CAREER: Protecting Deep Learning Systems against Hardware-Oriented Vulnerabilities

人工智能(AI)最近在许多应用中已经接近甚至超过了人类的水平。然而，人工智能的成功部署需要在模型生命周期的所有阶段针对所有类型的对抗性攻击具有足够的健壮性。虽然在增强AI算法的健壮性方面已经取得了很大的进展，但缺乏面向硬件的漏洞和对策的系统研究，这也打开了对AI安全教育的需求。鉴于这一迫切需求，该项目旨在探索新的面向硬件的对抗性人工智能概念，并开发针对此类漏洞的基本防御策略，以保护下一代人工智能系统。这个项目有四个推力。在推力1中，这个项目将利用对深度神经网络系统的新的对抗性攻击，以设计一种算法-硬件协同后门攻击为特色。然后在推力2中，它将开发将硬件方面整合到防御中的方法，以增强针对不受信任的半导体供应链中的漏洞的对手健壮性。随后，在推力3中，该项目将开发新的签名嵌入框架来保护不可信建模供应链中的深层神经网络模型的完整性，最后在推力4中，它将建模恢复策略作为一种创新方法来缓解不可信任用户空间中的面向硬件的故障攻击。该项目将从算法和硬件角度为确保人工智能系统的信任提供新的方法，以满足未来商业产品和国防的需求。此外，它还将推动医疗保健、自动驾驶汽车和物联网(IoT)等广泛行业的新兴人工智能应用取得进展，引发人工智能在移动和边缘设备中的广泛实施。在这个项目中开发的新理论和技术将被整合到本科和研究生教育中，用于提高公众意识和促进对人工智能安全重要性的理解。在这个项目中产生的数据、代码和结果将在适当的时候存储在克莱姆森大学霍尔科姆电气和计算机工程系管理的研究数据库中。所有数据将在本项目结束后保留至少五年，或在出版后至少保留五年，以较晚的时间为准。更长的期限将适用于在研究方面的询问或调查中出现问题的情况。项目库将根据http://ylao.people.clemson.edu/hardware_AI_securityThis的奖励进行维护，这反映了国家科学基金会的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Artificial intelligence (AI) has recently approached or even surpassed human-level performance in many applications. However, the successful deployment of AI requires sufficient robustness against adversarial attacks of all types and in all phases of the model life cycle. Although much progress has been made in enhancing the robustness of AI algorithms, there is a lack of systematic studies on hardware-oriented vulnerabilities and countermeasures, which also opens up demand for AI security education. Given this pressing need, this project aims at exploring novel hardware-oriented adversarial AI concepts and developing fundamental defensive strategies against such vulnerabilities to protect next-generation AI systems. This project has four thrusts. In Thrust 1, this project will exploit new adversarial attacks on deep neural network systems, featuring the design of an algorithm-hardware collaborative backdoor attack. Then in Thrust 2, it will develop methodologies that incorporate the hardware aspect into defense for enhancing adversarial robustness against vulnerabilities in the untrusted semiconductor supply chain. Subsequently, in Thrust 3, this project will develop novel signature embedding frameworks to protect the integrity of deep neural network models in the untrusted model building supply chain and finally in Thrust 4, it will model recovery strategies as an innovative approach to mitigate hardware-oriented fault attacks in the untrusted user-space.This project will yield novel methodologies for ensuring trust in AI systems from both the algorithm and hardware perspectives to meet the future needs of commercial products and national defense. In addition, it will catalyze advances in emerging AI applications across a broad range of sectors, including healthcare, autonomous vehicles, and Internet of things (IoT), triggering widespread implementation of AI in mobile and edge devices. New theories and techniques developed in this project will be integrated into undergraduate and graduate education and used to raise public awareness and promote understanding of the importance of AI security.Data, code and results generated in this project will be stored when appropriate in the research database managed by the Holcombe Department of Electrical and Computer Engineering at Clemson University. All data will be retained for at least five years after the end of this project or at least five years after publications, whichever is later. Longer periods will apply when questions arise from inquiries or investigations with respect to research. The project repository will be maintained under http://ylao.people.clemson.edu/hardware_AI_securityThis award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.