Differential fuzz testing to detect tampering in sensor systems and its application to arms control authentication

TL;DR

The paper addresses the challenge of authenticating verification hardware and software in nuclear arms control, where tampering can occur across software, firmware, libraries, and environmental factors. It proposes physical differential fuzz testing, which generates a baseline signature by fuzzing a known-good system and then replays inputs to detect tampering via statistically comparing Poisson-noisy outputs. Demonstrations with a NaI gamma-ray spectrometer show that time-based and counts-based tampering produce detectable deviations in a reduced chi-squared metric, with quantified false-alarm and false-negative rates. The approach provides a practical tamper-indicator framework for cyber-physical verification systems in arms control and safeguards, and suggests broader applicability to other high-assurity environments, while noting limitations and directions for future work.

Abstract

In future nuclear arms control treaties, it will be necessary to authenticate the hardware and software components of verification measurement systems, i.e., to ensure these systems are functioning as intended and have not been tampered with by malicious actors. While methods such as source code hashing and static analysis can help verify the integrity of software components, they may not be capable of detecting tampering with environment variables, external libraries, or the firmware and hardware of radiation measurement systems. In this article, we introduce the concept of physical differential fuzz testing as a challenge-response-style tamper indicator that can holistically and simultaneously test all the above components in a cyber-physical system. In essence, we randomly sample (or "fuzz") the untampered system's parameter space, including both normal and off-normal parameter values, and consider the time series of outputs as the baseline signature of the system. Re-running the same input sequence on a untampered system will produce an output sequence consistent with this baseline, while running the same input sequence on a tampered system will produce a modified output sequence and raise an alarm. We then apply this concept to authenticating the radiation measurement equipment in nuclear weapon verification systems and conduct demonstration fuzz testing measurements with a sodium iodide (NaI) gamma ray spectrometer. Because there is Poisson noise in the measured output spectra, we also use a mechanism for comparing inherently noisy or stochastic fuzzing sequences. We show that physical differential fuzz testing can detect two types of tamper attempts, and conclude that it is a promising framework for authenticating future cyber-physical systems in nuclear arms control, safeguards, and beyond.

Figures (7)

• Figure 1: Photograph of the sodium iodide (NaI) detector and source in the demonstration setup.
• Figure 2: Overview of time-based attack detection by fuzzing the system time. Here and in Fig. \ref{['fig:count-detect']}, the pseudocode is merely representative of the full attack code.
• Figure 3: Overview of counts-based attack detection by fuzzing detector parameters that affect total counts.
• Figure 4: Detection of the time-based attack via fuzz testing. Left: sequence of $\chi^2 / \nu$ values from an untampered system. Right: sequence of $\chi^2 / \nu$ values from a tampered system, with $38$ out of $100$ values crossing the $\chi^2 / \nu = 2$ alarm threshold.
• Figure 5: Comparison of two fuzz testing measurement pairs from the tampered system (the last two points in the right panel of Fig. \ref{['fig:time-chi2']}). The tampered system does not execute (does execute) the time-based attack in the top (bottom) panels, respectively, due to the fuzzed system times, leading to observably different $\chi^2 / \nu$ metrics.