As artificial intelligence plays an increasingly important role in decision-making within critical infrastructure, ensuring the authenticity and integrity of neural networks is crucial. This paper addresses the problem of detecting cloned neural networks. We present a method for identifying clones that employs a combination of metrics from both the information and physical domains: output predictions, probability score vectors, and power traces measured from the device running the neural network during inference. We compare the effectiveness of each metric individually, as well as in combination. Our results show that the effectiveness of both the information and the physical domain metrics is excellent for a clone that is a near replica of the target neural network. Furthermore, both the physical domain metric individually and the hybrid approach outperform the information domain metrics at detecting clones whose weights were extracted with low accuracy. The presented method offers a practical solution for verifying neural network authenticity and integrity. It is particularly useful in scenarios where neural networks are at risk of model extraction attacks, such as in cloud-based machine learning services.

At present, the state-of-the-art cloud FPGA deployment process does not allow the cloud provider to perform design checks for malicious circuits unless the clients' designs are available in an unprotected form. In this paper, we introduce the circuit disguise method that allows the design checks to be performed without disclosing the clients' Intellectual Property (IP). The method is based on a lossy circuit transformation that generates a compressed version of the netlist specifying the client's design. While the design checks can still be performed on the compressed version of the netlist, reversing the transformation to recover the original design is not possible. The circuit disguise method can be used in combination with bitstream encryption. This enables the clients to protect not only the designs but also the bitstreams. Furthermore, with circuit disguise, new design checks can be performed on designs that are already compiled into a protected bitstream. We present an implementation of the circuit disguise method and demonstrate its effectiveness with various benign and malicious benchmark designs. The implementation is publicly available.

In this paper, we present the first near-field electro-magnetic (EM) sensor that is entirely implemented in the FPGA configurable fabric, without the use of any peripherals such as analog-to-digital converters, external antennas, or resistor-capacitor circuits. The sensor detects changes in path delays caused by external EM radiation using an antenna (composed of the interconnect) and a time-to-digital converter. A cloud-based FPGA remotely configured with such a sensor may act as a receiving end of a wireless covert channel, e.g., to another FPGA in the neighborhood that does not share any common resources with the receiving FPGA. Thus, our results show the plausibility of an exploitable attack vector for cloud-based FPGA that is not limited to the multi-tenancy scenario.

A hidden transmitter embedded into a chip to extract secret information is a well-known type of hardware Trojan. Various ways of implementing covert channels have been proposed in the past. The focus of this paper is covert antennas created from the FPGA interconnect. We present several on-chip antenna implementations that leverage the routing resources of FPGAs. The proposed antennas can transmit data processed by the FPGA with bit-level precision. A near-field probe is used to capture the radiated signal and the transmitted data is restored with 100% accuracy. Our results suggest that introducing a routine screening process for covert antennas in FPGA designs, similar to the one performed for ring oscillators, would be of benefit for FPGA security.

Today's power/EM side-channel analysis is limited by the complexity of the target hardware. We investigate the feasibility of power/EM side-channel analysis of general-purpose computers. This paper makes a step towards this goal by analyzing memory operations of Raspberry Pi 3 Model B, a widely used general-purpose IoT device that is capable of running an operating system, and shows that it is possible to extract information about the data field of memory operations from near-field EM measurements.

The need of protecting data and bitstreams increases in computation environments such as FPGA as a Service (FaaS). Physically Unclonable Functions (PUFs) have been proposed as a solution to this problem. In this paper, we present an implementation of Arbiter PUF with 4 x 4 switch blocks in Xilinx Series 7 FPGA, perform its statistical analysis, and compare it to other Arbiter PUF variants. We show that the presented implementation utilizes five times less area than 2 x 2 Arbiter PUF-based implementations. It is suitable for many real-world applications, including identification, authentication, key provisioning, and random number generation.

As artificial intelligence plays an increasingly important role in decision-making within critical infrastructure, ensuring the authenticity and integrity of neural networks is crucial. This paper addresses the problem of detecting cloned neural networks. We present a method for identifying clones that employs a combination of metrics from both the information and physical domains: output predictions, probability score vectors, and power traces measured from the device running the neural network during inference. We compare the effectiveness of each metric individually, as well as in combination. Our results show that the effectiveness of both the information and the physical domain metrics is excellent for a clone that is a near replica of the target neural network. Furthermore, both the physical domain metric individually and the hybrid approach outperformed the information domain metrics at detecting clones whose weights were extracted with low accuracy. The presented method offers a practical solution for verifying neural network authenticity and integrity. It is particularly useful in scenarios where neural networks are at risk of model extraction attacks, such as in cloud-based machine learning services.