Graphics Processing Units (GPU) are widely used as deep learning accelerators because of its high performance and low power consumption. Additionally, it remains secure against hardware-induced transient fault injection attacks, a classic type of attacks that have been developed on other computing platforms. In this work, we demonstrate that well-trained machine learning models are robust against hardware fault injection attacks when the faults are generated randomly. However, we discover that these models have components, which we refer to as sensitive targets, that are vulnerable to faults. By exploiting this vulnerability, we propose the Lightning attack, which precisely strikes the model’s sensitive targets with hardware-induced transient faults based on the Dynamic Voltage and Frequency Scaling (DVFS). We design a sensitive targets search algorithm to find the most critical processing units of Deep Neural Network (DNN) models determining the inference results, and develop a genetic algorithm to automatically optimize the attack parameters for DVFS to induce faults. Experiments on three commodity Nvidia GPUs for four widely-used DNN models show that the proposed Lightning attack can reduce the inference accuracy by 69.1% on average for non-targeted attacks, and, more interestingly, achieve a success rate of 67.9% for targeted attacks.

With advancements in chip technology, the number of cores in modern commercial processors continues to rise, leading to increased complexity in interconnects and on-chip networks. This complexity, however, exposes significant security vulnerabilities, primarily in the form of side-channel and covert-channel exploits. Unlike other microarchitectural side-channel attacks, those leveraging on-chip interconnects utilize unique characteristics, allowing attackers to develop novel methods that can bypass existing effective defenses. In this paper, we present a comprehensive survey of current side-channel and covert-channel attacks based on processor-on-chip interconnects. We categorize these attacks into three types: contention-based, distance-based, and layout-based, according to the specific interconnect characteristics they exploit, and discuss corresponding countermeasures for each. Finally, we provide an outlook on future development trends in processor interconnect side channels. This survey is the first to specifically focus on interconnect-based side channels in processors.

Performance Monitor Unit (PMU) is an important hardware module in mainstream processors, which counts various architectural and microarchitectural events during the run-time of the processor. Theoretically, if an instruction is executed but doesn’t successfully retire (this is called transient execution), the events it triggers needn’t be recorded by PMU. However, in this study, we discover that current PMU implementations are capable of recording some events that are triggered in transient executions, which is a hardware vulnerability. Based on this vulnerability, we propose the attack, a new kind of side channel attack that enables attackers to maliciously leak secret data in transient executions. We perform a thorough study of PMU counters on five Intel processors and find that they all have vulnerable PMU counters that will measure transient execution events (there are 162 vulnerable PMU counters among all the 383 PMU counters). We demonstrate on real hardware that 112 vulnerable PMU counters can be utilized in attack to leak the secret data protected by Intel Software Guard Extensions (SGX). Besides, our experiments suggest that the throughput of attack is up to 291.2 bytes per second (Bps) with an error rate of 2.45% on average. This discovery and the corresponding mitigation methods can be helpful for microarchitecture designers to reevaluate the security risks induced by the PMU module.

With the rapid proliferation of crowd mobility data produced by ubiquitous mobile devices equipped with spatial positioning modules, deep neural networks (DNNs) have become widely applied in spatio-temporal trajectory modeling. However, recent studies have shown that DNNs are vulnerable to adversarial examples with strong transferability, which are crafted by introducing small perturbations to original examples but can cause catastrophic mistakes. To mitigate this vulnerability and enhance model robustness, we propose a novel self-supervised collaborative learning framework named Auto-GAN that consists of a generator for automatically learning robust latent features and a discriminator for providing comprehensive guidance to the generator. By leveraging the collaboration between the generator and discriminator, our proposed method significantly improves the denoising performance. Moreover, we combine point-level and feature-level constraints into training processes between original example reconstruction and adversarial example denoising, thereby effectively suppressing the potential “error amplification effect". Extensive experiments conducted on two representative real-world mobility datasets show that our proposed method can significantly enhance the model’s robustness against various adversarial attacks, while preserving the model’s prediction accuracy on original examples.

Recent research has unveiled numerous cache-timing side-channel attacks exploiting the side effects of fine-grained cache features, such as coherence protocol and prefetch, among others. Traditional modeling methods and verification techniques are insufficient for verifying caches with fine-grained features and detecting cache timing vulnerabilities. There is a necessity for comprehensive verification of such complex cache designs. This paper presents SCAFinder, a verification framework targeting the cache designs with fine-grained features; it identifies cache side-channel attacks through model checking techniques. Specifically, it proposes a modeling methodology for cache designs that enables us to abstract the cache’s behavior and latency characteristics. We implement a search algorithm for finding all counterexamples based on open-source model checking software. Subsequently, we add an attack scenario analysis module to discover attacks applicable to specific scenarios. We evaluate SCAFinder on Intel Skylake-X microarchitecture, demonstrating its capability to generate 7 new attack sequences exploiting coherence protocol and prefetch, and 12 new replacement policy-based side channels. As a case study, we successfully built a covert channel for one of the sequences on the real-world processor. To the best of our knowledge, we are the first to implement cross-core replacement policy-based attacks on non-inclusive caches.