Presentation
The Last Line of Defense in DNN Inference: Argmax Security Under Combined Power Side-Channel and Fault Injection Attack
DescriptionDeep Neural Network (DNN) edge devices are increasingly vulnerable to severe hardware security threats, particularly side-channel attacks (SCA) and fault injection attacks (FIA). This paper, for the first time, presents a combined side-channel and fault injection attack framework targeting the ArgMax unit—the hardware component responsible for converting output probabilities into the final class prediction and serving as the decision logic in DNN inference. An adversary can recover intermediate prediction values through SCA and subsequently manipulate the ArgMax decision via FIA to induce targeted misclassification. On an unprotected ArgMax, our attack achieved a 56.92% targeted misclassification success rate with full controllability across all classes, demonstrating its practical feasibility and high threat potential. To counter these threats, we introduce Shuffled-ArgMax, a lightweight defense scheme designed to resist combined SCA–FIA attacks. Using the power side-channel and voltage fault injection capabilities of the hardware security evaluation platform, CrackNuts, we evaluate a convolutional neural network deployed on an STM32F407 microcontroller. Experimental results demonstrate that Shuffled-ArgMax significantly suppresses side-channel leakage and enhances robustness against practical fault injection attacks.
Event Type
Work in Progress
TimeMonday, July 276:33pm - 6:34pm PDT
LocationExhibit Hall