CAREER: Dependable and Secure Machine Learning Acceleration from Untrusted Hardware

在机器学习(ML)模型和计算硬件的进步的推动下，智能正在从云到边缘成为一个家喻户晓的品牌，改变着各行各业。对于以安全和安保为主要要求的智能系统，如自动驾驶汽车和无医生诊所，确保推理的可靠性至关重要。不幸的是，目前的硬件不能提供这样的承诺。推理执行可能会受到内存、逻辑等硬件组件上的被动故障或主动物理故障攻击的干扰。虽然已经有从数据角度进行的相关研究，但硬件环境中的问题是不同的，而且远未被探索。这个职业项目旨在创建一种保护ML执行免受被动硬件故障和主动故障攻击的新范例，重点是通过设计将推理可靠性主动地植根到ML处理中。与以往反应式硬件故障修复或基于硬件安全的解决方案不同，该项目的新颖性在于ML处理内部的新能力开发，即“多用途神经元”，以及围绕此对ML算法、硬件架构和硬件安全的跨层探索。该项目的更广泛的意义和重要性是：1)提供实用的解决方案，以确保安全、医疗保健、自动化系统和其他领域的加速人工智能(AI)服务的信任根源；2)推动AI算法、硬件和安全设计之间的互动；3)提供丰富的教育机会和外联活动，以培养和吸引来自代表不足的群体和K-12社区的学生。该项目旨在通过算法-硬件-安全的协同设计，为硬件加速器开发以多用途神经元为中心的ML推理保护方法，并保证通用性、可扩展性、可行性和持久性。该项目包括三个方面的内容：1)通过“编码神经元”和硬件优化提高离线容错能力，而不假设事先有固定的攻击可用(通用性)；2)通过“守护神经元”、专用训练方法和硬件设计(可扩展性)在线缓解多重故障；3)通过基于“蜜神经元”和信任执行环境(持久性)构建的实时主动解决方案来防御强和自适应攻击。对推理准确性、延迟和硬件开销的影响将在所有推力中降至最低(可行性)。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Fueled by the advancements of machine learning (ML) models and computing hardware, intelligence is becoming a household brand from cloud to edge, transforming every walk of life. For intelligent systems with safety and security as their primary requirements, such as autonomous vehicles and doctorless clinics, ensuring inference dependability is essential. Unfortunately, current hardware cannot provide such a promise. The inference execution can be disturbed by either passive faults or active physical fault attacks on hardware components like memory, logic. While there have been relevant studies from the perspective of data, the problem in the context of hardware is different and far less explored. This CAREER project aims to create a new paradigm of safeguarding ML execution against both passive hardware faults and active fault attacks, with a focus on proactively rooting inference dependability into ML processing by design. Unlike prior reactive hardware bug repair or hardware security-based solutions, which do not closely embrace ML's distinct properties, the project's novelties lie in the new capability development inside ML processing, namely "Multi-Purposed Neuron", and the cross-layer exploration of ML algorithm, hardware architecture and hardware security centered around this. The project's broader significance and importance are: 1) yield practical solutions for ensuring the root of trust of accelerated artificial intelligence (AI) services in security, healthcare, automated systems, and other domains; 2) advance the state-of-the-art on the interactions among AI algorithm, hardware, and security design; 3) provide abundant educational opportunities and outreach activities to nurture and attract students from underrepresented groups and the K-12 community. The project seeks to develop "Multi-Purposed Neuron"-centered ML inference protection methodologies for hardware accelerators through algorithm-hardware-security co-design, with guarantees of generality, scalability, feasibility, and durability. The project consists of three thrusts: 1) Improve fault tolerance offline through "Coded Neurons" and hardware optimization without assuming a fixed attack available prior (Generality); 2) Mitigate multiple faults online via "Guarded Neurons", dedicated training methods and hardware design (Scalability); 3) Defend against strong and adaptive attacks by real time proactive solutions built upon "Honey Neurons" and Trust Execution Environment (Durability). The impact on inference accuracy, latency and hardware overhead will be minimized across all thrusts (Feasibility).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.