Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels