Executive Summary: Edge AI devices—particularly those powered by Tensor Processing Units (TPUs) and Field-Programmable Gate Arrays (FPGAs)—are increasingly targeted by sophisticated side-channel attacks. These attacks exploit physical side effects such as power consumption, electromagnetic emissions, timing variations, and thermal profiles to extract sensitive data, including model weights, inference inputs, and cryptographic keys. In 2026, researchers have demonstrated that TPUs and FPGAs running AI workloads are vulnerable to novel power and timing side-channel attacks that bypass hardware isolation mechanisms. This article examines the evolving threat landscape, evaluates the technical mechanisms behind these attacks, and provides actionable defense strategies for securing edge AI deployments.
Edge AI accelerators like TPUs and FPGAs operate under unique physical constraints that make them susceptible to side-channel leakage. Unlike CPUs, these devices perform highly parallelized matrix operations—such as matrix multiplications in transformers—with consistent, predictable power and timing profiles. An adversary with physical proximity to the device can monitor these physical emanations during inference tasks.
For example, in a power side-channel attack against a Google TPUv5e running a vision transformer (ViT), an attacker uses a high-resolution current probe on the PCIe power rail. The measured power trace correlates with the activation patterns of neurons in the final layer. By applying machine learning-based power template matching, the attacker reconstructs the output class probabilities with high fidelity, potentially reconstructing sensitive input data.
Similarly, on FPGAs implementing custom AI kernels in hardware description languages (HDLs), routing congestion and clock tree design introduce timing variations. An adversary can profile these variations by sending crafted input queries and measuring response latency. These timing differences reveal internal data flow patterns, enabling reverse engineering of the model architecture or extraction of secret weights.
In a 2025 study published at IEEE S&P, researchers demonstrated that a trained 500-million-parameter language model running on a TPUv5e could have its weights extracted with an average error of 3.2% using only 128 power traces. The attack exploited the TPU's systolic array architecture, where power consumption scales linearly with operand values. By correlating power spikes with known activation functions (e.g., ReLU), the adversary reconstructed the entire weight matrix.
Notably, the attack succeeded even when the model was deployed in a secure enclave—undermining Google's Titan security claims for TPU-based confidential computing. This highlights a critical gap: hardware accelerators designed for performance often neglect side-channel resistance.
In embedded AI applications using FPGAs (e.g., NVIDIA Jetson, AMD Kria), thermal side-channel attacks have emerged as a low-cost alternative. A thermal camera operating at 30 FPS can detect hotspots corresponding to active neural network layers. By correlating frame sequences with model execution, an attacker can map layer-wise computational intensity and infer model topology.
Electromagnetic side-channel attacks are equally potent. FPGAs emit strong EMI during DSP operations used in convolutional layers. Researchers have developed deep learning-based decoders that reconstruct activation maps from captured EMI signals with a mean IoU of 0.78 on the CIFAR-10 dataset.
Modern FPGAs support hardware-enforced isolation through features like AMD's Secure Boot or Intel's FPGA Secure Updates. However, side-channel attacks can still penetrate these defenses. For instance, power analysis can reveal the timing of secure boot sequences, enabling an attacker to infer the presence of proprietary IP or cryptographic keys. In 2026, a zero-day exploit named “EnclaveHammer” was disclosed, allowing adversaries to extract keys from FPGA-based TEEs by analyzing power fluctuations during RSA decryption.
This demonstrates that side-channel resistance must be a first-class design constraint for secure AI hardware.
To mitigate these risks, a multi-layered defense strategy is essential:
As AI models grow larger and edge devices proliferate, side-channel attacks will become more scalable and automated. Researchers are exploring:
The design of future AI hardware must embrace “Security by Design”, integrating side-channel resistance as a core performance metric alongside throughput and power efficiency.
For AI Hardware Vendors (e.g., AMD, NVIDIA, Google):