Backdoor attacks on deep learning (DL) models emerge as the most worrisome security threats to their secure and safe usage, especially for security-sensitive tasks. Great efforts have been devoted to thwarting backdoor attacks by devising detection or prevention countermeasures. By default, these countermeasures are designed and evaluated on models with full-precision parameters (e.g., floating32). It is unclear whether they are immediately applicable to mitigate backdoor attacks in the quantized model that are being pervasively deployed on mobile devices and Internet of Things (IoT) devices to save resources (i.e. power and memory) and reduce latency and privacy risks. This work, for the first time, initializes the critical examination of the robustness or applicability of existing state-of-the-art (SOTA) DL backdoor defenses for detecting or preventing backdoor attacks on quantized models. Based on extensive evaluations of four representative defenses (Neural Cleanse, ABS, Fine-Pruning and Trojan Signature) with three datasets (CIFAR10, GTSRB, and STL10), we found that only Neural Cleanse's defensive robustness is generally independent of model quantization, while all others exhibit degraded effectiveness or failures against quantized models (in particular, widely used int-8 and 1-bit models), especially when the model is quantized to be 1-bit. The identified main failure reason is that these defenses are based on examining the weight values of the model or the activation values of the neuron to identify or prevent the backdoor, often using the ranking as a step. Quantization with a small bit width leads to less fine-grained discrete values (e.g., 1-bit quantization only possesses two value elements of -1 and +1), rendering ranking effectiveness deteriorate in this case. Note that the quantization not only applies to the weight but also to activation, thus making these defenses less robust or trivially fail. This work highlights the demand for devising backdoor defenses that are generic to different quantization formats on top of the default full-precision model.

Due to their low latency and high privacy preservation, there is currently a burgeoning demand for deploying deep learning (DL) models on ubiquitous edge Internet of Things (IoT) devices. However, DL models are often large in size and require large-scale computation, which prevents them from being placed directly onto IoT devices, where resources are constrained, and 32-bit floating-point (float-32) operations are unavailable. Commercial framework (i.e., a set of toolkits) empowered model quantization is a pragmatic solution that enables DL deployment on mobile devices and embedded systems by effortlessly post-quantizing a large high-precision model (e.g., float-32) into a small low-precision model (e.g., int-8) while retaining the model inference accuracy. However, their usability might be threatened by security vulnerabilities. This work reveals that standard quantization toolkits can be abused to activate a backdoor. We demonstrate that a full-precision backdoored model which does not have any backdoor effect in the presence of a trigger—as the backdoor is dormant—can be activated by (i) TensorFlow-Lite (TFLite) quantization, the onlyproduct-readyquantization framework to date, and (ii) thebeta releasedPyTorch Mobile framework. In our experiments, we employ three popular model architectures (VGG16, ResNet18, and ResNet50), and train each across three popular datasets: MNIST, CIFAR10 and GTSRB. We ascertain that all trained float-32 backdoored models exhibit no backdoor effecteven in the presence of trigger inputs. Particularly, four influential backdoor defenses are evaluated, and they fail to identify a backdoor in the float-32 models. When each of the float-32 models is converted into an int-8 format model through the standard TFLite or PyTorch Mobile framework's post-training quantization, the backdoor is activated in the quantized model, which shows a stable attack success rate close to 100% upon inputs with the trigger, while it usually behaves upon non-trigger inputs. This work highlights that a stealthy security threat occurs when an end-user utilizes the on-device post-training model quantization frameworks, informing security researchers of a cross-platform overhaul of DL models post-quantization even if these models pass security-aware front-end backdoor inspections. Significantly, we have identified Gaussian noise injection into the malicious full-precision model as an easy-to-use preventative defense against the PQ backdoor. The attack source code is released athttps://github.com/quantization-backdoor.

To mitigate recent insidious backdoor attacks on deep learning models, advances have been made by the research community. Nonetheless, state-of-the-art defenses are either limited to specific backdoor attacks (i.e., source-agnostic attacks) or non-user-friendly in that machine learning expertise and/or expensive computing resources are required. This work observes that all existing backdoor attacks have an inadvertent and inevitable intrinsic weakness, termed as non-transferability —that is, a trigger input hijacks a backdoored model but is not effective in another model that has not been implanted with the same backdoor. With this key observation, we propose non-transferability enabled backdoor detection to identify trigger inputs for a model-under-test during run-time. Specifically, our detection allows a potentially backdoored model-under-test to predict a label for an input. Moreover, our detection leverages a feature extractor to extract feature vectors for the input and a group of samples randomly picked from its predicted class label, and then compares the similarity between the input and the samples in the feature extractor’s latent space to determine whether the input is a trigger input or a benign one. The feature extractor can be provided by a reputable party or is a free pre-trained model privately reserved from any open platform (e.g., ModelZoo, GitHub, Kaggle) by a user and thus our detection does not require the user to have any machine learning expertise or perform costly computations. Extensive experimental evaluations on four common tasks affirm that our detection scheme has high effectiveness (low false acceptance rate) and usability (low false rejection rate) with low detection latency against different types of backdoor attacks.

Deep learning models with backdoors act maliciously when triggered but seem normal otherwise. This risk, often increased by model outsourcing, challenges their secure use. Although countermeasures exist, their defense against adaptive attacks is under-examined, possibly leading to security misjudgments. This study is the first intricate examination illustrating the difficulty of detecting backdoors in outsourced models, especially when attackers adjust their strategies, even if their capabilities are significantly limited. It is relatively straightforward for attackers to circumvent detection by trivially violating its threat model (e.g., using advanced backdoor types or trigger designs not covered by the detection). However, this research highlights that various leading detection defenses can simultaneously be evaded using simple adaptive strategies, even under their defined threat models and with limited adversary capabilities (e.g., using easily detectable triggers while maintaining a high attack success rate). To be more specific, this study introduces a novel methodology that employs trigger specificity enhancement and training regulation in a symbiotic manner. This approach allows us to evade multiple backdoor detection defenses simultaneously, including Neural Cleanse (Oakland 19’), ABS (CCS 19’), and MNTD (Oakland 21’). These were the detection tools selected for the Evasive Trojans Track of the 2022 NeurIPS Trojan Detection Challenge. Even when applied in conjunction with these defenses under stringent conditions, such as a high attack success rate (> 97%) and the restricted use of the simplest trigger (small white square), our straightforward method garnered the second prize in NeurIPS Trojan Detection Challenge. Notably, for the first time, our adaptive attack successfully evaded other recent state-of-the-art defenses, including FeatureRE (NeurIPS 22’) and Beatrix (NDSS 23’). This study suggests that existing model outsourcing backdoor defenses remain vulnerable to adaptive attacks, and thus, the use of third-party models should be avoided whenever possible.

Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection, which can be deployed on pervasive Internet of Things (IoT) and edge devices. A large amount of data is often required to train an object detector with satisfactory accuracy. However, due to the intensive workforce involved with collecting and annotating large datasets, data curation task is often outsourced to a third party (e.g., Amazon Mechanical Turk) or volunteers. This work reveals severe vulnerabilities in this data curation pipeline. We propose TransCAB, the first work to craft clean-annotated images to stealthily implant the backdoor into the object detectors later trained on them by the data curator/user even when the data curator can manually audit the images and fully controls the training process. Existing clean-label poisoned images are only shown in classification tasks but not non-classification tasks, in particular, object detection due to unique challenges faced, generally owing to the complexity of having multiple objects within each frame (image), including the victim and non-victim objects. Furthermore, we demonstrate that the backdoor effect of both cloaking and misclassification are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical object as trigger (i.e., T-shirt). The efficacy of our TransCAB is ensured by constructively i) applying the image-camouflage attack that abuses the image-scaling function widely used by the deep learning framework (i.e., PyTorch), ii) incorporating the devised clean image replica technique, and iii) combining identified poison data selection criteria given constrained attacking budget. Extensive experi-ments on YOLOv3, YOLOv4, CenterNet, and Faster R-CNN affirm that TransCAB exhibits more than 90% attack success rate under various real-world scenes even when a very small (i.e., 0.14%) dataset fraction is poisoned. In addition, the small set of poisoned images crafted on one detector (i.e., YOLOv3) can be effectively transferred to insert a backdoor on another detector (i.e., CenterNet). A comprehensive video demo is at https://youtu.be/MA7L_LpXkp4, where a poison rate of merely 0.14% is set for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor. Our collected dataset with T-shirt as a natural trigger (about 11,350 frames in total) is open to the public at https://github.com/inconstance/T-shirt-natural-backdoor-dataset, which is the first relatively large-scale natural trigger backdoor dataset.

To improve the modeling resilience of silicon strong physical unclonable functions (PUFs), in particular, the APUFs that yield a very large number of challenge-response pairs (CRPs), a number of composited APUF variants, such as XOR-APUF, interpose-PUF (iPUF), feed-forward APUF (FF-APUF), and OAX-APUF, have been devised. When examining their security in terms of modeling resilience, utilizing multiple information sources, such as power side channel information (SCI) or/and reliability SCI, given a challenge is under-explored, which poses a challenge to their supposed modeling resilience in practice. Building upon multilabel/head deep learning (DL) model architecture, this work proposes multilabel multiside-channel-information-enabled DL attacks (MLMSAs) to thoroughly evaluate the modeling resilience of aforementioned APUF variants. Despite its simplicity, MLMSA can successfully break large-scaled APUF variants, which has not previously been achieved. More precisely, the MLMSA breaks 128-stage 30-XOR-APUF, (9, 9)- and (2, 18)-iPUFs, and$(2,2,30)$-OAX-APUF when CRPs, power SCI, and reliability SCI are concurrently used. It breaks 128-stage 12-XOR-APUF and$(2,2,9)$-OAX-APUF even when only the easy-to-obtain reliability SCI and CRPs are exploited. The 128-stage six-loop FF-APUF and one-loop 20-XOR-FF-APUF can be broken by simultaneously using reliability SCI and CRPs. All these attacks are normally completed within an hour with a standard personal computer. Therefore, MLMSA is a useful technique for evaluating other existing or any emerging strong PUF designs.

Currently, a high demand for on-device deep neural network (DNN) model deployment is limited by the large model size, computing-intensive floating-point operations (FLOPS), and intellectual property (IP) infringements (i.e., easy access to model duplication for the avoidance of license payments). One appealing solution to addressing the first two concerns is model quantization, which reduces the model size and uses integer operations commonly supported by microcontrollers (MCUs usually do not support FLOPS). To this end, a 1-bit quantized DNN model or deep binary neural network (BNN) significantly improves the memory efficiency, where each parameter in a BNN model has only 1 bit. However, BNN cannot directly provide IP protection (in particular, the functionality of the model is locked unless there is a license payment). In this article, we propose a reconfigurable BNN (RBNN) to further amplify the memory efficiency for resource-constrained Internet of Things (IoT) devices while naturally protecting the model IP. Generally, RBNN can be reconfigured on demand to achieve any one of$M$($M>1$) distinct tasks with the same parameter set, thus only a single task determines the memory requirements. In other words, the memory utilization is improved by a factor of$M$. Our extensive experiments corroborate that up to seven commonly used tasks ($M=7$, six of these tasks are image related and the last one is audio) can co-exist (the value of$M$can be larger). These tasks with a varying number of classes have no or negligible accuracy drop-off (i.e., within 1%) on three binarized popular DNN architectures, including VGG, ResNet, and ReActNet. The tasks span across different domains, e.g., computer vision and audio domains validated herein, with the prerequisite that the model architecture can serve those cross-domain tasks. To fulfill the IP protection of an RBNN model, the reconfiguration can be controlled by both a user key and a device-unique root key generated by the intrinsic hardware fingerprint (e.g., SRAM memory power-up pattern). By doing so, an RBNN model can only be used per paid user per authorized device, thus benefiting both the user and the model provider. The source code is released athttps://github.com/LearningMaker/RBNN.

Over the last decade, dc-dc power converters have attracted significant attention due to their increased use in a number of applications from aerospace to renewable energy. The interest in wide bandgap (WBG) power semiconductor devices stems from outstanding features of WBG materials, power device operation at higher temperatures, larger breakdown voltages, and the ability to sustain larger switching transients than silicon (Si) devices. As a result, recent progress and development of converter topologies, based on WBG power devices, are well-established for power conversion applications in which classical Si-based power devices show limited operation. Currently, Si carbide (SiC) and gallium nitride (GaN) are the most promising semiconductor materials that are being considered for the new generation of power devices. The use of new power semiconductor devices, such as GaN high electron mobility transistors (GaN HEMTs), leads to minimization of switching losses, allowing high switching frequencies (from kHz to MHz) for realizing compact power converters. Finally, design recommendations and future research trends are also presented.

Existing strong controlled physical unclonable function (PUF) designs are built to resist modeling attacks and they deal with noisy PUF responses by exploiting error correction logic. These designs are burdened by the costs of the error correction logic and information shown to leak through the associated helper data for assisting error corrections; leaving the design vulnerable to fault attacks or reliability-based attacks. We present a hybrid PUF-finite state machine (PUF-FSM) construction to realize a controlled strong PUF. The PUF-FSM design removes the need for error correction logic and related computation, storage of the helper data and loading it on-chip by only employing error-free responses judiciously determined on demand in the absence of the underlying PUF-an Arbiter PUF-with a large challenge response pair space. The PUF-FSM demonstrates improved security, especially to reliability-based attacks and is able to support a range of applications from authentication to more advanced cryptographic applications built upon shared keys. We experimentally validate the practicability of the PUF-FSM.

Computer vision and recognition is emerging as one of the important pillars in artificial intelligence systems. It is a vital way to interpret the collected data and find matching patterns that will help in real-time decision making. CMOS-based search engines suffer from density and power limitations. Memristor is a feasible candidate that is capable of performing search within a stored structure (in-memory computing). This paper proposes the first memristor-based stateful search engine architecture based on a novel stateful heterogeneous memristive XOR gate. The design is suitable for 2-D media applications, such as image matching and pattern inspection. It performs bitwise comparison using the proposed XOR gate. The output states of all XOR gates are transferred into a single analog memristor value that is read via a digital comparator. The design assumes a single memristor device for each of the incoming data, template, and result bits. Each 2-D array of input, template, and output is reordered into a single 1-D array with 3 × (N × M) structure, where N represents the number of entry data and M is the number of bits per entry. This allows for a significantly higher storage density than conventional CMOSbased or other memristor-based search engines. Simulations of the proposed architecture demonstrate functionalities in search and compare modes using an LTSpice circuit simulator. The proposed architecture achieves a 3-ns search cycle time at 0.34 nJ/database at 1.5 V/1 GHz using 2N + 1 memristors.

Memristor-based hardware accelerators are gaining an increased attention as a potential candidate to speed-up the vector-matrix operations commonly needed in many digital image processing tasks due to their area, speed, and energy efficiency. In this paper, a memristor-based image compression (MR-IC) architecture that exploits a lossy 2-D discrete wavelet transform is proposed. The architecture is composed of a computational memristor crossbar, an intermediate memory array that stores the row-transformed coefficients and a final memory that holds the compressed version of the original image. The computational memristor array performs in-memory computation on the initially stored transformation coefficients. Using the quantitative analysis approach, we demonstrate a 10× reduction in a number of operations compared with a conventional application-specific integrated circuit implementation. This translates to five orders of magnitude reduction in area, around 11× improvement in energy efficiency, and 1.28× speedup in computation time. Image quality metrics, such as peak signal-to-noise ratio (PSNR), structural similarity (SSIM) index, and complex wavelet-SSIM (CW-SSIM), are used to quantify the reduction in image quality due to lossy compression. The achieved metrics for conventional versus MR-IC are: PSNR 57.24 versus 33.29 dB, SSIM 0.9994 versus 0.8853, and CW-SSIM 1 versus 0.9983. Simulation results show that the 32 quantization levels proposed architecture provides significant improvements in energy, area, and performance compared to the 32 levels CMOS implementation with comparable CW-SSIM.

The increased connection of distributed generation (DG), such as photovoltaic (PV) and wind turbine (WT), has shifted the current distribution networks from being passive (consuming energy) into active (consuming/producing energy). However, there is still no consensus about how to determine the maximum amount of DGs that are allowed to be connected, i.e., how to quantify a so-called “hosting capacity” (HC). Therefore, this paper proposes a novel risk assessment tool for estimating network HC by considering uncertainties associated with PV, WT, and loads. This evaluation is performed using the likelihood approximation approach. The paper, also, proposes a utilization of clearness index for localized solar irradiance prediction of PV. In addition, we propose the use of sparse grid technique as an effective means for uncertainty computation while the use of Monte Carlo technique is taken for a comparison purpose. Two actual distribution networks (11-buses and South Australian large feeder) are considered as case studies to demonstrate the usefulness of the proposed tool.

Inaccurate motor parameters can lead to an inefficient motor control. Although several motor estimation methods have been utilized to estimate motor parameters, it is still challenging to ensure a good level of confidence in the estimation. In this paper, we propose a novel offline induction motor parameter estimation method based on sparse grid optimization algorithm. The estimation is achieved by matching the response of machines mathematical model with recorded stator current and voltage signals. This approach is noninvasive as it uses external measurements, resulting in reduced system complexity and cost. A globally optimal point was found by sampling on the sparse grid, which was created using the hyperbolic cross points and additional heuristics. This has resulted in reducing the total number of search points, and provided the best match between the mathematical model and measurement data. The estimated motor parameters can be further refined by using any local search method. The experimental results indicate a very good agreement between estimated values and reference values.

The ability to carry out signal processing, classification, recognition, and computation in artificial spiking neural networks (SNNs) is mediated by their synapses. In particular, through activity-dependent alteration of their efficacies, synapses play a fundamental role in learning. The mathematical prescriptions under which synapses modify their weights are termed synaptic plasticity rules. These learning rules can be based on abstract computational neuroscience models or on detailed biophysical ones. As these rules are being proposed and developed by experimental and computational neuroscientists, engineers strive to design and implement them in silicon and en masse in order to employ them in complex real-world applications. In this paper, we describe analog very large-scale integration (VLSI) circuit implementations of multiple synaptic plasticity rules, ranging from phenomenological ones (e.g., based on spike timing, mean firing rates, or both) to biophysically realistic ones (e.g., calcium-dependent models). We discuss the application domains, weaknesses, and strengths of various representative approaches proposed in the literature, and provide insight into the challenges that engineers face when designing and implementing synaptic plasticity rules in VLSI technology for utilizing them in real-world applications.

Spike Timing Dependent Plasticity (STDP) is a time-based synaptic plasticity rule that has generated significant interest in the area of neuromorphic engineering and Very Large Scale Integration (VLSI) circuit design. During the last decade, STDP and STDP-like learning mechanisms have shown promising solutions for various real world applications, ranging from pattern recognition to robotics. This paper presents a novel analog VLSI model for STDP that possesses advantages compared to previously published VLSI STDP designs. The presented STDP circuit is capable of reproducing the outcomes of several well known experiments using various plasticity rules inducing STDP protocols that utilise pairs, triplets, and quadruplets of spike patterns. When the circuit is compared to state-of-the-art VLSI STDP circuits, it shows a compact and symmetric design that makes the proposed circuit a powerful component for use in designing STDP or time-based Hebbian learning experiments and applications.

The Bienenstock-Cooper-Munro (BCM) and Spike Timing-Dependent Plasticity (STDP) rules are two experimentally verified form of synaptic plasticity where the alteration of synaptic weight depends upon the rate and the timing of pre- and post-synaptic firing of action potentials, respectively. Previous studies have reported that under specific conditions, i.e. when a random train of Poissonian distributed spikes are used as inputs, and weight changes occur according to STDP, it has been shown that the BCM rule is an emergent property. Here, the applied STDP rule can be either classical pair-based STDP rule, or the more powerful triplet-based STDP rule. In this paper, we demonstrate the use of two distinct VLSI circuit implementations of STDP to examine whether BCM learning is an emergent property of STDP. These circuits are stimulated with random Poissonian spike trains. The first circuit implements the classical pair-based STDP, while the second circuit realizes a previously described triplet-based STDP rule. These two circuits are simulated using 0.35 µm CMOS standard model in HSpice simulator. Simulation results demonstrate that the proposed triplet-based STDP circuit significantly produces the threshold-based behaviour of the BCM. Also, the results testify to similar behaviour for the VLSI circuit for pair-based STDP in generating the BCM.

Spike-Timing Dependent Plasticity (STDP) is believed to play an important role in learning and the formation of computational function in the brain. The classical model of STDP which considers the timing between pairs of pre-synaptic and post-synaptic spikes (p-STDP) is incapable of reproducing synaptic weight changes similar to those seen in biological experiments which investigate the effect of either higher order spike trains (e.g. triplet and quadruplet of spikes) [1]-[3], or, simultaneous effect of the rate and timing of spike pairs [4] on synaptic plasticity. In this paper, we firstly investigate synaptic weight changes using a p-STDP circuit [5] and show how it fails to reproduce the mentioned complex biological experiments. We then present a new STDP VLSI circuit which acts based on the timing among triplets of spikes (t-STDP) that is able to reproduce all the mentioned experimental results. We believe that our new STDP VLSI circuit improves upon previous circuits, whose learning capacity exceeds current designs due to its capability of mimicking the outcomes of biological experiments more closely; thus plays a significant role in future VLSI implementation of neuromorphic systems.

The nonvolatile memory property of a memristor enables the realization of new methods for a variety of computational engines ranging from innovative memristive-based neuromorphic circuitry through to advanced memory applications. The nanometer-scale feature of the device creates a new opportunity for realization of innovative circuits that in some cases are not possible or have inefficient realization in the present and established design domain. The nature of the boundary, the complexity of the ionic transport and tunneling mechanism, and the nanoscale feature of the memristor introduces challenges in modeling, characterization, and simulation of future circuits and systems. Here, a deeper insight is gained in understanding the device operation, leading to the development of practical models that can be implemented in current computer-aided design (CAD) tools.