Technical Summary: Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in Embedded Neural Networks

Problem Statement

Embedded neural networks (NNs) deployed on edge devices (e.g., microcontrollers) face a dual threat landscape: algorithmic adversarial attacks (like backdoors) and physical fault injection (FI) attacks. Historically, these domains have been treated separately. Physical FI attacks on NNs typically aim to induce immediate misclassification by corrupting weights or skipping instructions, often resulting in coarse-grained, non-stealthy failures. Conversely, backdoor attacks usually rely on specific input-space triggers (e.g., pixel patterns) that are detectable by input-space defenses.

The core problem addressed is the lack of understanding regarding how physical faults propagate through NN implementations to create specific, reproducible data perturbations. Current FI attacks often lack the precision to manipulate intermediate computations into "tractable states" that can be intentionally exploited. This paper posits that by precisely characterizing these fault-induced data transformations, an adversary can bridge the gap between hardware-level faults and algorithm-level backdoors, creating a stealthy attack vector that remains dormant during normal operation and activates only under specific physical fault conditions.

Methodology: LATCH

The authors propose LATCH (Latent Activation Trigger via Cross-level Faults in Hardware), a cross-level attack methodology that follows a "characterize-then-exploit" approach.

1. FI Characterization

The first step involves systematically characterizing the effects of physical faults on specific instructions within the NN inference pipeline. The authors focus on the ARM Cortex-M4 microcontroller, a common platform for constrained embedded applications.

• Target Operations: The study focuses on two dominant operations in resource-constrained NNs:
  • Memory Movement: Specifically the memcpy function, analyzing LDRB (load) and STRB (store) instructions.
  • Convolution: Specifically the SMLAD (Signed Multiply Accumulate Dual) instruction used in CMSIS-NN kernels for quantized convolution.
• Fault Injection Techniques: The authors utilize Electromagnetic Fault Injection (EMFI) and Voltage Glitching.
• Characterization Goal: To identify precise temporal and spatial windows where faults induce predictable, structured data changes (e.g., forcing a specific byte to 0x7F or 0x00) rather than random corruption.

2. Backdoor Injection

Once the fault-induced data pattern is characterized, a backdoor is implanted into the model.

• Trigger Mechanism: Unlike traditional backdoors triggered by input perturbations, the LATCH trigger is a specific intermediate value in a feature map (e.g., a specific byte in a convolutional layer output) that results only from the physical fault.
• Injection Methods:
  • Poison-based: Data poisoning during training where samples are relabeled when a specific intermediate activation (simulating the fault) is present.
  • Data-free (Weight Surgery): Post-hoc modification of quantized weights to create a pathway that activates the target class when the specific fault-induced value (e.g., 0x7F) appears in the feature map. This requires no retraining.

3. FI Exploitation (Triggering)

During deployment, the adversary performs a physical fault injection at the pre-characterized location and timing. This induces the specific data modification in the feature map, which acts as the trigger, causing the model to misclassify the input to the attacker's target class. The input image itself remains unmodified.

Key Contributions

1. Characterize-then-Exploit Methodology: The paper introduces a systematic approach to first characterize instruction-level fault effects on NN inference and then design attacks that explicitly exploit these reproducible patterns.
2. Cross-Level Backdoor Attack: LATCH is presented as the first cross-level attack where hardware-level faults introduce reproducible software-level data modifications that serve as stealthy backdoor triggers.
3. Implementation-Specific Precision: The work provides a detailed characterization of faults on ARM Cortex-M4, specifically targeting memcpy (load/store) and SMLAD instructions, demonstrating that faults can be manipulated to produce specific byte values (e.g., 0x7F).
4. Stealth and Evasion: The attack demonstrates that feature map backdoors triggered by physical faults evade standard input-space backdoor defenses (e.g., Neural Cleanse, STRIP) because the trigger never appears in the input data.

Experimental Results

The authors evaluated LATCH on MNIST and CIFAR-10 datasets using 8-bit quantized CNNs implemented with CMSIS-NN on ARM Cortex-M4.

• Fault Success Rate (FSR): The ability to induce the specific target byte change varied by technique and target.
  • EMFI on memcpy: FSR ranged from ~32% to 34%.
  • Voltage Glitching on memcpy: FSR was ~32%.
  • EMFI on SMLAD (Convolution): FSR was lower (~13%), requiring approximately 6–9 attempts on average to achieve a successful fault, but remained reproducible.
• Attack Success Rate (ASR): Once the fault was successfully induced, the backdoor triggered with 100% success across all tested configurations (MNIST and CIFAR-10, both poison-based and data-free).
• Benign Accuracy: The backdoored models maintained accuracy comparable to clean models during normal operation (e.g., ~99.3% on MNIST, ~80-84% on CIFAR-10).
• Defense Evasion:
  • Input-space defenses: Defenses like Neural Cleanse, STRIP, and Activation Clustering successfully detected pixel-based backdoors but failed to detect feature map backdoors, especially those triggered in deeper layers (e.g., Conv2).
  • Stealth: The Conv2 feature map backdoor evaded detection by 4/4 defenses on MNIST and 0/4 on CIFAR-10.
  • Adaptive Defenses: The paper notes that while adapting defenses to inject faults during probing could detect the backdoor, it would cause a high false-positive rate (rejecting ~100% of clean inputs), rendering such adaptations impractical.

Significance and Claims

The paper claims to highlight a novel attack vector at the intersection of hardware and algorithmic levels. By demonstrating that physical faults can be transformed into stealthy, reproducible triggers, the authors stress the need for defenses across abstraction levels.

The significance lies in the shift from viewing faults as random noise to viewing them as a controllable mechanism for activating hidden model behaviors. The authors assert that current backdoor detection methods, which assume triggers reside in the input space, are insufficient against this class of attacks. The work broadens the threat landscape for AI systems, suggesting that securing embedded NNs requires a holistic approach that considers the interaction between physical implementation vulnerabilities and algorithmic model integrity.

The paper remains modest in its scope, noting that it focuses on single-fault triggers and specific fault patterns (single-byte overwrites). It acknowledges that multi-fault triggers and richer fault patterns are left for future work.