# Hardware Trojan Attacks on Neural Networks

arXiv: https://arxiv.org/abs/1806.05768 · HTML: https://mlsanity.com/paper/1806.05768/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2018.

## Built on by (most cited first, 12 of 12)

- [Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead](https://mlsanity.com/paper/2101.02559/) (2021)
- [A Survey of Neural Trojan Attacks and Defenses in Deep Learning](https://mlsanity.com/paper/2202.07183/) (2022)
- [UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models](https://mlsanity.com/paper/2412.11441/) (2024)
- [Don't Knock! Rowhammer at the Backdoor of DNN Models](https://mlsanity.com/paper/2110.07683/) (2021)
- [SafeLight: Enhancing Security in Optical Convolutional Neural Network Accelerators](https://mlsanity.com/paper/2411.16712/) (2024)
- [SoWaF: Shuffling of Weights and Feature Maps: A Novel Hardware Intrinsic Attack (HIA) on Convolutional Neural Network (CNN)](https://mlsanity.com/paper/2103.09327/) (2021)
- [FeSHI: Feature Map Based Stealthy Hardware Intrinsic Attack](https://mlsanity.com/paper/2106.06895/) (2021)
- [IndirectAD: Practical Data Poisoning Attacks against Recommender Systems for Item Promotion](https://mlsanity.com/paper/2511.05845/) (2025)
- [Attacking Deep Learning AI Hardware with Universal Adversarial Perturbation](https://mlsanity.com/paper/2111.09488/) (2021)
- [Evil from Within: Machine Learning Backdoors through Hardware Trojans](https://mlsanity.com/paper/2304.08411/) (2023)
- [Evasive Hardware Trojan through Adversarial Power Trace](https://mlsanity.com/paper/2401.02342/) (2024)
- [HAMLOCK: HArdware-Model LOgically Combined attacK](https://mlsanity.com/paper/2510.19145/) (2025)

## Abstract (arXiv)

With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illuminate these security issues by introducing hardware Trojan attacks on neural networks, expanding the current taxonomy of neural network security to incorporate attacks of this nature. To aid in this, we develop a novel framework for inserting malicious hardware Trojans in the implementation of a neural network classifier. We evaluate the capabilities of the adversary in this setting by implementing the attack algorithm on convolutional neural networks while controlling a variety of parameters available to the adversary. Our experimental results show that the proposed algorithm could effectively classify a selected input trigger as a specified class on the MNIST dataset by injecting hardware Trojans into 0.03%, on average, of neurons in the 5th hidden layer of arbitrary 7-layer convolutional neural networks, while undetectable under the test data. Finally, we discuss the potential defenses to protect neural networks against hardware Trojan attacks.