Hardware Trojan Attacks on Neural Networks

Abstract

With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illuminate these security issues by introducing hardware Trojan attacks on neural networks, expanding the current taxonomy of neural network security to incorporate attacks of this nature. To aid in this, we develop a novel framework for inserting malicious hardware Trojans in the implementation of a neural network classifier. We evaluate the capabilities of the adversary in this setting by implementing the attack algorithm on convolutional neural networks while controlling a variety of parameters available to the adversary. Our experimental results show that the proposed algorithm could effectively classify a selected input trigger as a specified class on the MNIST dataset by injecting hardware Trojans into $0.03\%$, on average, of neurons in the 5th hidden layer of arbitrary 7-layer convolutional neural networks, while undetectable under the test data. Finally, we discuss the potential defenses to protect neural networks against hardware Trojan attacks.

References in corpus (7)

• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Spatially Transformed Adversarial Examples
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• DeepDriving: Learning Affordance for Direct Perception in Autonomous Driving
• Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features

Cited by in corpus (17)

• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attacks
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
• FeSHI: Feature Map Based Stealthy Hardware Intrinsic Attack
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems
• Backdoor Attacks to Graph Neural Networks
• TBT: Targeted Neural Network Attack with Bit Trojan
• A Stealthy Hardware Trojan Exploiting the Architectural Vulnerability of Deep Learning Architectures: Input Interception Attack (IIA)
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks
• Trustworthy AI Inference Systems: An Industry Research View
• Exposing the Robustness and Vulnerability of Hybrid 8T-6T SRAM Memory Architectures to Adversarial Attacks in Deep Neural Networks
• Live Trojan Attacks on Deep Neural Networks
• How Secure is Distributed Convolutional Neural Network on IoT Edge Devices?
• PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks
• S4oC: A Self-optimizing, Self-adapting Secure System-on-Chip Design Framework to Tackle Unknown Threats -- A Network Theoretic, Learning Approach