ModelSpy is a credible physical-layer attack on frontier AI. Defensive assumptions are behind the curve.

By Luigi Caramico, Founder & CTO, DataKrypto

 

Researchers at KAIST have shown that an antenna and electromagnetic receiver, both small enough to fit in a 20-liter backpack, can reconstruct key architectural details of an AI model running on a GPU on the other side of a concrete wall, with 97.6% accuracy on layer segmentation and 94.2% accuracy on hyperparameters. The attack works at roughly six meters and has been demonstrated through common building materials including glass, wood, and concrete. The equipment is commercially available.

What the researchers recovered was not model weights or training data. It was the model’s architecture: the layer topology, routing structure, and per-layer hyperparameters that encode much of a modern model’s design logic. The technique, called ModelSpy, was presented at NDSS 2026 by Prof. Han Jun of KAIST with collaborators at the National University of Singapore and Zhejiang University, and it won a Distinguished Paper Award.

EM side-channel work against neural network hardware has existed for years. ModelSpy advances the state of the art in range, target hardware, and reconstruction quality through an end-to-end learned pipeline that maps captured electromagnetic emissions to architectural inference.

My first read of the paper was not as the CTO of a security company. It was as someone who used to do offensive work for a living and still finds attack papers more interesting than defense papers. The KAIST result is excellent attacker thinking. Defensive assumptions have not yet adapted to this class of leakage.

That gap matters more than the attack’s current limitations suggest.

The attack is passive. The antenna sits in an adjacent space, records electromagnetic emissions from the GPU during execution, and a separate analysis pipeline reconstructs the architecture offline. The target system continues to operate normally, and the operator has no obvious way to know the capture occurred.

Why Architecture Matters

The most important finding in the paper is not the 97.6% accuracy number. It is what the authors do with the recovered architecture.

They build a surrogate model from the reconstructed architecture and use it to launch adversarial-example attacks against the real target. The gap between attacks built using the estimated architecture and attacks built using full white-box knowledge averaged only a few percentage points. For practical purposes, architecture recovery significantly narrows the gap between black-box and white-box attacks against a model the attacker has never directly accessed.

For frontier AI firms, architecture secrecy is no longer merely an academic concern; it is increasingly part of enterprise value itself. Hyperparameter choices, normalization placement, routing topology, attention configuration, depth-width tradeoffs, and execution structure often represent years of experimentation and massive infrastructure investment.

ModelSpy demonstrates that much of that structure may be inferable remotely against commodity hardware.

The resulting risk chain is direct:

• Architecture recovery enables surrogate-model construction, which lowers the cost of downstream extraction, adversarial, and membership-inference attacks against the original model.
• Side-channel attacks also tend to improve over time. Cache-timing research evolved from academic demonstrations into operational exploitation over the course of years. The trajectory may not repeat identically here, but the historical pattern is difficult to ignore.

What Current Defenses Miss

Trusted Execution Environments — including NVIDIA Confidential Computing across the latest GPU generation and the broader confidential-computing ecosystem — are designed primarily to defend against privileged software adversaries. They encrypt memory in motion, attest runtime integrity, and reduce exposure to operators outside the enclave. Those are important protections for the threat models they were built to address.

But they do not prevent observation of the physical emissions generated while the GPU executes the workload.

Confidential computing protects data at rest and in transit; it does not change the fact that the GPU must still operate on plaintext during computation. That plaintext compute window is exactly what ModelSpy’s emanation channel reads, and no confidential-computing implementation currently shipping closes it.

Encrypted memory buses still produce observable access behavior. Scheduling still produces timing structure. The hardware still emits electromagnetic leakage correlated with execution.

The paper’s proposed mitigations — EM jamming and decoy computations — are legitimate research directions, but operationally difficult to deploy at scale. Broadband jamming can interfere with nearby wireless infrastructure, while decoy computation increases utilization overhead in environments where GPU efficiency directly impacts economics.

Hardware redesign may eventually reduce leakage, but infrastructure replacement cycles are measured in years, and existing deployments cannot be retrofitted overnight.

Physical perimeter controls help, but maintaining meaningful EM exclusion zones across modern multi-tenant facilities is difficult in practice. The attack was demonstrated through common building materials at non-trivial distance using commercially available equipment.

No currently available mitigation is both operationally practical and complete against this leakage channel.

What Changes the Equation

ModelSpy works because the execution signatures of plaintext models are stable and distinguishable enough for a trained reconstruction pipeline to map captured emissions to architectural features.

The attack pipeline is not deriving architecture deterministically from physics alone. It is a supervised inference system trained on labeled execution traces generated from known architectures, and its accuracy depends on the target signatures resembling what the reconstruction system has previously observed.

This assumption is fragile in two distinct ways.

The first is novelty.

The reconstruction system was trained on a finite set of known architectures and execution distributions. A frontier model that pushes into genuinely new territory — unusual layer orderings, hidden dimensions or context lengths beyond what the pipeline observed during training, operations at scales it never saw — is already out of distribution before any additional defensive measure is applied.   The same operations executed at different scales shift the signal one way. Different execution ordering shifts it another. These are orthogonal axes of displacement, and the reconstruction pipeline has no clean method for disentangling them from the captured trace.

The second destabilizer is encrypted execution.

An encrypted model is still subject to electromagnetic emissions — the GPU still dispatches operations, still accesses memory, and still radiates. But the signatures presented to the reconstruction pipeline are no longer the same signatures it was trained on. The operations remain related to their plaintext counterparts, but the emitted patterns are no longer identical, and previously learned mappings can no longer be assumed to remain valid.

These effects compound. They do not simply add; they multiply, because each shifts the input distribution along a different axis and the reconstruction pipeline has no reliable method to disentangle them from the captured signal.

In a side-channel pipeline already operating near the edge of reliability, adding orthogonal sources of uncertainty can be enough to push the equation from difficult to unreliable, and from unreliable to unresolvable.

Even setting aside degraded reconstruction accuracy, a deeper operational problem remains for the attacker.

ModelSpy recovers architecture, not weights.

The attacker can describe the topology they believe they observed, but cannot instantiate a functioning model from it.

In plaintext environments, attackers can sometimes compensate for this limitation by starting from a publicly available base model, applying hypothesized modifications, instrumenting the target, probing behavioral similarity, testing adversarial transferability, and iteratively refining the reconstruction until the surrogate converges.

Against encrypted execution environments, that feedback loop largely disappears.

The target cannot be meaningfully instrumented, queried, or behaviorally aligned in a way that confirms the reconstruction. The attacker is left holding a blueprint they have no reliable way to verify against the building itself.

Why This Matters in Practice

The implications extend beyond academia. Cloud providers are investing heavily in sovereign AI infrastructure because governments and enterprises increasingly require guarantees about where models execute, who operates the infrastructure, and who can access sensitive workloads. Hardware vendors are simultaneously expanding confidential-computing capabilities into GPU infrastructure. Frontier model developers face a different pressure curve: their systems increasingly represent core enterprise value, and architecture secrecy is becoming part of the competitive moat itself.

ModelSpy highlights a different threat category than most confidential-computing initiatives were originally designed for. The hardware itself becomes an observable side channel during execution, and physical-layer attacks extend the confidential-AI problem further than many organizations have modeled.

The historical analogy is imperfect, but useful. Early internet infrastructure assumed trusted networks and plaintext communication by default. HTTPS was once considered operationally expensive and necessary only for sensitive transactions.

Over time, that assumption collapsed. The modern internet now treats encrypted transport as baseline infrastructure because the network itself is no longer considered trustworthy.

AI infrastructure may be approaching a similar transition. Frontier AI systems still often execute under the assumption that the machine running the workload is a fundamentally safe place to keep models, intermediate computations, embeddings, and proprietary data. The combination of sovereign AI requirements, confidential-computing adoption, and emerging side-channel research suggests that assumption is weakening.

This changes procurement and infrastructure decisions, particularly for sovereign, regulated, and multi-tenant AI deployments.

FHEnom and Encrypted Execution

At DataKrypto, our FHEnom platform is designed around continuous encrypted execution for AI workloads, keeping models, prompts, intermediate computations, and GPU-resident execution state protected throughout processing rather than exposing them during runtime.

In benchmarks performed by an independent hardware partner, FHEnom delivered transformer inference performance indistinguishable from plaintext execution on identical GPU hardware.

The important question, however, is empirical.

The cleanest next step would be for the original research group, or another competent side-channel laboratory, to run the published ModelSpy capture-and-analysis pipeline directly against encrypted execution environments and measure whether reconstruction accuracy materially degrades.

The relevant questions are straightforward:

• Does layer-segmentation accuracy collapse?
• Do hyperparameter recovery rates become statistically unreliable?
• Does surrogate-model transferability degrade meaningfully compared to plaintext execution?

We would welcome that measurement.

If the hypothesis holds, encrypted execution becomes a demonstrated mitigation against this class of side-channel inference.

If it fails, the field learns something important about the limitations of encrypted execution against physical-layer attacks.

Either outcome advances AI security research.

Why This Matters Now

ModelSpy moves encrypted execution from a long-term strategic concept into a near-term operational question.

The broader market is already moving toward confidential AI infrastructure. But most current approaches focus primarily on defending against privileged software adversaries and infrastructure trust boundaries.

ModelSpy demonstrates that the execution hardware itself may become part of the attack surface.

Frontier AI systems increasingly carry the value of the companies building them. The assumption that execution environments are trustworthy becomes harder to defend each year. ModelSpy may not be the final form of physical-layer attacks against AI infrastructure, but it is a credible signal of where the threat model is heading.