# SoWaF: Shuffling of Weights and Feature Maps: A Novel Hardware Intrinsic Attack (HIA) on Convolutional Neural Network (CNN)

arXiv: https://arxiv.org/abs/2103.09327 · HTML: https://mlsanity.com/paper/2103.09327/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 39 references that are in the map.
- First posted on arXiv 16 Mar 2021.

## Builds on (most cited first, 16 of 16)

- [CoEdge: Cooperative DNN Inference with Adaptive Workload Partitioning over Heterogeneous Edge Devices](https://mlsanity.com/paper/2012.03257/) (2020)
- [Accelerating CNN inference on FPGAs: A Survey](https://mlsanity.com/paper/1806.01683/) (2018)
- [Hardware Trojan Attacks on Neural Networks](https://mlsanity.com/paper/1806.05768/) (2018)
- [PoTrojan: powerful neural-level trojan designs in deep learning models](https://mlsanity.com/paper/1802.03043/) (2018)
- [Musical Chair: Efficient Real-Time Recognition Using Collaborative IoT Devices](https://mlsanity.com/paper/1802.02138/) (2018)
- [Privacy-Preserving Smart Parking System Using Blockchain and Private Information Retrieval](https://mlsanity.com/paper/1904.09703/) (2019)
- [2L-3W: 2-Level 3-Way Hardware-Software Co-Verification for the Mapping of Deep Learning Architecture (DLA) onto FPGA Boards](https://mlsanity.com/paper/1911.05944/) (2019)
- [FPGA-Based CNN Inference Accelerator Synthesized from Multi-Threaded C Software](https://mlsanity.com/paper/1807.10695/) (2018)
- [B-Ride: Ride Sharing with Privacy-preservation, Trust and Fair Payment atop Public Blockchain](https://mlsanity.com/paper/1906.09968/) (2019)
- [On Sharing Models Instead of Data using Mimic learning for Smart Health Applications](https://mlsanity.com/paper/1912.11210/) (2019)
- [Cooperation and Underlay Mode Selection in Cognitive Radio Network](https://mlsanity.com/paper/1604.03633/) (2016)
- [On Minimizing Energy Consumption for D2D Clustered Caching Networks](https://mlsanity.com/paper/1808.03050/) (2018)
- [Caching to the Sky: Performance Analysis of Cache-Assisted CoMP for Cellular-Connected UAVs](https://mlsanity.com/paper/1811.11098/) (2018)
- [Cooperative Transmission and Probabilistic Caching for Clustered D2D Networks](https://mlsanity.com/paper/1811.11099/) (2018)
- [Performance Analysis of Mobile Cellular-Connected Drones under Practical Antenna Configurations](https://mlsanity.com/paper/2002.00294/) (2020)
- [Optimizing Joint Probabilistic Caching and Channel Access for Clustered D2D Networks](https://mlsanity.com/paper/2003.02676/) (2020)

## Built on by (most cited first, 3 of 3)

- [FeSHI: Feature Map Based Stealthy Hardware Intrinsic Attack](https://mlsanity.com/paper/2106.06895/) (2021)
- [Security Analysis of Capsule Network Inference using Horizontal Collaboration](https://mlsanity.com/paper/2109.11041/) (2021)
- [Towards Enabling Dynamic Convolution Neural Network Inference for Edge Intelligence](https://mlsanity.com/paper/2202.09461/) (2022)

## Abstract (arXiv)

Security of inference phase deployment of Convolutional neural network (CNN) into resource constrained embedded systems (e.g. low end FPGAs) is a growing research area. Using secure practices, third party FPGA designers can be provided with no knowledge of initial and final classification layers. In this work, we demonstrate that hardware intrinsic attack (HIA) in such a "secure" design is still possible. Proposed HIA is inserted inside mathematical operations of individual layers of CNN, which propagates erroneous operations in all the subsequent CNN layers that lead to misclassification. The attack is non-periodic and completely random, hence it becomes difficult to detect. Five different attack scenarios with respect to each CNN layer are designed and evaluated based on the overhead resources and the rate of triggering in comparison to the original implementation. Our results for two CNN architectures show that in all the attack scenarios, additional latency is negligible (<0.61%), increment in DSP, LUT, FF is also less than 2.36%. Three attack scenarios do not require any additional BRAM resources, while in two scenarios BRAM increases, which compensates with the corresponding decrease in FF and LUTs. To the authors' best knowledge this work is the first to address the hardware intrinsic CNN attack with the attacker does not have knowledge of the full CNN.