Abstract:Deep neural network (DNN) accelerators overcome the power and memory walls for executing neural-net models locally on edge-computing devices to support sophisticated AI applications. The advocacy of “model once, run optimized anywhere” paradigm introduces potential new security threat to edge intelligence that is methodologically different from the well-known adversarial examples. Existing adversarial examples modify the input samples presented to an AI application either digitally or physically to cause a misclassification. Nevertheless, these input-based perturbations are not robust or surreptitious on multi-view target. To generate a good adversarial example for misclassifying a real-world target of variational viewing angle, lighting and distance, a decent number of target’s samples are required to extract the rare anomalies that can cross the decision boundary. The feasible perturbations are substantial and visually perceptible. In this paper, we propose a new glitch injection attack on DNN accelerator that is capable of misclassifying a target under variational viewpoints. The glitches injected into the computation clock signal induce transitory but disruptive errors in the intermediate results of the multiply-and-accumulate (MAC) operations. The attack pattern for each target of interest consists of sparse instantaneous glitches, which can be derived from just one sample of the target. Two modes of attack patterns are derived, and their effectiveness are demonstrated on four representative ImageNet models implemented on the Deep-learning Processing Unit (DPU) of FPGA edge and its DNN development toolchain. The attack success rates are evaluated on 118 objects in 61 diverse sensing conditions, including 25 viewing angles (−60° to 60°), 24 illumination directions and 12 color temperatures. In the covert mode, the success rates of our attack exceed existing stealthy adversarial examples by more than 16.3%, with only two glitches injected into ten thousands to a million cycles for one complete inference. In the robust mode, the attack success rates on all four DNNs are more than 96.2% with an average glitch intensity of 1.4% and a maximum glitch intensity of 10.2%.

An Energy-Efficient Neural Network Accelerator With Improved Resilience Against Fault Attacks

A Near Memory Computing FPGA Architecture for Neural Network Acceleration

RescueSNN: Enabling Reliable Executions on Spiking Neural Network Accelerators under Permanent Faults

Imperceptible Misclassification Attack on Deep Learning Accelerator by Glitch Injection

A Deep Investigation on Stealthy DVFS Fault Injection Attacks at DNN Hardware Accelerators

Efficient Error-Tolerant Quantized Neural Network Accelerators

SoftSNN: Low-Cost Fault Tolerance for Spiking Neural Network Accelerators under Soft Errors

Stealthy and Robust Glitch Injection Attack on Deep Learning Accelerator for Target with Variational Viewpoint.

An Efficient and Reliable Negative Margin Timing Error Detection for Neural Network Accelerator Without Accuracy Loss in 28nm CMOS

Algorithmic Strategies for Sustainable Reuse of Neural Network Accelerators with Permanent Faults

Towards Reliable AI Applications Via Algorithm-Based Fault Tolerance on NVDLA

FTT-NAS: Discovering Fault-Tolerant Convolutional Neural Architecture

NeuralFuse: Learning to Recover the Accuracy of Access-Limited Neural Network Inference in Low-Voltage Regimes

Implementation of Highly Reliable Convolutional Neural Network with Low Overhead on Field-Programmable Gate Array

Evaluating Built-in ECC of FPGA on-chip Memories for the Mitigation of Undervolting Faults

Analyzing the Single Event Upset Vulnerability of Binarized Neural Networks on SRAM FPGAs

Efficient Neural Networks on the Edge with FPGAs by Optimizing an Adaptive Activation Function

Utilizing Dual-Port FeFETs for Energy-Efficient Binary Neural Network Inference Accelerators

A 28-Nm 198.9-TOPS/W Fault-Tolerant Stochastic Computing Neural Network Processor

Exploring Fault-Energy Trade-offs in Approximate DNN Hardware Accelerators

Functional Criticality Classification of Structural Faults in AI Accelerators