Hu-Fu: Hardware and Software Collaborative Attack Framework against Neural Networks

Abstract

Recently, Deep Learning (DL), especially Convolutional Neural Network (CNN), develops rapidly and is applied to many tasks, such as image classification, face recognition, image segmentation, and human detection. Due to its superior performance, DL-based models have a wide range of application in many areas, some of which are extremely safety-critical, e.g. intelligent surveillance and autonomous driving. Due to the latency and privacy problem of cloud computing, embedded accelerators are popular in these safety-critical areas. However, the robustness of the embedded DL system might be harmed by inserting hardware/software Trojans into the accelerator and the neural network model, since the accelerator and deploy tool (or neural network model) are usually provided by third-party companies. Fortunately, inserting hardware Trojans can only achieve inflexible attack, which means that hardware Trojans can easily break down the whole system or exchange two outputs, but can't make CNN recognize unknown pictures as targets. Though inserting software Trojans has more freedom of attack, it often requires tampering input images, which is not easy for attackers. So, in this paper, we propose a hardware-software collaborative attack framework to inject hidden neural network Trojans, which works as a back-door without requiring manipulating input images and is flexible for different scenarios. We test our attack framework for image classification and face recognition tasks, and get attack success rate of 92.6% and 100% on CIFAR10 and YouTube Faces, respectively, while keeping almost the same accuracy as the unattacked model in the normal mode. In addition, we show a specific attack scenario in which a face recognition system is attacked and gives a specific wrong answer.

arXiv comment6 pages, 8 figures, 5 tables, accepted to ISVLSI 2018

References in corpus (10)

• Distilling the Knowledge in a Neural Network
• Binarized Neural Networks: Training Deep Neural Networks with Weights and Activations Constrained to +1 or -1
• DoReFa-Net: Training Low Bitwidth Convolutional Neural Networks with Low Bitwidth Gradients
• Do Deep Nets Really Need to be Deep?
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Poisoning Attacks against Support Vector Machines
• Pruning Filters for Efficient ConvNets
• Robust Physical-World Attacks on Deep Learning Models
• Channel Pruning for Accelerating Very Deep Neural Networks
• DSD: Dense-Sparse-Dense Training for Deep Neural Networks

Cited by in corpus (3)

• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• RED-Attack: Resource Efficient Decision based Attack for Machine Learning
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems