Imperceptible Misclassification Attack on Deep Learning Accelerator by Glitch Injection

Abstract

Imperceptible misclassification attack on deep learning accelerator by glitch injection

Two Sides of the Same Coin: Boons and Banes of Machine Learning in Hardware Security

“…Moreover, the emerging heterogenous hardware platforms supported by the new paradigm of "model once, run optimized anywhere" AI compilers for deploying trained ML models on edge computing devices and the leasing of AI models on the cloud also open out an uncharted territory of security threats. The threat landscape does not preclude existing hardware-oriented attacks such as device reliability [17] [126] [127], malicious attack [21] [19] [22] and side-channel information leakage [26] [25] [27] from repurposing for ML systems.…”

“…Recently, a more stealthy fault injection attack was demonstrated on nine DNN models pre-trained on Imagenet dataset, namely Inception v1 to v4, MobileNet v1 and v2, DenseNet121, ResNet50 and VGG16, implemented on a Xilinx ZYNQ UltraScale+ MPSoC device [22]. Instead of targeting conventional temporal and instruction set based architectures or memory array, this attack exploits the separate clock domain used for DVFS and the DNN dataflow for abstracting the pre-trained models into the FPGA overlay of DNN hardware accelerator.…”

“…What make these adversarial attacks impractical are that they require a decent number of pristine samples of a target to be drawn from different realistic scenarios for generating a physical adversarial example and the generated adversarial example either has a large perturbation area or nonobjective shape [162]. Recently, the clock glitch injection technique [22] was extended to achieve stealthy and robust misclassification for target with variational viewpoints by deriving the attack patterns from only one sample of the target object in a fixed scene [23]. Two attack modes, namely Least Glitch Attack (LGA) and Sensitive Layer Attack (SLA), were derived.…”

“…Remote attacks can degrade the ML's prediction accuracy on a powerful server through malicious manipulation of model parameters stored in the off-chip memory [20]. On the edge computing platforms, laser beam interference [21] and glitch injections [22] [23] have been exploited to tamper the internal processing of a ML model, resulting in a successful misclassification of the target input. Other vicious goals such as stealing or reverse engineering the trained model architecture/weights and training data are often achieved through side-channel attacks or a combination of side-channel and fault injection attacks.…”

“…The errors aggregate as they propagate to the inference layer to cause a misclassification of the target. Once the glitch has subsided, the correct timing will be restored, leaving no trace for detection[22]. With no knowledge about the models, this attack can achieve over 98% of successful target misclassification on eight out of nine models with only ten percent glitches launched into the total computation clock cycles of one inference.…”