Can a laser read the thoughts of an edge AI chip?

A laser beam focused on a running chip can reveal what the chip is thinking. The technique is called laser voltage imaging, and it turns tiny fluctuations in transistor voltage into visible light patterns.

Submitted to arXiv on 26 Aug 2026, the work comes from seven authors across multiple institutions. They call their method LLMscope.

Why edge inference creates a physical target

Large language models used to live in data centers behind locked doors and network firewalls. Now manufacturers push inference onto edge accelerators — chips inside phones, cameras, industrial controllers, and vehicles. Those chips must load model parameters and intermediate states into on-chip memory again and again during every forward pass. Each load and compute cycle creates a physical signal. The signal is small, but it is there.

Edge accelerators reuse the same buffers and compute subcircuits across addresses, tiles, modules, and layers. This reuse is a design choice for area and power efficiency. It also means the same physical wires carry different logical values at different times. If you can watch those wires at the right moments, you see the values.

How the laser sees inside

Laser voltage imaging scans a focused beam across the die while the chip operates. Transistors switching at gigahertz rates modulate the reflected light. A sensitive detector captures the modulation. The result is a movie of voltage activity with sub-micron spatial resolution and picosecond timing.

The team pointed this microscope at an FPGA-based LLM accelerator. They probed localized memories and compute subcircuits during inference. From the resulting traces they extracted embeddings, attention patterns, quantized MLP weights, activations, and other inference states. Full recovery of the targeted values was demonstrated.

The attack does not require decapping the package in all cases. Modern packages with thin substrates or flip-chip layouts can transmit enough light for the technique to work. Package types tested are not specified in the document.

Scaling the effort

Reading every bit one by one would take forever. The authors derive lower bounds that relate imaging effort to asset dimensions. Direct recovery scales linearly with the size of the targeted asset. A larger model means proportionally more laser scans.

A methodology to recover asset values even if some weights or bits remain unread is also established. The redundancy and structure of quantized neural networks make this possible. Missing pieces can be inferred from the surrounding context, similar to error correction in a noisy channel.

Total attack time for a full model is not reported. No comparison against other side-channel methods such as power analysis or electromagnetic probing appears. Countermeasures are not discussed.

What this means for a device owner

If you own a device that runs an LLM on an edge accelerator, the model weights and your inference data are physically present on that chip during every query. A determined adversary with access to the hardware and a laser voltage imaging setup — equipment that exists in university labs and some commercial failure-analysis facilities — can extract those assets. The attack leaves no log entry. It does not trigger software alarms.

The research shows the vulnerability exists. It does not show how widespread the required equipment is, nor how many deployed devices are actually exposed. It does not say whether any product has been attacked in the wild.

Where the explanation stops

The concept is proven on one FPGA-based accelerator. ASIC accelerators, GPUs, or NPUs from major vendors are not tested. Signal-to-noise ratio needed for each asset type is not quantified. A complete recipe — alignment, focus, synchronization, and data processing steps — is summarized, not enumerated. Anyone attempting to replicate would need to fill in those gaps.

The linear scaling law is a lower bound. Real-world noise, packaging variations, and on-chip noise sources could make the effort higher. Those factors are not characterized.

This work opens a research direction. It does not close it.