Evil from Within: Machine Learning Backdoors Through Dormant Hardware Trojans
Alexander Warnecke, Julian Speith, Jan-Niklas Möller, Konrad Rieck, Christof Paar · 2024
Backdoors pose a severe threat to machine learning, as they can compromise the integrity of security-critical systems, such as self-driving cars. While different defenses have been proposed to address this threat, they all rely on the assumption that the hardware accelerator executing a learning model is trusted. This paper challenges this assumption and investigates a backdoor attack that completely resides within such an accelerator. Outside of the hardware, neither the learning model nor the software is manipulated so that current defenses fail. As memory on a hardware accelerator is limited, we utilize minimal backdoors that deviate from the original model by a few model parameters only. To mount the backdoor, we develop a hardware trojan that lays dormant until it is programmed after in-field deployment. The trojan can be provisioned with the minimal backdoor and performs a parameter replacement only when the target model is processed. We demonstrate the feasibility of our attack by implanting our hardware trojan into a commercial machine-learning accelerator and programming it with a minimal backdoor for a traffic-sign recognition system. The backdoor affects only 30 model parameters (0.069%) with a backdoor trigger covering 6.25% of the input image, yet it reliably manipulates the recognition once the input contains a backdoor trigger. Our attack expands the circuit size of the accelerator by only 0.24% and does not increase the run-time, rendering detection hardly possible. Given the distributed hardware manufacturing process, our work points to a new threat in machine learning that currently eludes security mechanisms.