Fault Injection Attacks in Spiking Neural Networks and Countermeasures

Frontiers in Nanotechnology

Nanotechnology

Sachhidh Kannan¹  Karthikeyan Nagarajan²  Junde Li²  Swaroop Ghosh²  Sina Sayyah Ensan² 

[1] Ampere Computing, Portland, OR, United States;School of Electrical Engineering and Computer Science, Penn State University, University Park, PA, United States;

关键词: spiking neural network;    security;    fault injection;    STDP;    side channel attack;   

DOI  :  10.3389/fnano.2021.801999

 received in 2021-10-26, accepted in 2021-11-30,  发布年份 2022

来源: Frontiers

【 摘 要 】

Spiking Neural Networks (SNN) are fast emerging as an alternative option to Deep Neural Networks (DNN). They are computationally more powerful and provide higher energy-efficiency than DNNs. While exciting at first glance, SNNs contain security-sensitive assets (e.g., neuron threshold voltage) and vulnerabilities (e.g., sensitivity of classification accuracy to neuron threshold voltage change) that can be exploited by the adversaries. We explore global fault injection attacks using external power supply and laser-induced local power glitches on SNN designed using common analog neurons to corrupt critical training parameters such as spike amplitude and neuron’s membrane threshold potential. We also analyze the impact of power-based attacks on the SNN for digit classification task and observe a worst-case classification accuracy degradation of −85.65%. We explore the impact of various design parameters of SNN (e.g., learning rate, spike trace decay constant, and number of neurons) and identify design choices for robust implementation of SNN. We recover classification accuracy degradation by 30–47% for a subset of power-based attacks by modifying SNN training parameters such as learning rate, trace decay constant, and neurons per layer. We also propose hardware-level defenses, e.g., a robust current driver design that is immune to power-oriented attacks, improved circuit sizing of neuron components to reduce/recover the adversarial accuracy degradation at the cost of negligible area, and 25% power overhead. We also propose a dummy neuron-based detection of voltage fault injection at ∼1% power and area overhead each.

【 授权许可】

Unknown   
Copyright © 2022 Nagarajan, Li, Ensan, Kannan and Ghosh.