Every computation leaves physical traces. A chip draws slightly different power, takes slightly different time and radiates slightly different electromagnetic signals depending on what it is processing. A side-channel attack measures those traces and works backwards to the data or secrets inside. Cryptographers have defended smart cards and payment terminals against it for decades.
AI on physical devices revives the problem. On a neuromorphic chip, a neuron that fires uses power, and when it fires depends on what the network has learned. Researchers at TU Munich used electromagnetic measurements to recover a spiking network’s parameters layer by layer. A recovered model is both stolen intellectual property and a map for crafting inputs that fool it.
The defences are physical as much as digital: shielding, noise and masking in the chip design, tamper-evident enclosures, and limiting who can get close enough to measure. If a device sits within public reach, assume someone can.