Hu-Fu: Hardware and Software Collaborative Attack Framework Against Neural Networks

By Wenshuo Li, Jincheng Yu, Xuefei Ning, Pengjun Wang, Qi Wei, Yu Wang, Huazhong Yang. 2018

66 citations recorded by the source corpus.

Recently, Deep Learning (DL), especially Convolutional Neural Network (CNN), develops rapidly and is applied to many tasks, such as image classification, face recognition, image segmentation, and human detection. Due to its superior performance, DL-based models have a wide range of application in many areas, some of which are extremely safety-critical, e.g. intelligent surveillance and autonomous driving. Due to the latency and privacy problem of cloud computing, embedded accelerators are popular in these safety-critical areas. However, the robustness of the embedded DL system might be harmed by inserting hardware/software Trojans into the accelerator and the neural network model, since the accelerator and deploy tool (or neural network model) are usually provided by third-party companies. Fortunately, inserting hardware Trojans can only achieve inflexible attack, which means that hardware Trojans can easily break down the whole system or exchange two outputs, but can't make CNN recognize unknown pictures as targets. Though inserting software Trojans has more freedom of attack, it often requires tampering input images, which is not easy for attackers. So, in this paper, we propose a hardware-software collaborative attack framework to inject hidden neural network Trojans, which works as a back-door without requiring manipulating input images and is flexible for different scenarios. We test our attack framework for image classification and face recognition tasks, and get attack success rate of 92.6% and 100% on CIFAR10 and YouTube Faces, respectively, while keeping almost the same accuracy as the unattacked model in the normal mode. In addition, we show a specific attack scenario in which a face recognition system is attacked and gives a specific wrong answer.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Bo Li
2. Xiaojun Xu
3. Ben Y. Zhao
4. Haitao Zheng
5. Yuanshun Yao
6. Carl A. Gunter
7. Shiqing Ma
8. Nikita Borisov

In Hardware and Architecture

1. Bo Li
2. Ben Y. Zhao
3. Haitao Zheng

In Signal Processing

1. Bo Li
2. Nikita Borisov
3. Ben Y. Zhao
4. X. Zhang
5. Carl A. Gunter
6. Yingqi Liu
7. Shiqing Ma
8. Xiaojun Xu

Citations in the corpus

• Detecting AI Trojans Using Meta Neural Analysis (2019, background): “Thus, hardware Trojan attacks [16], [33] on neural networks are out of our scope.”
• Latent Backdoor Attacks on Deep Neural Networks (2019, background): “Another line of work directly tampers with the hardware a DNN model runs on [14, 27].”
• ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation (2019, background): “The work in [19, 34] trojans hardware that neural networks are running on.”