Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in Embedded Neural Networks
2026-07-10 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied how physical faults (like glitches) in tiny computers running neural networks can be combined with sneaky algorithm tricks called backdoors to create hidden attacks. They developed a precise way to inject faults that change the neural network's middle calculations without affecting normal inputs, making the attack hard to detect. Their approach uses physical fault triggers to activate backdoors only when faults happen, fooling the system while staying invisible during normal use. They tested this on common embedded devices and showed that current defenses, which expect attacks from normal inputs, may not catch these new fault-based backdoors.
Fault InjectionNeural NetworksBackdoor AttackEmbedded SystemsAdversarial AttacksFeature MapARM Cortex-M4Electromagnetic Fault InjectionSystem SecurityAlgorithmic Threats
Authors
Steyn Hommes, Vincent Dankbaar, Tanguy Stekke, Xiaomeng Wang, Lisanne Weidmann, Senna van Hoek, Durba Chatterjee, Lejla Batina, Zhuoran Liu
Abstract
Fault injection (FI) attacks on embedded neural network (NN) implementations primarily focus on inducing misclassification by corrupting weights or intermediate computations, overlooking their interaction with algorithmic adversarial threats. In this work, we present a cross-level attack that bridges implementation-level physical faults to algorithm-level adversarial attacks. By characterizing fault-induced data perturbations during NN inference, we connect FI with backdoor learning, enabling system-level attacks that jointly exploit implementation- and algorithm-level vulnerabilities. Specifically, we propose a precise fault-injection method that reliably manipulates targeted register values to tractable states during execution. Leveraging this level of FI precision, we propose a novel end-to-end feature map-level backdoor attack, where physically induced intermediate perturbations serve as stealthy triggers. Unlike conventional input-based backdoors, our trigger is activated only under physical faults, causing the NN to exhibit adversarial behavior that compromises system integrity while remaining benign during normal operation. We demonstrate that such physically triggered backdoors can be mounted on embedded NN platforms and remain effective against existing backdoor defenses that typically assume input-space triggers. We showcase the attack practicality using electromagnetic FI on convolutional neural networks implemented on ARM Cortex-M4 microcontroller, which is a common platform for constrained embedded applications. Our results highlight a novel attack vector at the intersection of hardware and algorithmic levels, stressing the need for defenses across abstraction levels.