[Paper Review] Hardware Trojan Attacks on Neural Networks

Joseph Clements, Yingjie Lao|arXiv (Cornell University)|Jun 14, 2018

Adversarial Robustness in Machine LearningComputer Science31 references64 citations

TL;DR

The paper introduces hardware Trojan attacks on neural networks, outlining a framework to insert malicious Trojans into NN hardware and demonstrates covert targeted misclassification on MNIST using Trojans affecting 0.03% of neurons in the 5th hidden layer of a 7-layer CNN.

ABSTRACT

With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illuminate these security issues by introducing hardware Trojan attacks on neural networks, expanding the current taxonomy of neural network security to incorporate attacks of this nature. To aid in this, we develop a novel framework for inserting malicious hardware Trojans in the implementation of a neural network classifier. We evaluate the capabilities of the adversary in this setting by implementing the attack algorithm on convolutional neural networks while controlling a variety of parameters available to the adversary. Our experimental results show that the proposed algorithm could effectively classify a selected input trigger as a specified class on the MNIST dataset by injecting hardware Trojans into $0.03\%$, on average, of neurons in the 5th hidden layer of arbitrary 7-layer convolutional neural networks, while undetectable under the test data. Finally, we discuss the potential defenses to protect neural networks against hardware Trojan attacks.

Motivation & Objective

• Motivate and formalize the security issue of hardware Trojans in neural network implementations.
• Develop a framework to insert malicious hardware Trojans into NN classifiers.
• Evaluate the adversary’s capability by implementing the attack on convolutional neural networks.
• Quantify how Trojans can induce a targeted classification on MNIST with minimal neuron involvement.

Proposed method

• Create a novel framework for inserting malicious hardware Trojans into neural network classifiers.
• Implement the attack algorithm on convolutional neural networks with controllable adversary parameters.
• Demonstrate that a selected trigger can cause a specified class on MNIST.
• Show that the Trojan affects about 0.03% of neurons in the 5th hidden layer of a 7-layer CNN on average.
• Assess detectability under test data and discuss defense options.

Experimental results

Research questions

• RQ1 Can hardware Trojans be embedded in neural network hardware without detection during standard testing?
• RQ2 What fraction and location of neurons must be compromised to force a targeted misclassification?
• RQ3 How effective are hardware Trojan attacks across typical CNN architectures (e.g., 7-layer CNN) on MNIST?
• RQ4 What defenses can mitigate hardware Trojan threats in NN hardware implementations.

Key findings

• The attack can classify a selected input trigger as a specified class on MNIST.
• Trojans injected into 0.03% of neurons in the 5th hidden layer of arbitrary 7-layer CNNs can achieve targeted misclassification on average.
• Trojan activity remains undetectable under the test data used in evaluation.
• The paper discusses potential defense approaches against hardware Trojan attacks in neural networks.