Lightweight Hybrid Side-Channel Anomaly Detection for Edge AI Accelerators: A Simulation-Based Machine Learning Study

Abstract

As Artificial Intelligence (AI) increasingly operates on resource-limited accelerators, the analysis of physical leakage and the possibility of hardware-level tampering becomes increasingly relevant. This paper presents a proof-of-concept simulation-based study of a lightweight hybrid approach to detecting Trojan activation, voltage glitching, clock glitching, and memory-bus probing. A physically parameterized synthetic dataset of 12,000 traces was generated using a combination of compute bursts, workload variation, measurement noise, and attack-specific perturbations. Fourteen low-cost time- and frequency-domain features were extracted from 256-sample windows. Logistic regression, random forest, gradient boosting, and radial-basis-function support vector machines were evaluated in single-model and fusion settings, with particular emphasis on a weighted probability combination. Using a 75/25 train/test split, the final hybrid model achieved 96.57% accuracy, 98.01% precision, 95.07% recall, 96.51% F1-score, and 0.9939 AU-ROC on the test set. On normal traces, the model demonstrated 98.07% specificity, while the attack-wise true-positive rates were 93.60% for Trojan activation, 89.33% for voltage glitches, 97.33% for clock glitches, and 100% for bus probing. The results indicate that a reduced set of statistical and spectral properties of power traces can facilitate hardware-level integrity screening. Extended physical-layer analysis using FPGA, GPU, and microcontroller platforms is recommended for future research.