# Attacking Deep Learning AI Hardware with Universal Adversarial Perturbation

arXiv: https://arxiv.org/abs/2111.09488 · HTML: https://mlsanity.com/paper/2111.09488/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 52 references that are in the map.
- First posted on arXiv 18 Nov 2021.

## Builds on (most cited first, 23 of 23)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Practical Black-Box Attacks against Machine Learning](https://mlsanity.com/paper/1602.02697/) (2016)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [In-Datacenter Performance Analysis of a Tensor Processing Unit](https://mlsanity.com/paper/1704.04760/) (2017)
- [STRIP: A Defence Against Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/1902.06531/) (2019)
- [Efficient Processing of Deep Neural Networks: A Tutorial and Survey](https://mlsanity.com/paper/1703.09039/) (2017)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems](https://mlsanity.com/paper/1812.00292/) (2018)
- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [Defense against Universal Adversarial Perturbations](https://mlsanity.com/paper/1711.05929/) (2017)
- [Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection](https://mlsanity.com/paper/2006.16545/) (2020)
- [Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks](https://mlsanity.com/paper/1905.12032/) (2019)
- [Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers](https://mlsanity.com/paper/2004.11514/) (2020)
- [Hardware Trojan Attacks on Neural Networks](https://mlsanity.com/paper/1806.05768/) (2018)
- [Live Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/2004.11370/) (2020)
- [Hu-Fu: Hardware and Software Collaborative Attack Framework against Neural Networks](https://mlsanity.com/paper/1805.05098/) (2018)
- [Revisiting RowHammer: An Experimental Analysis of Modern DRAM Devices and Mitigation Techniques](https://mlsanity.com/paper/2005.13121/) (2020)
- [Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers](https://mlsanity.com/paper/2003.04498/) (2020)
- [Programmable Neural Network Trojan for Pre-Trained Feature Extractor](https://mlsanity.com/paper/1901.07766/) (2019)
- [Designing Efficient and High-performance AI Accelerators with Customized STT-MRAM](https://mlsanity.com/paper/2104.02199/) (2021)

## Abstract (arXiv)

Universal Adversarial Perturbations are image-agnostic and model-independent noise that when added with any image can mislead the trained Deep Convolutional Neural Networks into the wrong prediction. Since these Universal Adversarial Perturbations can seriously jeopardize the security and integrity of practical Deep Learning applications, existing techniques use additional neural networks to detect the existence of these noises at the input image source. In this paper, we demonstrate an attack strategy that when activated by rogue means (e.g., malware, trojan) can bypass these existing countermeasures by augmenting the adversarial noise at the AI hardware accelerator stage. We demonstrate the accelerator-level universal adversarial noise attack on several deep Learning models using co-simulation of the software kernel of Conv2D function and the Verilog RTL model of the hardware under the FuseSoC environment.