针对基于参数攻击的嵌入式神经网络激光注入评估
Evaluation of Parameter-based Attacks against Embedded Neural Networks with Laser Injection
AI总结：
本文首次在32位Cortex-M微控制器上利用激光故障注入成功实现了比特翻转攻击变体，并展示了仿真如何辅助选择最敏感的参数比特集合以评估嵌入式神经网络模型的鲁棒性。
摘要：
即将出台的与基于机器学习（ML）系统安全相关的认证行动引发了重大的评估挑战，而模型在众多硬件平台上的大规模部署进一步加剧了这一挑战。直到最近，大多数研究工作仍集中在基于API的攻击上，即将ML模型视为纯粹的算法抽象。然而，新的基于实现的威胁已被揭示，强调了提出实用和基于仿真的方法以正确评估模型鲁棒性的紧迫性。一个主要问题是基于参数的攻击（如比特翻转攻击，BFA），它突出了典型深度神经网络模型在面临对其存储在内存中的内部参数进行精确和最优更改时缺乏鲁棒性。出于安全测试目的，本研究首次在实践中报告了在32位Cortex-M微控制器上利用激光故障注入成功实现的一种BFA变体。这是一种用于安全评估的标准故障注入手段，能够注入空间和时间上精确的故障。为避免不切实际的暴力破解策略，我们展示了仿真如何帮助在考虑激光故障模型的情况下，从参数中选择最敏感的比特集合。
英文摘要：
Upcoming certification actions related to the security of machine learning (ML) based systems raise major evaluation challenges that are amplified by the large-scale deployment of models in many hardware platforms. Until recently, most of research works focused on API-based attacks that consider a ML model as a pure algorithmic abstraction. However, new implementation-based threats have been revealed, emphasizing the urgency to propose both practical and simulation-based methods to properly evaluate the robustness of models. A major concern is parameter-based attacks (such as the Bit-Flip Attack, BFA) that highlight the lack of robustness of typical deep neural network models when confronted by accurate and optimal alterations of their internal parameters stored in memory. Setting in a security testing purpose, this work practically reports, for the first time, a successful variant of the BFA on a 32-bit Cortex-M microcontroller using laser fault injection. It is a standard fault injection means for security evaluation, that enables to inject spatially and temporally accurate faults. To avoid unrealistic brute-force strategies, we show how simulations help selecting the most sensitive set of bits from the parameters taking into account the laser fault model.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
