Collaborative Research: SaTC: CORE: Small: Secure and Robust Machine Learning in Multi-Tenant Cloud FPGA

随着云计算市场的快速增长和机器学习(ML)计算的关键发展，云-FPGA(现场可编程门阵列)已经成为公共租赁的重要硬件资源，其中多个租户可以随着时间的推移甚至同时共存并共享一片FPGA芯片。在多租户云-现场可编程门阵列环境中，随着多个硬件资源的共同使用，形成了一个独特的攻击面，恶意租户可以利用这种间接交互来操纵其他租户的电路应用，例如，故意注入故障。以往的研究表明，即使在黑盒攻击场景下，片外存储器和片上缓冲区之间ML模型参数传输的微小但精心设计的扰动也可能导致ML智能完全故障，对未来的ML Cloud-FPGA系统构成前所未有的威胁。该项目(1)旨在了解多租户ML Cloud-FPGA系统的脆弱性并探索防御方法，在云计算领域对产业界和学术界都是至关重要的和及时的；(2)提高ML云系统的安全性，防止基于硬件的模型篡改多租户Cloud-FPGA计算基础设施中的片外数据传输；以及(3)在新课程开发、本科生和研究生培训以及通过K-12外联计划促进女性和代表性不足的少数族裔在STEM中的应用方面，将研究成果与教育相结合。本项目将ML算法安全与FPGA硬件安全相结合，遵循软硬件协同设计机制，探索提高多租户ML云-FPGA系统安全性的新方案。它包括三个研究推动力。系统地研究、建模和刻画了一种对抗性权重复制硬件故障注入方法，该方法利用恶意租户中的侵略性权力掠夺电路向受害租户的ML模型注入故障。研究了多种ML算法，以增强ML模型在从片外存储器传输到片上缓冲区的过程中对模型参数注入敌意故障时的内在健壮性和弹性。该奖项反映了NSF的法定使命，通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为是值得支持的。

Alongside the rapid growth of cloud-computing market and critical developments in machine learning (ML) computation, the cloud-FPGA (Field Programmable Gate Arrays) has become a vital hardware resource for public lease, where multiple tenants can co-reside and share an FPGA chip over time or even simultaneously. With many hardware resources being jointly used in the multi-tenant cloud-FPGA environment, a unique attack surface is created, where a malicious tenant can leverage such indirect interaction to manipulate the circuit application of other tenants, e.g., intentionally injecting faults. It has been demonstrated in prior research that small, but carefully designed, perturbation of the ML model parameter transmission between off-chip memory and on-chip buffer could completely malfunction ML intelligence, even under black-box attack scenario, posing an unprecedented threat to future ML cloud-FPGA system. This project (1) targets to understand the vulnerability of multi-tenant ML cloud-FPGA systems and explore defensive approaches, which are crucial and timely for both industry and academia in the cloud-FPGA computing domain; (2) advances the security of ML cloud system against hardware-based model tampering on off-chip data transmission in multi-tenant cloud-FPGA computing infrastructure; and (3) integrates the research outcomes with education in terms of new curriculum development, undergraduate and graduate student training, as well as promoting women and underrepresented minorities in STEM through K-12 outreach programs. This project integrates ML algorithm security and FPGA hardware security to follow a software-hardware co-design mechanism, exploring novel solutions that improve the security of multi-tenant ML cloud-FPGA system. It consists of three research thrusts. Thrust-1 systematically studies, models, and characterizes an adversarial weight duplication hardware fault injection method, which leverages aggressive power-plundering circuits in malicious tenant to inject fault into the victim tenant's ML model. Thrust-2 explores various ML algorithmic methodologies to enhance the intrinsic robustness and resiliency of ML model against adversarial fault injection into model parameters during the transmission from off-chip memory to on-chip buffer. Thrust-3 investigates FPGA system-level tamper-resistant approaches to further provide comprehensive solutions to improve the ML-FPGA system security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.