{"id":2,"date":"2025-08-12T16:59:18","date_gmt":"2025-08-12T16:59:18","guid":{"rendered":"https:\/\/research.ece.ncsu.edu\/gatebleed\/?page_id=2"},"modified":"2025-10-01T18:29:02","modified_gmt":"2025-10-01T18:29:02","slug":"sample-page","status":"publish","type":"page","link":"https:\/\/research.ece.ncsu.edu\/gatebleed\/","title":{"rendered":"Home"},"content":{"rendered":"\n
<\/div><\/span>
\n
\n

Gatebleed<\/h1>\n\n\n\n

Exploiting Power Gating for Stealthy AI Timing Attacks<\/h2>\n\n\n\n

A new hardware side-channel that turns a power optimization into a high-signal timing leak \u2014 the first hardware-only membership inference attack on AI accelerators.<\/p>\n<\/div><\/div>\n\n\n\n

<\/div>\n<\/div><\/div>\n\n\n\n

Overview<\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

GateBleed is a newly discovered microarchitectural side-channel affecting Intel\u2019s Advanced Matrix Extensions (AMX) and potentially other AI accelerators.<\/p>\n\n\n\n

It exploits the staged power-gating mechanism designed to improve performance-per-watt in AI workloads.<\/p>\n\n\n\n

When AMX or similar accelerators wake from deep power states, they incur a large, repeatable latency penalty \u2014 up to ~20,000 CPU cycles \u2014 which can be measured remotely and used to infer sensitive information.<\/p>\n\n\n\n

Microarchitectural side-channel attacks exploit the specific implementation of a processor\u2019s instruction-set architecture (e.g., x86, ARM). Unlike traditional malware, these attacks leverage benign code paths that unintentionally reveal information about a victim\u2019s workload through measurable side effects. The landmark examples\u2014Spectre and Meltdown (2018)\u2014show how performance optimizations can be a double-edged sword: enabling high performance while simultaneously exposing systems to new classes of attacks.<\/p>\n\n\n\n

The end of Dennard Scaling, the principle that shrinking transistors increases density without significantly raising power consumption, has further complicated matters. To reduce power use, modern processors aggressively power-gate idle components. However, the resulting wake-up latency creates observable patterns that attackers can exploit to infer component usage. Similarly, AI workloads are power-intensive. To cope, practitioners employ software-level model gating optimizations such as early exiting<\/em> and mixture-of-experts<\/em>. GateBleed demonstrates that these optimizations introduce uneven hardware utilization, enabling privacy attacks against AI models; GateBleed is the first demonstration of data privacy being compromised through power optimization. Unlike Spectre and Meltdown, which exploit fundamentally limited performance optimizations, power gating and model gating are likely to become even more widespread as the demand for ever-larger AI models grows in the post-Dennard Scaling era, increasing the potential for GateBleed attacks.<\/p>\n\n\n\n

Our peer-reviewed paper, \u201cGATEBLEED: Exploiting On-Core Accelerator Power Gating for High Performance & Stealthy Attacks on AI\u201d, has been accepted at MICRO 2025.<\/p>\n\n\n\n

\"\ud83d\udcc4\" Read the preprint on arXiv<\/a><\/p>\n\n\n\n

\n\n\n\n

Key Findings<\/h2>\n\n\n\n