New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
Laser Probing Lifts LLM Secrets from Edge Chips
Published: Thu, 27 Aug 2026 • By Theo Solander
Attacks
Researchers use laser voltage imaging to read Large Language Model (LLM) assets from edge AI accelerators during inference. They recover embeddings, activations, attention state and quantised weights from FPGA-based designs, with hybrid methods filling gaps. The work shows model IP and user data can leak when LLMs run on physically accessible devices.
Every time we push computation out of the datacentre and into the world, the old ghosts of physical side channels stir. In this case, the team behind LLMscope points a microscope and a near‑infrared laser at an edge accelerator and proceeds to read the guts of a Large Language Model (LLM) as it runs. It feels novel, but the rhythm is familiar: when secrets leave the vault, optics find a way in.
The technique is electro‑optical frequency mapping (EOFM). Sweep a modulated laser across the backside of a live die, and you get frequency‑selected maps of switching activity. That lets you pick out storage and datapath structures, down to individual bit positions in flip‑flops (FF) and block RAM (BRAM). The researchers validate on an FPGA board with a Kintex‑class device configured as an LLM accelerator using a systolic array. Because these accelerators reuse the same on‑chip buffers and compute lanes across addresses, tiles, modules and layers, once you’ve localised the boundaries you can ride the dataflow and read a lot.
How it works
There are three moves. First, direct bit‑level recovery: EOFM cleanly resolves FF and BRAM cells at staging points, so you can decode complete numbers in flight. That yields embeddings, activations, attention state, even quantised MLP weights and Logit" target="_blank" rel="noopener" class="term-link">logits, while the device keeps running.
Second, hybrid recovery: if you can only sample part of a streamed weight matrix, you combine the partial reads with observed input‑output pairs for the linear blocks and solve for the unknowns with linear algebra. It hinges on observation diversity and full‑rank inputs, but when those hold, the gaps close.
Third, downstream consistency: if a few bits remain hidden, you enumerate candidate completions and propagate them through known computations, pruning against a later EOFM‑recovered state. In practice, this survived several missing bits without losing the trail.
Why it scales
The team derives lower bounds relating imaging effort to asset size and how many bits you harvest per capture. Direct recovery scales linearly. Large streamed matrices are costly to traverse — think of a 4096×4096 projection at 4‑bit — but local states often reveal many bits at once, keeping effort reasonable. The punchline: buffer and subcircuit reuse amortises the upfront mapping across layers and modules.
There are constraints. You need backside access, a capable optical bench, and tight control of inference replays. Placement and routing matter, so each device family needs characterisation. Even so, the pattern is classic. We once listened to monitors sing and smartcards whisper; now edge LLMs hum the same tune. The practical question is no longer if an attacker can read on‑device assets, but which deployments are assuming physical safety they don’t have.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing
Authors: Dev Mehta, Lily Dukette, William Folan, Olivia Kochol, Noah Solomon, Shahin Tajik, and Fatemeh Ganji
The move of LLM inference to edge AI accelerators introduces new physical vulnerabilities. During execution, model parameters and intermediate inference states are repeatedly loaded into and processed on the chip, making them suscep- tible to physical side-channel attacks. In this work, by deploying laser voltage imaging, we show that one can extract LLM assets during inference, namely embeddings, attention, and quantized MLP weights, activations, and other inference states, from localized memories and compute subcircuits. To validate our claims, we perform an attack on an FPGA-based LLM accelerator. Since such accelerators reuse the same buffers and compute subcircuits across addresses, tiles, modules, and layers, reading asset values comes down to probing different memories during inference. We demonstrate full recovery of the targeted values; however, we also establish a methodology to recover asset values even if some weights or bits remain unread. We further derive lower bounds that relate imaging effort to asset dimensions and show that even direct recovery scales linearly with the size of the targeted asset
🔍ShortSpan Analysis of the Paper
Problem
This paper investigates physical side-channel exposure of large language model assets when inference is run on edge AI accelerators. During execution, parameters and intermediate inference state are repeatedly staged in on-chip memories, registers and datapaths, creating an opportunity for physical probing to reveal both persistent model assets (embeddings, projection and MLP weights, quantisation metadata) and inference-state assets (activations, attention, KV-cache entries, logits). The work matters because model intellectual property and user-dependent secrets can migrate from protected data centres onto locally deployed hardware that may be physically accessible to an adversary.
Approach
The authors model FPGA LLM inference as an asset-flow system and focus on backside optical probing using electro-optical frequency mapping (EOFM). EOFM scans a near-infrared laser across an operating die and recovers frequency-selected spatial maps of circuit activity, enabling localisation of storage and datapath primitives and identification of physical bit positions. Experiments use a Digilent Genesys 2 board with an AMD/Xilinx Kintex-7 FPGA, a Hamamatsu microscope for EOFM, and a systolic-array matrix-multiplier test design that exposes flip-flop (FF) and block RAM (BRAM) boundaries representative of LLM accelerators. Recovery strategies include direct bit-level readout, hybrid recovery that combines partial direct reads with Gaussian-elimination solves using observed input-output pairs for linear modules, and downstream-consistency checks that eliminate candidate completions when only a few bits are unread.
Key Findings
Direct bit-level recovery: EOFM localises FF and BRAM bit positions and decodes complete numerical values at those boundaries while the device remains operational, allowing exact readout of staged embeddings, activations, and weight tiles.
Hybrid recovery: When full optical coverage is impractical (for example streamed weight matrices), partially recovered weight entries plus sufficiently diverse exact module input-output observations permit reconstruction of the remaining unknowns by linear algebra; success requires full-rank input submatrices and observation diversity.
Downstream consistency: If only a small number of bits are unresolved, enumerating candidate completions and propagating them through known computations to an EOFM-recovered downstream state prunes candidates; experiments showed robust recovery even with multiple hidden bits.
Scalability bounds: Imaging effort scales with asset size and with how many asset bits are recovered together per measurement; direct coverage of large streamed matrices can require many replay states (examples: a 4096×4096 4-bit projection implies very large traversal counts), while activations and local states often expose many bits together reducing cost.
Practical demonstration: FF and BRAM experiments decoded multi-bit values and validated hybrid and downstream recovery strategies using only a few controlled EOFM captures.
Limitations
The attack requires physical backside access, specialised optical equipment and the ability to execute or replay inference under controlled, repeatable conditions. Recovery depends on the specific placement and routing of bits on the die, so characterisation per device family is needed. Hybrid recovery succeeds only if input observations are sufficiently diverse and full-rank; incomplete coverage or overlapping unresolved bits can leave ambiguities. Imaging cost can be high for very large streamed assets.
Implications
An attacker with physical access and the described optical capability can extract model intellectual property and user-dependent inference state from edge LLM accelerators. Extracted model parameters enable reconstruction or cloning of deployed models, while recovered KV-cache entries, activations or logits can reveal confidential user inputs and outputs. Reuse of on-chip buffers and compute engines makes it practical to amortise localisation across many assets, increasing the risk to both model IP and runtime secrets in locally deployed systems.
- It tackles a real risk in shared GPU setups: attackers can sneakily peek at model weights via PCIe/DMA or by dumping GPU memory.
- Proposes CloakL...
- It shows a practical side-channel attack against FINN-generated dataflow AI accelerators, capable of recovering hardware configuration like folding ...
- It exposes a new attack surface: bit-flips in a shared KV-cache used by LLM serving can subtly change model outputs.
- The attack can be hard to det...
- It reveals a new hardware-level timing side-channel: whether sparsity-driven zero-skipping is used in AI accelerators can leak private backend featu...
- It tackles how hardware-induced bit-flips or fault-injection can silently corrupt LLMs and cause dangerous or unpredictable behavior, which is a key...
- It shows a new kind of threat: just a few flipped bits in the model weights can cause persistent, across-the-board cost/latency inflation for all us...
- It shows a new timing-based side channel in multi-tenant LLM serving stacks: shared KV and semantic caches, and GPU memory behavior, can leak privat...
- Addresses a real risk: when LLMs run on shared accelerators, an attacker with read access to memory can glimpse hidden states and caches, risking pr...
- It reveals a new on-device side-channel: dynamic image preprocessing causes timing and cache patterns that leak both the shape of the input and, lat...
- It reveals a new class of in-memory jailbreaks: changing only a few bits in model parameters can override safety guards at runtime, not just through...
Get the weekly digest
The few AI-security papers that matter, with the practitioner takeaway. No spam.
