Lightning: Leveraging DVFS-induced Transient Fault Injection to Attack Deep Learning Accelerator of GPUs

• 全文链接
• 请求原文

作   者：

RIHUI SUN;  PENGFEI QIU;  YONGQIANG LYU;  JIAN DONG;  HAIXIA WANG;  DONGSHENG WANG;  GANG QU; 

作者机构：

Harbin Institute of Technology;  Tsinghua University;  University of Maryland;  Beijing University of Posts and Telecommunications; 

关键词：

Deep learning trustworthiness;  Hardware faults;  GPU accelerator;  DVFS; 

期刊名称：

ACM Transactions on Design Automation of Electronic Systems

i s s n：

1084-4309

年卷期：

2024 年 29 卷 1 期

页   码：

14-1-14-22

页   码：

摘   要：

Graphics Processing Units (GPU) are widely used as deep learning accelerators because of its high performance and low power consumption. Additionally, it remains secure against hardware-induced transient fault injection attacks, a classic type of attacks that have been developed on other computing platforms. In this work, we demonstrate that well-trained machine learning models are robust against hardware fault injection attacks when the faults are generated randomly. However, we discover that these models have components, which we refer to as sensitive targets, that are vulnerable to faults. By exploiting this vulnerability, we propose the Lightning attack, which precisely strikes the model's sensitive targets with hardware-induced transient faults based on the Dynamic Voltage and Frequency Scaling (DVFS). We design a sensitive targets search algorithm to find the most critical processing units of Deep Neural Network (DNN) models determining the inference results, and develop a genetic algorithm to automatically optimize the attack parameters for DVFS to induce faults. Experiments on three commodity Nvidia GPUs for four widely-used DNN models show that the proposed Lightning attack can reduce the inference accuracy by 69.1% on average for non-targeted attacks, and, more interestingly, achieve a success rate of 67.9% for targeted attacks.