Evaluation of parameter-based attacks against embedded neural networks with laser injection
Résumé
Machine Learning models are exposed to numerous attack vectors that threaten the confidentiality, integrity and availability of many AI-based systems.
These security concerns urge the development of practical robustness evaluation methods to help ongoing and future standardization and certification actions.
Models embed in physically accessible devices are critical cases since their attack surface also encompasses physical threats such as fault injection attacks.
More particularly, parameter-based attacks (such as the Bit-Flip Attack, BFA) highlight the lack of robustness of state-of-the-art deep neural network models when confronted by accurate and optimal alterations of their parameters stored in memory. This work goes beyond simulation-based evaluation by demonstrating, for the first time, a complete BFA-like attack on a 32-bit Cortex-M microcontroller thanks to laser injection, a standard fault injection means for security evaluation, that enables spatially and temporally accurate faults. We show a high consistency between simulation and experimental attacks with only a few bit-sets necessary to significantly alter the performance of a standard neural network model.
Origine | Fichiers produits par l'(les) auteur(s) |
---|