FPGA Pentimenti: Transistors Leak Previous FPGA Cloud User Data

Cloud service providers offer Field Programmable Gate Arrays (FPGAs) as a time-shared service for accelerating various workloads. With the current temporal sharing model, there is generally believed to be no information leakage between subsequent users since the FPGA is entirely digitally erased between each tenant.

Our results show that conventional wisdom is flawed: data from previous users of an FPGA can be extracted by measuring analog burn-in effects without physical access to the FPGA. We call these “FPGA pentimenti,” i.e., analog remnants of a previous user’s information that reflect themselves due to bias temperature instability (BTI) effects that change transistor timing behavior. Pentimenti arise when BTI causes are reversed and transistor characteristics recover, enabling a subsequent FPGA user to observe previous logical values applied to FPGA elements.

Much like infrared imaging can expose artwork pentimenti — early paint strokes since painted over by an artist whose remnants remain but are not visible to the naked eye — an FPGA pentimento can be extracted by a subsequent FPGA user even though the data was cleared, and thus no longer digitally exists on the device.

Our ASPLOS paper describes the results in more detail. Or listen to Colin’s lightning talk below.

Open-Source Parallel Computing Curriculum

We are working to redevelop UCSD CSE 160 “Introduction to Parallel Programming” to make it more open and accessible. A major effort is moving from CUDA and nVidia GPUs to OpenCL. That will enable us to target a much broader set of hardware accelerators like vector processing units, tensor processing units, field-programmable gate arrays, multi-core processors, and other emerging architectures. The video presented at the Qualcomm University Platforms Symposium describes the efforts that we are undertaking. The intended outcome is making the curriculum – the slides, the programming assignments, the classroom materials, etc. all open-source. I hope this will make it easier for other educators to adopt and students outside of UCSD to learn more about parallel computing. Many thanks to Qualcomm and Intel for supporting these curriculum changes.

FishSense Nets Multiple Awards

FishSense has been on a tear recently. FishSense won the inaugural Transdisciplinary Collaboration Award at the 2024 Jacobs School of Engineering Research Expo. This comes on the heels of other accolades including a CA CARES research award and finalist at the Triton Innovation Challenge.

FishSense is a collaboration between Engineers for Exploration, Scripps Institution of Oceanography Semmens Lab, and REEF citizen scientists. FishSense provides simple yet effect tool for fisheries assessment. FishSense couples a commercial dive camera with an underwater laser and adds a bit of optics and machine learning to automatically determine fish length and biomass. Congrats Chris, Kyle, Avik, and the entire FishSense team!

AMD Researchers Invade UCSD

Alireza Khodamoradi, Stephen Neuendorffer, and Kristof Denolf visited UCSD to discuss the latest and greatest at AMD. Ali, Steve, and Kristof are all part of AMD Research and Development Group. Ali discussed his research on new data types for hardware-accelerated computing. Ali is a Kastner Research Group Ph.D. alumnus who graduated two years ago and has since been working at AMD Xilinx. Steve is a long-time collaborator of our research group and co-author of the “Parallel Programming for FPGAs” with Ryan. Steve and Kristof did a tag-team presentation on the AI Engines — a new architecture that lies between a GPU and an FPGA. Kristof also has ties to our research group, having mentored Ali at Xilinx while Ali was doing an internship there during his Ph.D. and a co-author on our Streaming Spiking Neural Networks (S2N2) project. It was great to hear about their recent work and have all of them back in SD. And my apologies, but I forgot to record the AI Engine talk until a few minutes after it started!

IEEE Fellow

Ryan was elevated to IEEE Fellow “for contributions to the design and security of reconfigurable systems.” This is a great honor, though, in retrospect, it is purely a consequence that Ryan has worked with many outstanding researchers over the years. It also means that Ryan is old…or perhaps, to spin it in a more positive light, he is very distinguished.

Ryan with the other distinguished IEEE Fellows at DAC 2023.

Tailoring Skip Connections for More Efficient ResNet Hardware

Skip connections are valuable for training Residual Neural Networks (ResNets), helping them converge to a better solution faster. But skip connections add overhead to the hardware implementation; they require additional on-chip memory and other resources and larger memory bandwidths. Skip connections are like training wheels on a bicycle – they are helpful for learning but get in the way once the learning process is completed.

Tailor is a hardware-software codesign technique that modifies skip connections to be more hardware efficient while maintaining overall accuracy. Tailor gradually transforms a ResNet to remove or shorten the skip connections while iteratively retraining the network. Tailor can remove skip connections on smaller networks. As the network gets larger, removing the skip connections reduces accuracy. In these cases, Tailor makes the skip connections shorter. Perhaps non-intuitively, this reduces resources as the hardware synthesis tool (hls4ml in this case) will implement these shortened skip connections on local memories, which incurs very little additional overhead.

An original ResNet with skip connections in place. The same ResNet model with removed and shortened skip connections.

Tailor started in CSE 237C class in Fall 2020. That was during the height of the pandemic, so the class was totally online. Co-authors Olivia “Liv” Weng, Gabriel Marcano, and Nojan Sheybani were students in this class. Co-author Alireza “Ali” Khodamoradi and Ryan Kastner were course instructors. Ali came up with the idea and pitched it as a potential class project. The project went through several submissions and many rejections, but each time Liv and other co-authors took the reviewer’s comments, added more experiments, and polished the writing. The paper improved and picked up a few other co-authors along the way. Rejections are frustrating but a common (and rarely talked about) aspect of publishing in top venues. It was a journey that resulted in a very strong set of research results.

Links: The Tailor paper in the ACM Transactions on Reconfigurable Technology and Systems, “Davis” summarizes the work nicely, Edge Impulse highlights the project

Qualcomm Innovation Fellowship for Hardware Security Verification

Since 2009, the annual Qualcomm Innovation Fellowship has enabled Qualcomm to help foster the research and development of new technologies in key areas of interest to the semiconductor industry through investments in Ph.D. students and their forward-thinking ideas. Members of winning teams are awarded a fellowship and partner with a Qualcomm mentor to help facilitate their proposed research plan.   

For this year’s fellowship, Qualcomm listed “Secure System Design” as one of their eight areas of interest. Upon seeing this, Andy Meza (UCSD) was inspired to join forces with current research collaborator and former UCSD labmate Colin Drewes (Stanford) in order to submit a proposal, given their shared interest and background in hardware security research. From December 2022 to July 2023, Andy and Colin’s research proposal, “Facilitating Security Verification via Hyperflow Analysis” made its way through the Abstract phase (182 teams), the Full Proposal phase (90 teams), and the Finalist Presentation and Live Q&A phase (43 teams) in order to end up among the winning proposals (18 teams).

Andy Meza and Colin Drewes, 2023 Qualcomm Innovation Fellows.

The funding and mentorship from the Qualcomm Innovation Fellowship will enable Andy and Colin to continue their research into automated methodologies for detecting, exploiting, and, ultimately, mitigating security vulnerabilities in hardware designs. It will also support their sushi-eating and coffee-drinking endeavors, which, as any serious researcher knows, is a critical part of the research process.

Congrats Andy and Colin!

Junkyard Computing

With over 1.2 billion smartphones shipped in 2021, it’s clear that they are a ubiquitous part of our lives. Smartphones have a relatively short lifespan; the average upgrade cycle is two years. People replace them for different reasons — they want a better camera, newer software features, the screen becomes too broken to be usable, or the battery life doesn’t retain a charge. However, even if the screen is cracked or the battery life has diminished, the discarded devices can be repurposed to perform valuable computations.

The relative carbon costs for smartphones. Manufacturing or embodied carbon dominates, far surpassing the carbon associated with the energy required to power the device over its lifetime.

The rapid consumption of smartphones comes with significant environmental costs. Manufacturing smartphone computer chips is incredibly carbon-intensive. This embodied carbon outweighs the carbon costs of powering the smartphone over its entire lifetime. Repurposing smartphones to extend their life is critical to reducing their carbon footprint. 

The Junkyard Computing Project aims to repurpose these unwanted smartphones for useful computation. This computational stockpile represents a huge wasted potential; these smartphones have a high-performance and energy-efficient processor, extensive networking capabilities, and a reliable built-in power supply. This project gives a second life to older, discarded, idle smartphones.  The project’s research addresses critical technical questions of transforming a user-optimized, interactive device into a robust, reliable device capable of long-term, unattended operation.  It develops new metrics to capture manufacturing and operational carbon costs, couples these with economic models, and establishes a roadmap for the best opportunities for old electronic devices.  Finally, the project tests these ideas at scale to empirically establish how to use phones-as-compute and phones-as-sensors. We have shown how to repurpose smartphones as a web server for the project, as cloudlets for microservices for social media websites, and as wildlife monitoring sensors.

Jen Switzer‘s ASPLOS Lightning Talk

The project has gained a lot of attention. In the popular press, it had articles on Hacker News and Hackaday. Our ASPLOS paper has over 50,000 downloads making it the most downloaded paper in ASPLOS history (28 years). It was given a Distinguished Paper Award at ASPLOS. We were awarded a National Science Foundation grant as part of the Design for Environmental Sustainability in Computing program. A Google gift allows us to work closely with Dave Patterson, Herman Schmit, and other Googlers to develop racks of repurposed smartphones.

Finally, it should be noted that “Junkyard Computing” is the unofficial project name. The National Science Foundation politely asked us to remove “Junkyard Computing” from the title of that grant. Of course, we obliged. We wouldn’t want an overzealous senator to wrongly accuse us of wasting taxpayer money! We promise that we are spending US taxpayer dollars responsibly. Dave Patterson coined the name “Redundant Array of Inexpensive Smartphones (RAIS)” for cloud repurposing efforts. He didn’t think that “junkyard” was a good way to sell the project to Google’s upper management. Who are we to argue with a Turing Award winner and legendary acronym maker? Regardless of the name, our research will find new homes for powerful but unwanted smartphones and lead to a more holistic, carbon-centric view of computation


We had a busy, but enjoyable time at the International Symposium on FPGAs. It is always great to visit the beautiful Monterey Peninsula.

The festivities started on Sunday, when Dustin Richmond, Ryan Kastner, Jeff Goeders, and Mirjana Stojilović organized the Third Workshop on Security for Custom Computing Machines (SCCM) on Sunday. This hybrid event had 30+ people in person and another 30+ online. The presentations have all been posted on the SCCM website, which also has videos from last year. As part of this, Colin Drewes gave the first public presentation of our Pentimenti project, which describes a novel temporal analog side channel in FPGAs.

Point Lobos State National Reserve

On Monday, Colin presented his UCSD MS research developing a time-to-digital converter (TDC) for FPGA security applications. TDCs are common sensors for measuring the on-chip voltage and inferring behaviors of other system tenants. Our Tunable Dual-Polarity TDC (repo, paper) can hone in on important times in the computation, e.g., around clock transitions, and extract more information about co-tenant computations. The project was one of the three best paper nominations. Unfortunately, we did not get the best paper, but we are honored to be in the top three. The research was a strong, multi-university collaboration between UC Santa Cruz, UC San Diego, and Georgia Tech Research Institute. Congrats to all the authors!

On Tuesday, Olivia Weng presented her research on co-design optimizations for implementing neural networks on FPGAs. This research is part of the Tailor project, which performs network architecture modifications that remove or shorten skip connections to optimize on-chip memory architectures.

NSF CSGrad4US Fellowship

Andres (Andy) Meza was awarded a 2022 National Science Foundation Computer and Information Science and Engineering (CISE) Graduate Fellowship (CSGrad4US). CSGrad4US “aims to increase the number and diversity of domestic graduate students pursuing research and innovation careers.”

Andy is a Research and Development Staff in our group working on hardware security and ML hardware acceleration. He plays a critical role in much of our group’s research. These include hardware security verification projects with industry (Intel, Cycuity, OpenTitan, Leidos, the Semiconductor Research Corporation) and academia (Cynthia Sturton’s group and Calvin Deutschbein). As if this isn’t enough, he also works on the hls4ml project on topics related MLPerf Tiny benchmarks and fault tolerance. To date, he has seven(!) publications at top venues with several more in submission.

Andy started with our group as an undergraduate. After graduation, he continued working on research projects and moved into his R&D staff role. Andy is applying for Ph.D. programs and will undoubtedly continue his research career as a Ph.D. student starting next academic year. We hope he stays at UCSD!

Congrats Andy on this well-deserved honor!