# FeSHI: Feature Map Based Stealthy Hardware Intrinsic Attack

arXiv: https://arxiv.org/abs/2106.06895 · HTML: https://mlsanity.com/paper/2106.06895/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 45 references that are in the map.
- First posted on arXiv 13 Jun 2021.

## Builds on (most cited first, 13 of 13)

- [STRIP: A Defence Against Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/1902.06531/) (2019)
- [Maximizing CNN Accelerator Efficiency Through Resource Partitioning](https://mlsanity.com/paper/1607.00064/) (2016)
- [Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems](https://mlsanity.com/paper/1908.03369/) (2019)
- [Yedrouj-Net: An efficient CNN for spatial steganalysis](https://mlsanity.com/paper/1803.00407/) (2018)
- [Hardware Trojan Attacks on Neural Networks](https://mlsanity.com/paper/1806.05768/) (2018)
- [OpenEI: An Open Framework for Edge Intelligence](https://mlsanity.com/paper/1906.01864/) (2019)
- [PoTrojan: powerful neural-level trojan designs in deep learning models](https://mlsanity.com/paper/1802.03043/) (2018)
- [TAD: Trigger Approximation based Black-box Trojan Detection for AI](https://mlsanity.com/paper/2102.01815/) (2021)
- [TrISec: Training Data-Unaware Imperceptible Security Attacks on Deep Neural Networks](https://mlsanity.com/paper/1811.01031/) (2018)
- [FAdeML: Understanding the Impact of Pre-Processing Noise Filtering on Adversarial Machine Learning](https://mlsanity.com/paper/1811.01444/) (2018)
- [2L-3W: 2-Level 3-Way Hardware-Software Co-Verification for the Mapping of Deep Learning Architecture (DLA) onto FPGA Boards](https://mlsanity.com/paper/1911.05944/) (2019)
- [SoWaF: Shuffling of Weights and Feature Maps: A Novel Hardware Intrinsic Attack (HIA) on Convolutional Neural Network (CNN)](https://mlsanity.com/paper/2103.09327/) (2021)
- [An FPGA Implementation of Convolutional Spiking Neural Networks for Radioisotope Identification](https://mlsanity.com/paper/2102.12565/) (2021)

## Built on by (most cited first, 1 of 1)

- [Towards Enabling Dynamic Convolution Neural Network Inference for Edge Intelligence](https://mlsanity.com/paper/2202.09461/) (2022)

## Abstract (arXiv)

To reduce the time-to-market and access to state-of-the-art techniques, CNN hardware mapping and deployment on embedded accelerators are often outsourced to untrusted third parties, which is going to be more prevalent in futuristic artificial intelligence of things (AIoT) systems. These AIoT systems anticipate horizontal collaboration among different resource-constrained AIoT node devices, where CNN layers are partitioned and these devices collaboratively compute complex CNN tasks. This horizontal collaboration opens another attack surface to the CNN-based application, like inserting the hardware Trojans (HT) into the embedded accelerators designed for the CNN. Therefore, there is a dire need to explore this attack surface for designing secure embedded hardware accelerators for CNNs. Towards this goal, in this paper, we exploited this attack surface to propose an HT-based attack called FeSHI. Since in horizontal collaboration of RC AIoT devices different sections of CNN architectures are outsourced to different untrusted third parties, the attacker may not know the input image, but it has access to the layer-by-layer output feature maps information for the assigned sections of the CNN architecture. This attack exploits the statistical distribution, i.e., Gaussian distribution, of the layer-by-layer feature maps of the CNN to design two triggers for stealthy HT with a very low probability of triggering. Also, three different novel, stealthy and effective trigger designs are proposed.