HAMLOCK: HArdware-Model LOgically Combined attacK

TL;DR

HAMLOCK introduces a novel cross-layer backdoor that distributes trigger detection and misclassification across hardware and software, keeping the software model largely benign until activated by a compromised accelerator. By minimally altering a few trigger neurons in the model and deploying lightweight hardware Trojans that detect these activations and bias the final logits, it achieves near-perfect ASR with negligible CA loss and conceals itself from current defenses. The approach remains effective across MNIST, CIFAR-10, GTSRB, and ImageNet and withstands both white-box and black-box model defenses, while incurring negligible hardware overhead (as low as 0.01%). This work highlights critical security risks at the hardware–software boundary and calls for cross-layer defenses to protect the ML supply chain in edge/accelerated deployments.

Abstract

The growing use of third-party hardware accelerators (e.g., FPGAs, ASICs) for deep neural networks (DNNs) introduces new security vulnerabilities. Conventional model-level backdoor attacks, which only poison a model's weights to misclassify inputs with a specific trigger, are often detectable because the entire attack logic is embedded within the model (i.e., software), creating a traceable layer-by-layer activation path. This paper introduces the HArdware-Model Logically Combined Attack (HAMLOCK), a far stealthier threat that distributes the attack logic across the hardware-software boundary. The software (model) is now only minimally altered by tuning the activations of few neurons to produce uniquely high activation values when a trigger is present. A malicious hardware Trojan detects those unique activations by monitoring the corresponding neurons' most significant bit or the 8-bit exponents and triggers another hardware Trojan to directly manipulate the final output logits for misclassification. This decoupled design is highly stealthy, as the model itself contains no complete backdoor activation path as in conventional attacks and hence, appears fully benign. Empirically, across benchmarks like MNIST, CIFAR10, GTSRB, and ImageNet, HAMLOCK achieves a near-perfect attack success rate with a negligible clean accuracy drop. More importantly, HAMLOCK circumvents the state-of-the-art model-level defenses without any adaptive optimization. The hardware Trojan is also undetectable, incurring area and power overheads as low as 0.01%, which is easily masked by process and environmental noise. Our findings expose a critical vulnerability at the hardware-software interface, demanding new cross-layer defenses against this emerging threat.

Figures (6)

• Figure 1: Hardware-model logically combined attack. Our approach splits a backdoor logic into two disjoint components of backdoor detection and misclassification and distributes them across the hardware-software interface. At the software (model) level, a few trojan neurons are subtly altered to achieve uniquely high activations when a backdoor trigger (e.g., red square) is present. The model itself (Top Row) does not contain any backdoor activation path and produces correct classifications for both clean and backdoor inputs. Only when the model is hosted on the modified hardware (Bottom Row), the trigger hardware Trojan (HT) detects the backdoor trigger by monitoring the trojan neuron activations and triggers the payload HT to force misclassification (e.g., classify as "Cat").
• Figure 2: Threat Model of HAMLOCK
• Figure 3: Necessity of Hardware-Aware Model Attack. In backdoored models generated through naive data poisoning, neuron activations for clean and backdoor samples are not clearly separable. No single neuron exhibits a clean “flip” in activation (e.g., from low to high) that could serve as a reliable on/off indicator of the backdoor trigger, making it difficult to coordinate with hardware-based trigger detection.
• Figure 4: The activation value distributions of clean and backdoor samples
• Figure 5: Backdoor triggers on the three benchmark datasets. The triggers are the squared regions on each corner of different images. The top row shows trigger samples used for the trigger optimization attack, while the bottom row displays trigger samples generated by the weight optimization attack.