The rapid advancement of artificial intelligence (AI) has resulted in creation of a vast array of accelerator hardware, including GPUs, TPUs, and FPGAs, alongside the latest ASICs, to efficiently train and deploy AI models. However, AI accelerators are vulnerable to security threats that can compromise sensitive information, such as model architecture and jeopardize operational integrity, leading to unreliable applications. While significant efforts have been made for security verification of AI accelerators, existing techniques have inherent limitations and struggle to keep pace with evolving attack strategies. In this paper, we present a comprehensive analysis of the evolving field of security verification methodologies for AI accelerators, critically examining their effectiveness and identifying key limitations. Furthermore, we explore emerging trends in the field and outline potential research directions that could be pursued to enhance the security verification of AI accelerators.

Network-on-Chip (NoC) fabrics are widely used in modern System-on-Chip designs to provide coordination among integrated hardware units. A significant category of security flaws entails a rogue foundry manipulating the routing logic and NoC topology through reverse engineering. In this study, we develop an architecture to defend NoC fabrics against these kinds of attacks, called OBNoCs [1] which replaces router connections in a reconfigurable manner with switches that may be configured to induce the desired topology after manufacturing. We achieve verifiable redaction of NoC functionality with our approach: switch configurations create several permissible topologies, but only one of them is the desired topology. We implement the OBNoCs technique on the Intel QuartusTM Platform, and experimental findings on practical SoC designs demonstrate that the architecture has low overhead related to power consumption and resource usage.

Deep learning systems are susceptible to evasion attacks, which represent a significant category of security vulnerabilities. These attacks entail the alteration of input data in such a way that the victim deep neural network (DNN) misclassifies it. Researchers have devised detection and defense methods to counter evasion attacks; however, these techniques impose a significant computational burden and are not suitable for real-time detection on devices with limited resources. This article presents an infrastructure,${\mathrm{G{\scriptstyle ERALT}}}$designed to improve the efficiency of evasion attack detection for real-time execution on edge devices. It involves a partition analysis that optimizes detection methods and allows for the use of a smaller detection network. Additionally, we propose a hardware architecture that accelerates internetwork inference using intermediate data reuse techniques and enables a different pattern of model updates between cloud servers and edge devices in real-world applications. Furthermore, it is also extended to a principle of internetwork accelerator design, which is evaluated at different PE ratios. Our evaluations demonstrate that${\mathrm{G{\scriptstyle ERALT}}}$achieves more than$3\times $improvement in performance compared to standard accelerators like Eyeriss, without affecting detection and classification accuracy. The boosted model update system avoids the bandwidth limit between edge devices and the cloud server, saving 14 h when updating the model for a new evasion attack.

We present an infrastructure for evaluating CNN models for vulnerability against a variety of integrity attacks. Our focus is on attacks that corrupt CNN computations with an impact on prediction/classification accuracy. The attack model encompasses a variety of mechanisms including injection of faults and glitches, integrity attacks on compute resources, etc. Our tool enables users to explore a variety of attack configurations, targets, and accuracy drops tolerated by the model. Experiments with our tool on publicly available CNN models show the vulnerability between layers is different, which can be exploited to protect important parts of the computation even when deployed on untrusted accelerators.

Modern System-on-Chip designs typically use Network-on-Chip (NoC) fabrics to implement coordination among integrated hardware blocks. An important class of security vulnerabilities involves a rogue foundry reverse-engineering the NoC topology and routing logic. In this paper, we develop an infrastructure, ObNoCs , for protecting NoC fabrics against such attacks. ObNoCs systematically replaces router connections with switches that can be programmed after fabrication to induce the desired topology. Our approach provides provable redaction of NoC functionality: switch configurations induce a large number of legal topologies, only one of which corresponds to the intended topology. We implement the ObNoCs methodology on Intel Quartus™ Platform, and experimental results on realistic SoC designs show that the architecture incurs minimal overhead in power, resource utilization, and system latency.