Case Western Reserve University · IBM Research

Membership Inference Attacks

Ask PDF

Jun 16, 2026cs.LG

CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models

Membership inference attacks (MIAs) are a canonical way to assess a machine learning model's privacy properties. Although several attempts have been made to evaluate MIAs on language models, the extant literature has suffered numerous difficulties in constructing clean evaluations to test new techniques. In particular, subtle distribution shifts between member and non-member sets can undermine the statistical validity of MIAs; recent work has underscored this by showing that "blind" methods with no access to the underlying model can perform far better than published methods on the same benchmarks. This paper constructs a benchmark for principled evaluation of MIAs against LLMs, by leveraging the insight that training data before and after a fixed point during training are drawn from the same distribution. Therefore, all open-source models with intermediate checkpoints and public training data can be converted into MIA testbeds. We apply our framework to a half-dozen published attacks on the Pythia and OLMo family of models, from 70M to 7B parameters. To facilitate further privacy research, we open-source a modular library for designing and implementing attacks in this setting: https://github.com/safr-ai-lab/pandora_llm.

Jeffrey G. Wang, Jason Wang, Marvin Li +1

Harvard University · Harvard Business School

LLM Evaluation Membership Inference Attacks LLM Auditing

Ask PDF

Mar 19, 2026cs.CR

Automated Membership Inference Attacks (AutoMIA): Discovering MIA Signal Computations using LLM Agents

Membership inference attacks (MIAs), which enable adversaries to determine whether specific data points were part of a model's training dataset, have emerged as an important framework to understand, assess, and quantify the potential information leakage associated with machine learning systems. Designing effective MIAs is a challenging task that usually requires extensive manual exploration of model behaviors to identify potential vulnerabilities. In this paper, we introduce AutoMIA -- a novel framework that leverages large language model (LLM) agents to automate the design and implementation of new MIA signal computations. By utilizing LLM agents, we can systematically explore a vast space of potential attack strategies, enabling the discovery of novel strategies. Our experiments demonstrate AutoMIA can successfully discover new MIAs that are specifically tailored to user-configured target model and dataset, resulting in improvements of up to 0.18 in absolute AUC over existing MIAs. This work provides the first demonstration that LLM agents can serve as an effective and scalable paradigm for designing and implementing MIAs with SOTA performance, opening up new avenues for future exploration.

Toan Tran, Olivera Kotevska, Li Xiong

Emory University · Oak Ridge National Laboratory

Membership Inference Attacks

Ask PDF