CAREER: Protecting Deep Learning Systems against Hardware-Oriented Vulnerabilities

人工智能（AI）最近在许多应用中已经接近甚至超过了人类的水平。然而，人工智能的成功部署需要在模型生命周期的所有阶段对所有类型的对抗性攻击具有足够的鲁棒性。尽管在增强人工智能算法的鲁棒性方面取得了很大进展，但缺乏对面向硬件的漏洞和对策的系统研究，这也为人工智能安全教育开辟了需求。鉴于这一迫切需求，该项目旨在探索新的面向硬件的对抗性人工智能概念，并开发针对此类漏洞的基本防御策略，以保护下一代人工智能系统。这个项目有四个重点。在Thrust 1中，该项目将利用对深度神经网络系统的新型对抗性攻击，其特点是设计一种算法-硬件协同后门攻击。然后在推力2中，它将开发将硬件方面纳入防御的方法，以增强对抗不可信半导体供应链中的漏洞的健壮性。随后，在Thrust 3中，该项目将开发新的签名嵌入框架，以保护不可信模型构建供应链中深度神经网络模型的完整性，最后在Thrust 4中，它将建模恢复策略作为一种创新方法，以减轻不可信用户空间中面向硬件的故障攻击。该项目将产生新的方法，从算法和硬件的角度确保对人工智能系统的信任，以满足未来商业产品和国防的需求。此外，它还将促进包括医疗保健、自动驾驶汽车和物联网（IoT）在内的广泛领域的新兴人工智能应用的进步，从而引发人工智能在移动和边缘设备中的广泛实施。本项目开发的新理论和技术将融入本科和研究生教育，并用于提高公众意识，促进对人工智能安全重要性的理解。本项目产生的数据、代码和结果将在适当的时候存储在克莱姆森大学霍尔库姆电气与计算机工程系管理的研究数据库中。所有数据将在本项目结束后至少保留5年，或在发表后至少保留5年，以较晚者为准。如果对研究的询问或调查产生问题，则适用较长的时间。项目储存库将在http://ylao.people.clemson.edu/hardware_AI_securityThis奖下维护，这反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Artificial intelligence (AI) has recently approached or even surpassed human-level performance in many applications. However, the successful deployment of AI requires sufficient robustness against adversarial attacks of all types and in all phases of the model life cycle. Although much progress has been made in enhancing the robustness of AI algorithms, there is a lack of systematic studies on hardware-oriented vulnerabilities and countermeasures, which also opens up demand for AI security education. Given this pressing need, this project aims at exploring novel hardware-oriented adversarial AI concepts and developing fundamental defensive strategies against such vulnerabilities to protect next-generation AI systems. This project has four thrusts. In Thrust 1, this project will exploit new adversarial attacks on deep neural network systems, featuring the design of an algorithm-hardware collaborative backdoor attack. Then in Thrust 2, it will develop methodologies that incorporate the hardware aspect into defense for enhancing adversarial robustness against vulnerabilities in the untrusted semiconductor supply chain. Subsequently, in Thrust 3, this project will develop novel signature embedding frameworks to protect the integrity of deep neural network models in the untrusted model building supply chain and finally in Thrust 4, it will model recovery strategies as an innovative approach to mitigate hardware-oriented fault attacks in the untrusted user-space.This project will yield novel methodologies for ensuring trust in AI systems from both the algorithm and hardware perspectives to meet the future needs of commercial products and national defense. In addition, it will catalyze advances in emerging AI applications across a broad range of sectors, including healthcare, autonomous vehicles, and Internet of things (IoT), triggering widespread implementation of AI in mobile and edge devices. New theories and techniques developed in this project will be integrated into undergraduate and graduate education and used to raise public awareness and promote understanding of the importance of AI security.Data, code and results generated in this project will be stored when appropriate in the research database managed by the Holcombe Department of Electrical and Computer Engineering at Clemson University. All data will be retained for at least five years after the end of this project or at least five years after publications, whichever is later. Longer periods will apply when questions arise from inquiries or investigations with respect to research. The project repository will be maintained under http://ylao.people.clemson.edu/hardware_AI_securityThis award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.