Securing AI Hardware: Challenges in Detecting and Mitigating Hardware Trojans in ML Accelerators

Artificial Intelligence (AI) has transformed multiple industries, creating specialized hardware for AI/Machine Learning (ML) workloads. These hardware accelerators have become prevalent in healthcare, scientific computing, space ex-ploration, the military, and consumer electronics. However, using AI hardware in critical systems can pose a significant risk due to potential attack vectors that malicious entities can exploit. One such vulnerability is the insertion of Hardware Trojans (HT) into an Integrated Circuit (IC), which can result in catastrophic consequences. Detecting and mitigating HTs in AI hardware can be a challenge due to the complexity of the hardware and ML algorithms. Moreover, adversarial HT attacks can also degrade model accuracy, and detecting the cause of model accuracy loss is difficult. Thus, developing effective techniques to detect and mitigate HT attacks in AI hardware is crucial. With the added risk of HT insertion by unknown attack vectors, addressing the challenge of mitigating HTs in AI hardware is vital. This paper presents a comprehensive review of the potential threat of Hardware Trojans (HTs) in AI/ML hardware accelerators, provides potential mitigation approaches for securing AI/ML accelerators, and highlights open challenges in this field.

I. Introduction

IC supply chain globalization allows design companies, also known as design houses, to design and fabricate state-of-the-art hardware without owning a fabrication facility. However, this lack of control of the supply chain leads to a multitude of hardware security vulnerabilities. Amongst these security issues, Hardware Trojan (HT) insertion has been a significant concern for design houses that offshore their fabrication. This concern of modifications to the design netlist is multiplied when the hardware in question is intended for use in mission-critical or sensitive applications like the military, healthcare, and aerospace, to name a few. Mitigation against Artificial Intelligence (AI) or Machine Learning (ML) HTs is a multi-layered challenge. HTs are malicious, unwanted, and intentional modifications to Integrated Circuits (ICs). These modifications can potentially lead to various effects, from leaking information to altering the intended functionality of the IC [1]. ML accelerators are susceptible to HT attacks due to their complex and interconnected nature. The malicious alterations caused by HTs on Neural Networks (NNs) cause the model to intentionally produce false outputs. HTs could be added to the IC using either hardware or software. During training, software trojans are typically incorporated into the NN parameters by data poisoning, creating a back door that only functions as intended when inputs contain the appropriate software Trojan triggers. HTs can be inserted into ML accelerators at various stages of their design, fabrication, testing, or assembly, as shown in Figure 2 [1], [2]. A meticulously designed trigger and payload are typically included in an HT that is injected into NN in order to jeopardize the integrity of the network. Adversaries can exploit the complex nature of ML accelerator designs to introduce subtle malicious modifications that can go undetected during manufacturing tests [3]–[6]. For instance, they can modify the design of a functional block to include additional circuits that perform malicious activities, such as leaking sensitive data or disrupting the normal functioning of the accelerator. Another way of introducing HTs is through the supply chain. Adversaries can tamper with the hardware at any point in manufacturing and testing, making it difficult to trace the attack's origin. Furthermore, insiders with access to the design or manufacturing process can also introduce HTs, making detecting malicious modifications to the original design even more challenging. Therefore, it is crucial to implement robust security measures and thorough testing to detect and mitigate HTs in ML accelerators. These accelerators may later be used in safety-critical systems like self-driving cars, as shown in Figure 1. One of the primary factors for the stealthiness of HTs is their ability to maintain the original functionality of the hardware without noticeable modifications. HTs are designed to remain dormant until a specific trigger event occurs, such as a particular input pattern or signal. Once activated, the Trojan can perform various malicious actions, including leaking sensitive data or manipulating the system's output, without being detected by pre-silicon and post-silicon verification and testing methodologies [1]. Furthermore, ML hardware is often complex and contains many interconnected components, making it difficult to isolate and analyze individual design sections. The hardware may also use proprietary architectures, designs, and Intellectual Properties (IPs), making it difficult to develop standardized testing methods for detecting Trojans. Therefore, detecting and mitigating HTs in ML accelerators is very challenging. This highlights the need for a multi-faceted approach that involves implementing robust security measures throughout the design, manufacturing, and supply chain processes to ensure the integrity of the hardware system. In this paper, the threat of HTs in ML hardware accelerators is discussed, insights into the hardware security vulnerabilities in ML hardware are given, and potential mitigation methods are discussed with an understanding of state-of-the-art HTs. This paper uses the term “Machine Learning Hardware Accelerators” to describe ASIC IPs that allow faster ML model processing. We do not investigate ML acceleration using GPUs, FPGAs, TPUs, or DSP platforms. Fig. 1.

Malicious ML hardware accelerator shown wrongly classifies the label of an object. This misclassification due to the presence of HT(s) in the ML Hardware Accelerator may lead to a crash in Self Driving Cars.

Fig. 2.

Hardware Trojan Threats (red) and potential mitigations (green) for AI/ML hardware accelerators through the IC supply chain