[论文解读] Hardware Trojan Attacks on Neural Networks

Joseph Clements, Yingjie Lao|arXiv (Cornell University)|Jun 14, 2018

Adversarial Robustness in Machine Learning参考文献 31被引用 64

一句话总结

本文介绍了对神经网络的硬件木马攻击，给出在 NN 硬件中插入恶意木马的框架，并展示在 MNIST 上通过影响7层CNN第5隐藏层约0.03%神经元的木马实现隐蔽的定向错误分类。

ABSTRACT

With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illuminate these security issues by introducing hardware Trojan attacks on neural networks, expanding the current taxonomy of neural network security to incorporate attacks of this nature. To aid in this, we develop a novel framework for inserting malicious hardware Trojans in the implementation of a neural network classifier. We evaluate the capabilities of the adversary in this setting by implementing the attack algorithm on convolutional neural networks while controlling a variety of parameters available to the adversary. Our experimental results show that the proposed algorithm could effectively classify a selected input trigger as a specified class on the MNIST dataset by injecting hardware Trojans into $0.03\%$, on average, of neurons in the 5th hidden layer of arbitrary 7-layer convolutional neural networks, while undetectable under the test data. Finally, we discuss the potential defenses to protect neural networks against hardware Trojan attacks.

研究动机与目标

• 激发并形式化神经网络实现中的硬件木马安全问题。
• 开发一个框架，将恶意硬件木马注入到 NN 分类器中。
• 通过在卷积神经网络上实现攻击来评估对手的能力。
• 量化木马在 MNIST 上以最少神经元参与实现定向分类的能力。

提出的方法

• 为将恶意硬件木马注入神经网络分类器创建新框架。
• 在具有可控对手参数的卷积神经网络上实现攻击算法。
• 证明选定的触发器可以在 MNIST 上导致指定类别。
• 结果显示木马平均影响7层 CNN的第5隐藏层约0.03% 的神经元。
• 在测试数据下评估可检测性并讨论防御选项。

实验结果

研究问题

• RQ1 是否可以在神经网络硬件中嵌入硬件木马而在常规测试中不被检测？
• RQ2 要强制定向错误分类，必须损坏的神经元的比例和位置是多少？
• RQ3 在典型的 CNN 架构（如7层CNN）对 MNIST 的硬件木马攻击有多有效？
• RQ4 哪些防御措施可以降低神经网络硬件实现中的硬件木马威胁？

主要发现

• 攻击可以将选定的输入触发器分类为 MNIST 上的指定类别。
• 注入到任意7层CNN的第5隐藏层约0.03%神经元的木马可实现平均定向错误分类。
• 木马活动在评估所用的测试数据下保持不可检测。
• 本文讨论了针对神经网络中的硬件木马攻击的潜在防御方法。