Hardware-Triggered Backdoors

TL;DR

This paper introduces a novel hardware-triggered backdoor attack in machine learning models, exploiting hardware-induced numerical variations to manipulate model predictions across different hardware platforms.

Contribution

It demonstrates a new type of backdoor attack leveraging hardware-induced numerical deviations, highlighting a previously unknown security vulnerability in ML deployment.

Findings

Backdoors can be reliably triggered across GPU accelerators.

Hardware variations can be exploited to flip model predictions.

The paper explores potential defenses against this attack.

Abstract

Machine learning models are routinely deployed on a wide range of computing hardware. Although such hardware is typically expected to produce identical results, differences in its design can lead to small numerical variations during inference. In this work, we show that these variations can be exploited to create backdoors in machine learning models. The core idea is to shape the model's decision function such that it yields different predictions for the same input when executed on different hardware. This effect is achieved by locally moving the decision boundary close to a target input and then refining numerical deviations to flip the prediction on selected hardware. We empirically demonstrate that these hardware-triggered backdoors can be created reliably across common GPU accelerators. Our findings reveal a novel attack vector affecting the use of third-party models, and we investigate different defenses to counter this threat.