用数学恒等式实时检测DNN推理中的错误,防故障攻击和硬件失效。
MAED: Mathematical Activation Error Detection for Mitigating Physical Fault Attacks in DNN Inference
- 利用激活函数的数学特性,在运行时持续验证计算正确性。
- 对ReLU、Sigmoid、Tanh三种函数实现接近100%的错误检测率。
- 在微控制器上开销低于1%,FPGA几乎不增加面积,适合嵌入式部署。
嵌入式系统中深度神经网络(DNN)推理阶段日益面临故障攻击与故障的威胁,可能导致错误预测并引发灾难性后果,因此开发有效的缓解技术至关重要。本文提出MAED(数学激活误差检测),一种基于算法级误差检测的框架,通过利用数学恒等式在运行时持续验证非线性激活函数计算的正确性。据我们所知,这是首个将算法级错误检测技术用于防御嵌入式系统中关键DNN组件的恶意故障注入攻击及自然故障的方案。评估针对三种广泛应用的激活函数——ReLU、Sigmoid和Tanh进行,它们是引入非线性的基础单元,一旦出错将导致误判。通过故障模型模拟,该方案实现了接近100%的错误检测率,并有效缓解了现有针对DNN推理的故障攻击。在AMD/Xilinx Artix-7 FPGA和ATmega328P微控制器上的实现表明,与基线版本相比,该方案在微控制器上引入的时钟周期开销不足1%,在FPGA上几乎不增加面积,但使Sigmoid和Tanh的延迟增加约20%。
原文摘要 · Abstract (English)
The inference phase of deep neural networks (DNNs) in embedded systems is increasingly vulnerable to fault attacks and failures, which can result in incorrect predictions. These vulnerabilities can potentially lead to catastrophic consequences, making the development of effective mitigation techniques essential. In this paper, we introduce MAED (Mathematical Activation Error Detection), an algorithm-level error detection framework that exploits mathematical identities to continuously validate the correctness of non-linear activation function computations at runtime. To the best of our knowledge, this work is the first to integrate algorithm-level error detection techniques to defend against both malicious fault injection attacks and naturally occurring faults in critical DNN components in embedded systems. The evaluation is conducted on three widely adopted activation functions, namely ReLu, sigmoid, and tanh which serve as fundamental building blocks for introducing non-linearity in DNNs and can lead to mispredictions when subjected to natural faults or fault attacks. We assessed the proposed error detection scheme via fault model simulation, achieving close to 100% error detection while mitigating existing fault attacks on DNN inference. Additionally, the overhead introduced by integrating the proposed scheme with the baseline implementation (i.e., without error detection) is validated through implementations on an AMD/Xilinx Artix-7 FPGA and an ATmega328P microcontroller, as well as through integration with TensorFlow. On the microcontroller, the proposed error detection incurs less than 1% clock cycle overhead, while on the FPGA it requires nearly zero additional area, at the cost of approximately a 20% increase in latency for sigmoid and tanh.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。