Neural network implementations are known to be vulnerable to physical attack vectors such as fault injection attacks. As of now, these attacks were only utilized during the inference phase with the intention to cause a misclassification. In this work, we explore a novel attack paradigm by injecting faults during the training phase of a neural network in a way that the resulting network can be attacked during deployment without the necessity of further faulting. In particular, we discuss attacks against ReLU activation functions that make it possible to generate a family of malicious inputs, which are called fooling inputs, to be used at inference time to induce controlled misclassifications. Such malicious inputs are obtained by mathematically solving a system of linear equations that would cause a particular behaviour on the attacked activation functions, similar to the one induced in training through faulting. We call such attacks fooling backdoors as the fault attacks at the training phase inject backdoors into the network that allow an attacker to produce fooling inputs. We evaluate our approach against multi-layer perceptron networks and convolutional networks on a popular image classification task obtaining high attack success rates (from 60% to 100%) and high classification confidence when as little as 25 neurons are attacked while preserving high accuracy on the originally intended classification task.

翻译：神经网络实现已知易受物理攻击向量影响，例如故障注入攻击。迄今为止，此类攻击仅在推理阶段被利用，旨在引发分类错误。在本研究中，我们探索了一种新的攻击范式，通过在神经网络训练阶段注入故障，使得生成的网络在部署阶段无需进一步故障即可被攻击。具体而言，我们讨论了针对ReLU激活函数的攻击，这些攻击能够生成一系列恶意输入，称为欺骗输入，在推理时用于诱导受控的分类错误。此类恶意输入通过数学求解线性方程组获得，该方程组会在受攻击的激活函数上引发特定行为，类似于训练阶段通过故障诱导的行为。我们将这类攻击称为欺骗后门，因为训练阶段的故障攻击在网络中注入了后门，使攻击者能够生成欺骗输入。我们在流行的图像分类任务上，对多层感知器网络和卷积网络评估了该方法，获得了较高的攻击成功率（60%至100%）和高分类置信度，仅需攻击25个神经元，同时保持原始分类任务的高精度。