Input-Triggered Hardware Trojan Attack on Spiking Neural Networks

CSIT, Queen's University Belfast, Belfast, UK Abstract --Neuromorphic computing based on spiking neural networks (SNNs) is emerging as a promising alternative to traditional artificial neural networks (ANNs), offering unique advantages in terms of low power consumption. However, the security aspect of SNNs is under-explored compared to their ANN counterparts. As the increasing reliance on AI systems comes with unique security risks and challenges, understanding the vulnerabilities and threat landscape is essential as neuromorphic computing matures. In this effort, we propose a novel input-triggered Hardware Trojan (HT) attack for SNNs. The HT mechanism is condensed in the area of one neuron. The trigger mechanism is an input message crafted in the spiking domain such that a selected neuron produces a malicious spike train that is not met in normal settings. This spike train triggers a malicious modification in the neuron that forces it to saturate, firing permanently and failing to recover to its resting state even when the input activity stops. The excessive spikes pollute the network and produce misleading decisions. We propose a methodology to select an appropriate neuron and to generate the input pattern that triggers the HT payload. The attack is illustrated by simulation on three popular benchmarks in the neuromorphic community. We also propose a hardware implementation for an analog spiking neuron and a digital SNN accelerator, demonstrating that the HT has a negligible area and power footprint and, thereby, can easily evade detection. Neuromorphic architectures having as basis spiking neural networks (SNNs) offer a fundamentally different approach in information processing compared to conventional artificial neural networks (ANNs). This property makes SNNs less computationally and energy-intensive, thus carrying promising opportunities for the increasingly demanding requirements of artificial intelligence (AI) [1], [2]. In particular, in SNNs the information is processed in the form of spike trains and is encoded in the timing between spikes or in the spike firing rate. Spikes are processed as soon as they are generated, thus offering real-time processing and a low-latency inference.