Function Recognition from Raw Power Side Channels in Bare-Metal Embedded Systems: Feasibility and Limits

Abstract Bare-metal microcontrollers underpin resource-constrained IoT, industrial, and cyber-physical systems, yet their lack of operating-system-level instrumentation limits runtime security visibility. This raises a fundamental question: how much security-relevant execution behavior can be recovered independently from the physical signals exposed by the device?We investigate whether selected C functions can be recognized directly from raw power traces of continuous, unmodified bare-metal workloads. Using an ARM Cortex-M4 platform and ChipWhisperer for power acquisition, we compare Transformer- and LSTM-based sequence-classification baselines with a parallel architecture of class-specific autoencoders operating directly on fixed-size power windows. The latter learns a separate reconstruction model and decision threshold for each function, enabling unrelated workload segments to be rejected rather than forcibly classified.For five retained functions (memcpy, memset, memmove, strncpy, and strncat), class-specific reconstruction provides the best observed operating point, achieving 96% TPR and 4% FNR at a 39.79% FPR. Across all evaluated architectures, malloc and strcpy remain difficult to distinguish because of, respectively, low intra-function signal variation and high inter-function similarity.These results establish both the feasibility and the physical limits of raw-power function recognition. Rather than a standalone vulnerability detector, the approach provides an external behavioral signal that can complement software-derived evidence in trustworthy embedded-system monitoring.