Most DL side-channel defenses just trade leakage for throughput loss, and on accelerators that can be catastrophic. The survey should separate true architectural fixes from masking-and-noise theater, because the latter usually survives only in toy settings.

Masking on accelerators is brittle, the leakage just moves into DMA, caches, and tiling patterns.

Watching a supposedly sealed inference box, the part that kept leaking wasn’t the matmul kernel, it was the boring stuff around it, model load time, batch sizing, and how long the first request took after a cold start. We ended up treating weights like a key lifecycle problem, because once a model blob sits on disk, in RAM, then in a cache line, the “static asset” assumption stops helping fast. What I like about this survey is it pulls model, weights, and inputs apart instead of lumping everything into “the accelerator leaks”. In practice the ugly bug is usually that the mitigation story is split across teams, ML folks own throughput, platform owns the runtime, and nobody owns the path where the secret actually changes shape.