FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack
Convolutional Neural Networks (CNN) have shown impressive performance in computer vision, natural language processing, and many other applications, but they exhibit high computations and substantial memory requirements. To address these limitations, especially in resource-constrained devices, the us...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9514588/ |
| _version_ | 1818677151927369728 |
|---|---|
| author | Tolulope A. Odetola Faiq Khalid Hawzhin Mohammed Travis C. Sandefur Syed Rafay Hasan |
| author_facet | Tolulope A. Odetola Faiq Khalid Hawzhin Mohammed Travis C. Sandefur Syed Rafay Hasan |
| author_sort | Tolulope A. Odetola |
| collection | DOAJ |
| description | Convolutional Neural Networks (CNN) have shown impressive performance in computer vision, natural language processing, and many other applications, but they exhibit high computations and substantial memory requirements. To address these limitations, especially in resource-constrained devices, the use of cloud computing for CNNs is becoming more popular. This comes with privacy and latency concerns that have motivated the designers to develop embedded hardware accelerators for CNNs. However, designing a specialized accelerator increases the time-to-market and cost of production. Therefore, to reduce the time-to-market and access to state-of-the-art techniques, CNN hardware mapping and deployment on embedded accelerators are often outsourced to untrusted third parties, which is going to be more prevalent in futuristic artificial intelligence of things (AIoT) systems. These AIoT systems anticipates horizontal collaboration among different resource constrained AIoT node devices, where CNN layers are partitioned and these devices collaboratively compute complex CNN tasks. This horizontal collaboration opens another attack surface to the CNN-based application, like inserting the hardware Trojans (HT) into the embedded accelerators designed for the CNN. Therefore, there is a dire need to explore this attack surface for designing the secure embedded hardware accelerators for CNNs. Towards this goal, in this paper, we exploited this attack surface to propose an HT-based attack called FeSHI. Since in horizontal collaboration of RC AIoT devices different sections of CNN architectures are outsourced to different untrusted third parties, the attacker may not know the input image, but it has access to the layer-by-layer output feature maps information for the assigned sections of the CNN architecture. This attack exploits the statistical distribution, i.e., Gaussian distribution, of the layer-by-layer feature maps of the CNN to design two triggers for stealthy HT with a very low probability of triggering. Also three different novel, stealthy and effective trigger designs are proposed. To illustrate the effectiveness of the proposed attack, we deployed the LeNet and LeNet-3D on PYNQ to classify the MNIST and CIFAR-10 datasets, respectively, and tested FeSHI. The experimental results show that FeSHI utilizes up to 2% extra LUTs, and the overall resource overhead is less than 1% compared to the original designs. It is also demonstrated on the PYNQ board that FeSHI triggers the attack vary randomly making it extremely difficult to detect. |
| first_indexed | 2024-12-17T08:54:49Z |
| format | Article |
| id | doaj.art-829ea904532f4b6fa64a4ef46283d46e |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-17T08:54:49Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-829ea904532f4b6fa64a4ef46283d46e2022-12-21T21:55:58ZengIEEEIEEE Access2169-35362021-01-01911537011538710.1109/ACCESS.2021.31045209514588FeSHI: Feature Map-Based Stealthy Hardware Intrinsic AttackTolulope A. Odetola0Faiq Khalid1https://orcid.org/0000-0001-6263-674XHawzhin Mohammed2Travis C. Sandefur3Syed Rafay Hasan4https://orcid.org/0000-0003-0183-8086Department of Electrical and Computer Engineering, Tennessee Tech University, Cookeville, TN, USADepartment of Computer Engineering, Technische Universität Wien (TU Wien), Vienna, AustriaDepartment of Electrical and Computer Engineering, Tennessee Tech University, Cookeville, TN, USADepartment of Electrical and Computer Engineering, Tennessee Tech University, Cookeville, TN, USADepartment of Electrical and Computer Engineering, Tennessee Tech University, Cookeville, TN, USAConvolutional Neural Networks (CNN) have shown impressive performance in computer vision, natural language processing, and many other applications, but they exhibit high computations and substantial memory requirements. To address these limitations, especially in resource-constrained devices, the use of cloud computing for CNNs is becoming more popular. This comes with privacy and latency concerns that have motivated the designers to develop embedded hardware accelerators for CNNs. However, designing a specialized accelerator increases the time-to-market and cost of production. Therefore, to reduce the time-to-market and access to state-of-the-art techniques, CNN hardware mapping and deployment on embedded accelerators are often outsourced to untrusted third parties, which is going to be more prevalent in futuristic artificial intelligence of things (AIoT) systems. These AIoT systems anticipates horizontal collaboration among different resource constrained AIoT node devices, where CNN layers are partitioned and these devices collaboratively compute complex CNN tasks. This horizontal collaboration opens another attack surface to the CNN-based application, like inserting the hardware Trojans (HT) into the embedded accelerators designed for the CNN. Therefore, there is a dire need to explore this attack surface for designing the secure embedded hardware accelerators for CNNs. Towards this goal, in this paper, we exploited this attack surface to propose an HT-based attack called FeSHI. Since in horizontal collaboration of RC AIoT devices different sections of CNN architectures are outsourced to different untrusted third parties, the attacker may not know the input image, but it has access to the layer-by-layer output feature maps information for the assigned sections of the CNN architecture. This attack exploits the statistical distribution, i.e., Gaussian distribution, of the layer-by-layer feature maps of the CNN to design two triggers for stealthy HT with a very low probability of triggering. Also three different novel, stealthy and effective trigger designs are proposed. To illustrate the effectiveness of the proposed attack, we deployed the LeNet and LeNet-3D on PYNQ to classify the MNIST and CIFAR-10 datasets, respectively, and tested FeSHI. The experimental results show that FeSHI utilizes up to 2% extra LUTs, and the overall resource overhead is less than 1% compared to the original designs. It is also demonstrated on the PYNQ board that FeSHI triggers the attack vary randomly making it extremely difficult to detect.https://ieeexplore.ieee.org/document/9514588/Convolutional Neural NetworkCNNhardware securityedge intelligenceAIoTFPGA |
| spellingShingle | Tolulope A. Odetola Faiq Khalid Hawzhin Mohammed Travis C. Sandefur Syed Rafay Hasan FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack IEEE Access Convolutional Neural Network CNN hardware security edge intelligence AIoT FPGA |
| title | FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack |
| title_full | FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack |
| title_fullStr | FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack |
| title_full_unstemmed | FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack |
| title_short | FeSHI: Feature Map-Based Stealthy Hardware Intrinsic Attack |
| title_sort | feshi feature map based stealthy hardware intrinsic attack |
| topic | Convolutional Neural Network CNN hardware security edge intelligence AIoT FPGA |
| url | https://ieeexplore.ieee.org/document/9514588/ |
| work_keys_str_mv | AT tolulopeaodetola feshifeaturemapbasedstealthyhardwareintrinsicattack AT faiqkhalid feshifeaturemapbasedstealthyhardwareintrinsicattack AT hawzhinmohammed feshifeaturemapbasedstealthyhardwareintrinsicattack AT traviscsandefur feshifeaturemapbasedstealthyhardwareintrinsicattack AT syedrafayhasan feshifeaturemapbasedstealthyhardwareintrinsicattack |