Feshi: Feature Map-Based Stealthy Hardware Intrinsic Attack
Total Page:16
File Type:pdf, Size:1020Kb
Date of publication August 16, 2021, date of current version August 24, 2021. Digital Object Identifier 10.1109/ACCESS.2021.3104520 FeSHI: Feature Map-based Stealthy Hardware Intrinsic Attack TOLULOPE A. ODETOLA1, FAIQ KHALID2, (Member, IEEE), HAWZHIN MOHAMMED1, TRAVIS C. SANDEFUR1, SYED RAFAY HASAN1, (Member, IEEE) 1Department of Electrical and Computer Engineering, Tennessee Technological University, Cookeville, TN, 38505, USA 2Department of Computer Engineering, Technische Universität Wien (TU Wien), Vienna, Austria This work is partially supported by the Carnegie Classification Funding from College of Engineering, and by the Faculty Research Grant from the Office of Research, Tennessee Tech University. ABSTRACT Convolutional Neural Networks (CNN) have shown impressive performance in computer vision, natural language processing, and many other applications, but they exhibit high computations and substantial memory requirements. To address these limitations, especially in resource-constrained devices, the use of cloud computing for CNNs is becoming more popular. This comes with privacy and latency concerns that have motivated the designers to develop embedded hardware accelerators for CNNs. However, designing a specialized accelerator increases the time-to-market and cost of production. Therefore, to reduce the time-to-market and access to state-of-the-art techniques, CNN hardware mapping and deployment on embedded accelerators are often outsourced to untrusted third parties, which is going to be more prevalent in futuristic artificial intelligence of things (AIoT) systems. These AIoT systems anticipates horizontal collaboration among different resource constrained AIoT node devices, where CNN layers are partitioned and these devices collaboratively compute complex CNN tasks. This horizontal collaboration opens another attack surface to the CNN-based application, like inserting the hardware Trojans (HT) into the embedded accelerators designed for the CNN. Therefore, there is a dire need to explore this attack surface for designing the secure embedded hardware accelerators for CNNs. Towards this goal, in this paper, we exploited this attack surface to propose an HT-based attack called FeSHI. Since in horizontal collaboration of RC AIoT devices different sections of CNN architectures are outsourced to different untrusted third parties, the attacker may not know the input image, but it has access to the layer-by-layer output feature maps information for the assigned sections of the CNN architecture. This attack exploits the statistical distribution, i.e., Gaussian distribution, of the layer-by-layer feature maps of the CNN to design two triggers for stealthy HT with a very low probability of triggering. Also three different novel, stealthy and effective trigger designs are proposed. To illustrate the effectiveness of the proposed attack, we deployed the LeNet and LeNet-3D on PYNQ to classify the MNIST and CIFAR-10 datasets, respectively, and tested FeSHI. The experimental results show that FeSHI utilizes up to 2% extra LUTs, and the overall resource overhead is less than 1% arXiv:2106.06895v3 [cs.CR] 25 Aug 2021 compared to the original designs. It is also demonstrated on the PYNQ board that FeSHI triggers the attack vary randomly making it extremely difficult to detect. INDEX TERMS Convolutional Neural Network, CNN, Hardware Security, Edge Intelligence, AIoT, FPGA, Hardware Trojan, Hardware Intrinsic Attack I. INTRODUCTION ficient deployment of CNNs on small-scale FPGAs. There- Due to design flexibility through partial reconfiguration [1]– fore, to achieve resource efficiency, short time-to-market, [5] and fast prototyping [6] [7], small-scale Field Pro- and state-of-the-art implementation, the deployment of pre- grammable Gate Arrays (FPGAs) [8] are being used to de- trained CNN on hardware accelerators can be outsourced to ploy Convolutional Neural Networks (CNNs) on Resource- untrusted third parties, which provide soft IPs or hard IPs (in Constrained (RC) devices in Artificial Intelligence of Things the form of bitstream files) of the deployed CNN. Although (AIoT), especially for Edge Intelligence (EI) based appli- outsourcing the CNN deployment achieves the required goal, cations [9]. However, it is very challenging to achieve ef- it comes with security risks such as malicious hardware VOLUME 9, 2021 1 Tolulope et al.: FeSHI: Feature Map-based Stealthy Hardware Intrinsic Attack insertions, which can be stealthy by nature [10]. Data Single FPGA-bases CNN Inference Recently, various hardware Trojans (HTs) insertion tech- All Layers of the CNN are mapped on a single FPGA Conv 1 … niques in CNNs have been explored, but most of them are Data Conv 2 IP 2 applicable under the following assumptions: Pool 1 Conv 1 Pool 2 Conv n Prob • These techniques require full access to the CNN architec- Conv 2 ture to evaluate triggering probability, stealthiness, and re- Pool 1 Conv 3 IP 1 source utilization (comparing them with design constraints Pool 2 FPGA of their attacks [11]–[13]). Conv 3 Multi-FPGA-bases CNN Inference • Few of the techniques require a pre-defined sequence, … Different Layer(s) are mapped on a different small-scale FPGAs where a sequence of events serves as the trigger for the FPGA1 FPGA2 FPGA3…(n-1) FPGAn Conv n attack [15]. This sequence of events also requires knowl- Data Conv 2 … IP 1 edge of the full CNN architecture, and in the absence of of CNN Implementation Full IP 1 Conv 1 Pool 2 IP 2 information about any layer, especially the initial layer and/or the last layer, there is a high probability that the IP 2 Pool 1 Conv 3 Conv n Prob Prob sequence of events may never occur. Designer_1 Designer_2 Designer_3… Designer_n • Some of the techniques require weight manipulation, FIGURE 1: A figurative comparison between single FPGA-based which requires a change in the values of the weights of CNN inference and multi-FPGA-based CNN. In single FPGA-based the CNN to achieve misclassification that can easily be inference, all CNN layers are implemented on an FPGA, and the detected using model integrity analysis [14], [16]. attacker has access to the complete CNN architecture. On the other hand, in multi-FPGA-based inference, full CNN is divided into multiple • Another work requires knowledge of input dataset or ac- different partitions, where different third-party IP designers can design cess to the input image to introduce the trigger [14]. each partition. These partitions can be mapped on multiple FPGAs. • In [12], Clements et al. modify the internal structure of certain operations to inject malicious behavior, which (a) LeNet for MNIST Dataset means they require that the attacker has access to internal 1 ch. 6 ch. 6 ch. 16 ch. 16 ch. 120 ch. 84 ch. 10 ch. 28x28 24x24 12x12 8x8 4x4 1x1 1x1 1x1 IP 1 IP 2 Data Prob Pool 2 Pool Pool 1 Pool Conv 1 Conv Conv 3 Conv mathematical operations. 2 Conv In the real-world scenario, it is impossible to get full access (b) LeNet-3D for CIFAR-10 Dataset to the CNN architecture [18]–[25]. Therefore, most of these 3 ch. 10 ch. 10 ch. 20 ch. 20 ch. 100 ch. 150 ch. 10 ch. 2 HT attacks are applicable under the limited attack scenario. 32x32 28x28 1 14x14 10x10 5x5 1x1 1x1 1x1 IP 1 IP IP 2 Data Prob Relu Pool 2 Pool Pool 1 Pool Relu Conv 1 Conv Conv 3 Conv Moreover, most of the approaches adopted in state-of-the-art 2 Conv hardware/firmware Trojan attacks on hardware accelerator- FIGURE 2: CNN models used in experiments; (a) LeNet trained/ based CNN inference are focused on the deployment of tested on MNIST (b) LeNet-3D trained/ tested on CIFAR-10. CNN on a single FPGA with access to the complete CNN pipeline [12], [15], [17]. Table 1 summarizes the differences in the state-of-the-art HT insertion techniques. access to the complete network or ground truth, coming up To address some of these attacks, defense techniques such with stealthy and effective hardware attacks is challenging. as [26] is proposed, which is a trigger approximation-based In this paper, we investigate and demonstrate that an attacker Trojan detection framework. It searches for triggers in input may carry out an attack on the CNN while not having com- space and also detects Trojans in a feature map space. Gao et plete knowledge of CNN architecture and training or testing al. [27] propose a STRIP defense methodology that turns the dataset. It is worth mentioning here that though the attacker strength of an input-agnostic trigger into a means of detecting does not have access to the training dataset, it may still Trojans at run-time. Doan et al. [28] propose Februus that be provided with a Feature Map-based Validation Dataset neutralizes Trojan attacks on Deep Neural Network (DNN) (FMV-Dataset) to verify the functional correctness hardware. systems at run-time. Please note, it is not the traditional validation dataset as Partitioning of CNN with horizontal collaboration among provided along with the training dataset for any supervised RC AIoT device [29]–[32] or via vertical collaboration machine learning techniques. [33] [34] is also considered as an alternative approach to defend attacks. This is because partitioned CNN acts like a A. MOTIVATIONAL CASE STUDY distributed network; hence it contains the inherent security To investigate the viability of the above-mentioned attack, feature of such networks. Moreover, with partitioned CNN we need to explore whether the small-sized FMV-Dataset, on multiple FPGAs, third parties (3Ps) do not have access with a possible payload in only one of the partitioned CNN to the full CNN pipeline rendering current attack techniques layers, can lead to an effective and stealthy attack or not. To invalid. However, partitioning CNNs on multiple FPGAs can answer this, we postulate two hypotheses and performed two also pose security concerns. experiments to confirm the validity of our hypotheses: It is possible that one or more of these FPGA devices Hypothesis 1: A small-sized FMV-Dataset can provide an are malicious, and the CNN deployment on FPGA may be adequate estimate of the statistical attributes of the complete compromised.