💻 computer science

Attacking AI Accelerators by Leveraging Arithmetic Properties of Addition

This paper introduces a novel hardware aging attack on AI accelerators that exploits the commutative property of addition to permute adder inputs, thereby inducing unbalanced transistor stress and accelerating circuit degradation without incurring area or software overhead, ultimately causing up to a 64% drop in inference accuracy within four years.

Original authors: Masoud Heidary, Biresh Kumar Joardar

Published 2026-03-31

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Masoud Heidary, Biresh Kumar Joardar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: A "Silent Saboteur" for AI Chips

Imagine you have a super-fast robot chef (an AI Accelerator) that can cook millions of meals (process data) in seconds. This robot relies on a specific tool: a multiplier. Think of the multiplier as a high-speed blender that mixes ingredients together to create the final dish.

The researchers in this paper discovered a way to sabotage this blender. They didn't break it, and they didn't jam the gears. Instead, they rearranged the order of the ingredients entering the blender.

Because of a basic math rule called commutativity (which means $A + B$ is the same as $B + A$ ), the robot still produces the exact same meal. The customer (the software) doesn't notice anything is wrong immediately.

However, this tiny rearrangement puts extra stress on specific, weak parts of the blender's motor. Over time, those specific parts wear out much faster than they should. Eventually, the blender starts to stutter, mix up the ingredients, and serve spoiled food. The robot chef slowly loses its mind, making terrible mistakes, all while looking like it's working perfectly fine.

The Problem: Why AI Chips Age

Just like humans, computer chips get "old." Over time, the tiny transistors inside them degrade due to heat and electricity. This is called aging.

Normal Aging: Like a car engine slowly losing power over 10 years. Engineers know this happens and build a "safety buffer" (guard band) to keep the car running safely for a while.
The Attack: The researchers found a way to make the engine wear out in just 4 years instead of 10, bypassing the safety buffer.

The Method: The "Input Swap" Trick

The attack targets Adders (the parts of the chip that do the math).

The Setup: Inside a chip, an adder takes three inputs (let's call them A, B, and C) and adds them up.
The Trick: The attacker swaps the wires for inputs B and C.
The Result: Mathematically, the answer is identical. $1+2+3$ is the same as $1+3+2$ . The chip passes all standard tests because the output is correct.
The Hidden Damage: Inside the chip, the transistors that handle input B are different from those that handle input C. By swapping them, the attacker forces the "weaker" transistors to work harder and longer. It's like forcing a runner to run on a rough, rocky path instead of a smooth track. They get tired (age) much faster.

The Execution: How the Attack Happens

The paper suggests a malicious factory worker or a shady third-party vendor could do this during the manufacturing process.

Stealth: They don't need to add extra parts or change the code. They just swap two wires. It's like a mechanic swapping the left and right tires on a car. The car drives straight, but the tires wear out unevenly.
Targeting: The researchers wrote a smart algorithm (a digital map) to find the "weakest paths" in the chip. They swap wires only in the most critical areas to maximize damage while staying hidden.

The Consequences: When the Robot Chef Breaks

The researchers tested this on various AI models (like those used for self-driving cars, medical diagnosis, or chatbots).

The Timeline: For the first year or two, everything looks normal. The safety buffer hides the damage.
The Crash: Around the 4-year mark, the damage becomes too great. The chip starts making calculation errors.
The Impact:
- Self-driving cars might misidentify a stop sign as a speed limit sign.
- Medical AI might miss a tumor in an X-ray.
- Chatbots might start hallucinating nonsense.

In their experiments, the accuracy of these AI models dropped by as much as 64%. That means a system that was 90% reliable became less than 30% reliable, rendering it useless for critical tasks.

Why This is Scary

It's Invisible: You can't see it with a microscope easily, and standard software tests won't catch it because the math is still "correct" in the short term.
No Cost: It doesn't cost the attacker anything extra. No new chips, no extra power, just a wire swap.
Hard to Fix: Once the transistors are worn out, you can't fix them with a software update. You have to throw the whole chip away.

Summary

This paper reveals a terrifying new way to attack AI hardware. By exploiting a simple math rule, an attacker can secretly rearrange the internal wiring of a chip to make it age rapidly. The chip works perfectly at first, but slowly degrades until the AI system fails catastrophically, all while looking like a normal, aging device. It's a "slow poison" for the brain of modern technology.

1. Problem Statement

The reliability of AI models is heavily dependent on the underlying hardware substrate. As semiconductor technology scales to nanometer regimes, circuits are increasingly susceptible to aging mechanisms such as Negative Bias Temperature Instability (NBTI), Hot Carrier Injection (HCI), and Time Dependent Dielectric Breakdown (TDDB). NBTI, in particular, causes a gradual increase in the threshold voltage ( $V_{th}$ ) of PMOS transistors, leading to increased propagation delays and potential timing violations.

While aging is a natural process, hardware aging attacks aim to accelerate this degradation maliciously to induce premature failure or accuracy loss. Existing attacks often rely on:

Input manipulation: Changing workload patterns to stress specific transistors (often detectable).
Hardware Trojans: Adding extra circuitry to boost voltage or heat (incurs area overhead).
Thermal variations: Using localized heating (hard to control in complex logic).

The paper identifies a gap: there is a need for a stealthy, zero-overhead aging attack that exploits the inherent mathematical properties of hardware components to accelerate aging without altering the logical function or physical footprint of the circuit.

2. Methodology

The proposed attack targets Multipliers within AI accelerators (specifically Systolic Arrays) by exploiting the commutative property of addition ( $A + B = B + A$ ).

Core Insight

In a full adder, the sum output remains constant regardless of the order of inputs. However, the physical transistors responsible for processing these inputs experience different stress levels depending on the input values.

NBTI Stress: Occurs when a PMOS transistor's gate is at logic '0' (negative bias) while the source is at a higher potential.
The Attack Vector: By rewiring (permuting) the input pins of a full adder (e.g., swapping inputs $B$ and $C$ ), the attacker changes which specific transistors are subjected to negative bias for longer durations.
Stealth: Since the mathematical output (Sum and Carry) remains identical, the circuit passes functional testing. The attack only manifests as accelerated aging over time.

Attack Implementation Strategy

The authors propose a greedy depth-first graph traversal algorithm (Algorithm 1) to optimize the attack:

Critical Path Identification: Identify the top- $k$ critical paths in the multiplier circuit (MAC unit).
Stress Simulation: Simulate the aging behavior (using NBTI models) for all possible input permutations of the adders within these paths.
Greedy Selection: Select the specific input permutation that maximizes the stress ( $\alpha$ , the probability of a PMOS being at logic '0') on the most vulnerable transistors.
Targeted Rewiring: Apply the rewiring only to the most sensitive adders (e.g., top 25%, 50%, or 100% of adders in the critical path) to balance stealth and damage.

Scope

Target: Multipliers in Systolic Arrays (common in TPUs, GPUs, and CPUs).
Applicability: Works on both Integer/Fixed-point and Floating-point multipliers (attacking the mantissa multiplication stage).
Threat Model: Assumes a malicious foundry or third-party IP vendor tampering with the circuit design before fabrication.

3. Key Contributions

Novel Attack Vector: First demonstration of an aging attack leveraging the commutative property of addition to induce unbalanced transistor stress without functional changes.
Zero Overhead: The attack requires no additional area, power, or software. It only involves swapping existing wire connections during the design/fabrication phase.
Stealth: The attack is logically invisible; the circuit behaves correctly during post-manufacturing testing. Timing violations only occur after years of accelerated aging.
Generalizability: The method is applicable to any commutative logic block, specifically targeting the Multiply-Accumulate (MAC) units that form the backbone of AI inference.

4. Experimental Results

The authors evaluated the attack using GlobalFoundries 22nm (GF22nm) technology, simulating 6-bit to 16-bit Array and Wallace Tree multipliers with various AI models (CNNs, GNNs, Transformers).

Delay Degradation:
- Tampering the critical path (M-1-100%) in an 8-bit Array multiplier caused a 29% increase in delay after 4 years compared to natural aging.
- Wallace Tree multipliers showed even higher sensitivity, with up to a 48% delay increase.
- Higher bit-width multipliers (e.g., 16-bit) exhibited significantly greater delay increases than lower bit-widths.
Error Likelihood:
- Under a static timing guard band (designed for natural aging), the attack caused significant timing violations.
- Full tampering (M-All-100%) resulted in an error likelihood of 35% for 16-bit multipliers after 4 years, compared to 16% for 8-bit.
- The proposed method outperformed prior attacks (Workload-Aware Lifetime Trojan and Process Reliability Trojan) in terms of error generation.
AI Model Accuracy Impact:
- CNNs (e.g., Darknet, VGG): Suffered severe accuracy drops. Darknet on CIFAR-10 dropped from 85% to **30% (55% loss)** after 4 years with full tampering.
- Transformers (BERT): Showed a more modest but still significant drop (15% on SST-2), attributed to the simplicity of the dataset.
- GNNs: Experienced a 26% average accuracy loss.
- Overall: Across a mix of models and datasets, the attack caused an average 38% to 64% accuracy loss after 4 years, rendering the hardware dysfunctional for safety-critical applications.

5. Significance and Implications

Security Threat: This work reveals a fundamental vulnerability in the physical design of AI accelerators. It demonstrates that "mathematically correct" optimizations (like input ordering) can be weaponized to destroy hardware reliability over time.
Supply Chain Risk: The attack highlights the danger of untrusted foundries or IP vendors. Since the modification is invisible to standard functional testing, it poses a severe risk to the semiconductor supply chain.
Limitations of Current Defenses: Standard aging mitigation techniques (like static guard bands) are insufficient because they are calibrated for natural aging, not for this specific, targeted acceleration of stress on critical transistors.
Future Directions: The paper suggests that future hardware designs for AI must consider "aging-aware" commutative logic placement or dynamic stress balancing to prevent such targeted attacks.

In conclusion, the paper presents a highly effective, low-cost, and stealthy hardware aging attack that exploits the mathematical properties of adders to degrade AI accelerators, posing a critical threat to the long-term reliability of AI systems.