Hardware Trojan Attacks on Neural Networks

By Joseph Clements, Yingjie Lao. 2018

98 citations recorded by the source corpus.

With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illuminate these security issues by introducing hardware Trojan attacks on neural networks, expanding the current taxonomy of neural network security to incorporate attacks of this nature. To aid in this, we develop a novel framework for inserting malicious hardware Trojans in the implementation of a neural network classifier. We evaluate the capabilities of the adversary in this setting by implementing the attack algorithm on convolutional neural networks while controlling a variety of parameters available to the adversary. Our experimental results show that the proposed algorithm could effectively classify a selected input trigger as a specified class on the MNIST dataset by injecting hardware Trojans into $0.03\%$, on average, of neurons in the 5th hidden layer of arbitrary 7-layer convolutional neural networks, while undetectable under the test data. Finally, we discuss the potential defenses to protect neural networks against hardware Trojan attacks.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “Another line of work directly tampers with hardware the DNN is running on [30], [31].”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, background): “perturbation based techniques; data poisoning can be used to cause misintended model behaviors [39], and compromised hardware can also be used to insert trojans during the network inference procedure [9]. Akhtar et al. [1] provides a useful survey about the current state of the adversarial deep lear”
Detecting AI Trojans Using Meta Neural Analysis (2019, methodology): “Thus, hardware Trojan attacks [16], [33] on neural networks are out of our scope.”
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation (2019, background): “The work in [19, 34] trojans hardware that neural networks are running on.”
Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search (2019, background): “Neural network parameters have been attacked using different levels of hardware trojans, which require a specific pattern of input to trigger the trojan inside the network [7, 24].”
SentiNet: Detecting Physical Attacks Against Deep Learning Systems (2018, background): “Additionally, adversarial attacks certainly are not limited to gradient-perturbation based techniques; data poisoning can be used to cause misintended model behaviors [39], and compromised hardware can also be used to insert trojans during the network inference procedure [9].”