The wide deployment of Deep Neural Networks (DNN) in high-performance cloud
computing platforms brought to light multi-tenant cloud field-programmable gate
arrays (FPGA) as a popular choice of accelerator to boost performance due to
its hardware reprogramming flexibility. Such a multi-tenant FPGA setup for DNN
acceleration potentially exposes DNN interference tasks under severe threat
from malicious users. This work, to the best of our knowledge, is the first to
explore DNN model vulnerabilities in multi-tenant FPGAs. We propose a novel
adversarial attack framework: Deep-Dup, in which the adversarial tenant can
inject adversarial faults to the DNN model in the victim tenant of FPGA.
Specifically, she can aggressively overload the shared power distribution
system of FPGA with malicious power-plundering circuits, achieving adversarial
weight duplication (AWD) hardware attack that duplicates certain DNN weight
packages during data transmission between off-chip memory and on-chip buffer,
to hijack the DNN function of the victim tenant. Further, to identify the most
vulnerable DNN weight packages for a given malicious objective, we propose a
generic vulnerable weight package searching algorithm, called Progressive
Differential Evolution Search (P-DES), which is, for the first time, adaptive
to both deep learning white-box and black-box attack models. The proposed
Deep-Dup is experimentally validated in a developed multi-tenant FPGA
prototype, for two popular deep learning applications, i.e., Object Detection
and Image Classification. Successful attacks are demonstrated in six popular
DNN architectures (e.g., YOLOv2, ResNet-50, MobileNet, etc.)

本文研究了多住户云场可编程门阵列中 DNN 模型容易受到攻击的问题，并提出了一种名为 Deep-Dup 的新型对抗性攻击框架，借助恶意用户可以利用恶意电力抢夺电路对 FPGA 进行攻击，在数据传输过程中重复 DNN 权重包以劫持受害住户的 DNN 功能，并提出名为 P-DES 的通用易受攻击的 DNN 权重包搜索算法，该算法是自适应于白盒和黑盒攻击模型的。