Active and Passive Physical Attacks on Neural Network Accelerators

Abstract

Neural networks are being increasingly deployed as the method of choice in a variety of real-world applications. These applications may be privacy-sensitive or have safety implications such as medical image analysis or autonomous driving. Furthermore, the network models are intellectual property, which should be kept secret. Due to that, reverse-engineering neural networks in order to retrieve the secret parameters has become a popular research topic. One way to achieve this is by gathering side-channel information and then inferring the topology and parameters of the target network. Additionally, it is possible to recover the input to a neural network by utilizing side-channel attack methods. Another threat comes from fault injection attacks, which can crash an accelerator or lead to information leakage. With the growing ubiquity of neural networks and its deployment in edge computing it becomes more important to be aware of physical attacks.