Spiking Neural Networks (SNN) are quickly gaining traction as a viable alternative to Deep Neural Networks (DNN). In comparison to DNNs, SNNs are more computationally powerful and provide superior energy efficiency. SNNs, while exciting at first appearance, contain security-sensitive assets (e.g., neuron threshold voltage) and vulnerabilities (e.g., sensitivity of classification accuracy to neuron threshold voltage change) that adversaries can exploit. We investigate global fault injection attacks by employing external power supplies and laser-induced local power glitches to corrupt crucial training parameters such as spike amplitude and neuron's membrane threshold potential on SNNs developed using common analog neurons. We also evaluate the impact of power-based attacks on individual SNN layers for 0% (i.e., no attack) to 100% (i.e., whole layer under attack). We investigate the impact of the attacks on digit classification tasks and find that in the worst-case scenario, classification accuracy is reduced by 85.65%. We also propose defenses e.g., a robust current driver design that is immune to power-oriented attacks, improved circuit sizing of neuron components to reduce/recover the adversarial accuracy degradation at the cost of negligible area and 25% power overhead. We also present a dummy neuron-based voltage fault injection detection system with 1% power and area overhead.
MRFI: An Open Source Multi-Resolution Fault Injection Framework for Neural Network Processing
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beijing Institute of Control Engineering（北京控制工程研究所）
We propose HASHTAG, the first framework that enables high-accuracy detection of fault-injection attacks on Deep Neural Networks (DNNs) with provable bounds on detection performance. Recent literature in fault-injection attacks shows the severe DNN accuracy degradation caused by bit flips. In this scenario, the attacker changes a few weight bits during DNN execution by tampering with the program's DRAM memory. To detect runtime bit flips, HASHTAG extracts a unique signature from the benign DNN prior to deployment. The signature is later used to validate the integrity of the DNN and verify the i…
Enhancing Neural Network Robustness Against Fault Injection Through Non-linear Weight Transformations
Kyushu Institute of Technology（九州工业大学）；Graduate School of Life Science and Systems（生命科学与系统研究生院）；Research Center for Neuromorphic AI Hardware（神经形态AI硬件研究中心）
Harden Deep Neural Networks Against Fault Injections Through Weight Scaling
Kyushu Institute of Technology（九州工业大学）；Graduate School of Life Science and Systems（生命科学与系统研究生院）；Research Center for Neuromorphic AI Hardware（神经形态人工智能硬件研究中心）
Machine Learning applications are acknowledged at the foundation of autonomous driving, because they are the enabling technology for most driving tasks. However, the inclusion of trained agents in automotive systems exposes the vehicle to novel attacks and faults, that can result in safety threats to the driv-ing tasks. In this paper we report our experimental campaign on the injection of adversarial attacks and software faults in a self-driving agent running in a driving simulator. We show that adversarial attacks and faults injected in the trained agent can lead to erroneous decisions and se…
The great quest for adopting AI-based computation for safety-/mission-critical applications motivates the interest towards methods for assessing the robustness of the application w.r.t. not only its training/tuning but also errors due to faults, in particular soft errors, affecting the underlying hardware. Two strategies exist: architecture-level fault injection and application-level functional error simulation. We present a framework for the reliability analysis of Convolutional Neural Networks (CNNs) via an error simulation engine that exploits a set of validated error models extracted from …
Analysis of LLM Vulnerability to GPU Soft Errors: An Instruction-Level Fault Injection Study
School of Computer Science (National Pilot Software Engineering School), Beijing University of Posts and Telecommunications（计算机学院（国家试点软件工程学院），北京邮电大学）；State Key Lab of Processors, Institute of Computing Technology, Chinese Academy of Sciences（处理器国家重点实验室，中国科学院计算技术研究所）
Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection
Faculty of Informatics and Information Technologies, Slovak University of Technology（信息与信息技术学院，斯洛伐克技术大学）；State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；TTControl GmbH
