[Paper Review] Artificial Neural Networks and Fault Injection Attacks

Shahin Tajik, Fatemeh Ganji|arXiv (Cornell University)|Aug 17, 2020

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper investigates fault injection attacks on AI accelerators and neural network (NN) hardware, analyzing their vulnerabilities and comparing them to traditional cryptographic systems. It demonstrates that remote fault attacks—via voltage or clock glitching—can compromise NNs in multi-tenant environments like cloud FPGAs and shared CPUs/GPUs, exploiting shared power and memory resources to inject errors and bypass security mechanisms.

ABSTRACT

This chapter is on the security assessment of artificial intelligence (AI) and neural network (NN) accelerators in the face of fault injection attacks. More specifically, it discusses the assets on these platforms and compares them with ones known and well-studied in the field of cryptographic systems. This is a crucial step that must be taken in order to define the threat models precisely. With respect to that, fault attacks mounted on NNs and AI accelerators are explored.

Motivation & Objective

• To assess the threat of fault injection attacks on AI accelerators and neural network hardware.
• To identify and compare the assets protected in AI accelerators with those in traditional cryptographic hardware.
• To explore practical remote fault injection techniques targeting AI systems in cloud and edge environments.
• To evaluate the fault resilience of neural networks and its implications for securing fault-prone hardware primitives.
• To identify research gaps in securing AI accelerators against physical attacks and suggest future countermeasures.

Proposed method

• Analyzes threat models and assets in AI accelerators, focusing on neural network weights, biases, and inference data.
• Compares AI accelerator assets with those in cryptographic hardware to highlight differences in attack surface and value.
• Reviews existing fault injection techniques such as voltage glitching, clock glitching, and bit-flip attacks via hardware Trojans.
• Examines remote fault injection via shared infrastructure, including power distribution network (PDN) manipulation in multi-tenant FPGAs.
• Evaluates real-world attacks like RAM-Jam, Rowhammer, v0ltpwn, and clkscrew to demonstrate voltage and timing fault injection in cloud-based AI accelerators.
• Assesses the impact of fault injection on neural network inference by targeting weights and state transitions in hidden and output layers.

Experimental results

Research questions

• RQ1 What are the primary assets in AI accelerators that are vulnerable to fault injection attacks?
• RQ2 How do the threat models and assets in AI accelerators differ from those in traditional cryptographic hardware?
• RQ3 To what extent can fault injection attacks be performed remotely on AI accelerators in shared cloud environments?
• RQ4 How do hardware Trojans like RAM-Jam and power wasters enable remote fault injection in multi-tenant FPGAs?
• RQ5 Can the inherent fault tolerance of neural networks be leveraged to replace vulnerable hardware primitives for improved security?

Key findings

• Neural networks are not inherently fault-tolerant; fault tolerance must be designed into models, though some resilience exists in specific scenarios.
• Remote fault injection attacks are feasible on cloud-based AI accelerators via shared power and memory resources, even without direct physical access.
• Attacks like RAM-Jam and Rowhammer can induce voltage drops and bit flips in FPGAs and DRAM, respectively, causing timing faults in neural network computations.
• Power waster circuits based on ring-oscillators can induce localized overheating and voltage drops, enabling fault injection into neighboring IP cores on FPGAs.
• CPU and GPU-based AI accelerators in the cloud are vulnerable to remote fault injection via Rowhammer (DRAM bit flips), v0ltpwn (voltage manipulation), and clkscrew (clock frequency manipulation).
• The real-time, proprietary memory and core schedulers in GPUs introduce uncertainty, making fault injection more challenging and less predictable than on CPUs.