An official website of the United States government
The wide deployment of Deep Neural Networks (DNN) in high-performance cloud computing platforms brought to light multi-tenant cloud field-programmable gate arrays (FPGA) as a popular choice of accelerator to boost performance due to its hardware reprogramming flexibility. Such a multi-tenant FPGA setup for DNN acceleration potentially exposes DNN interference tasks under severe threat from malicious users. This work, to the best of our knowledge, is the first to explore DNN model vulnerabilities in multi-tenant FPGAs. We propose a novel adversarial attack framework: Deep-Dup, in which the adversarial tenant can inject adversarial faults to the DNN model in the victim tenant of FPGA. Specifically, she can aggressively overload the shared power distribution system of FPGA with malicious power-plundering circuits, achieving adversarial weight duplication (AWD) hardware attack that duplicates certain DNN weight packages during data transmission between off-chip memory and on-chip buffer, to hijack the DNN function of the victim tenant. Further, to identify the most vulnerable DNN weight packages for a given malicious objective, we propose a generic vulnerable weight package searching algorithm, called Progressive Differential Evolution Search (P-DES), which is, for the first time, adaptive to both deep learning white-box and black-box attack models. The proposed Deep-Dup is experimentally validated in a developed multi-tenant FPGA prototype, for two popular deep learning applications, i.e., Object Detection and Image Classification. Successful attacks are demonstrated in six popular DNN architectures (e.g., YOLOv2, ResNet-50, MobileNet, etc.) on three datasets (COCO, CIFAR-10, and ImageNet).
more »
« less
This content will become publicly available on March 3, 2026
Encrypted Model Reference Adaptive Control With False Data Injection Attack Resilience via Somewhat Homomorphic Encryption-Based Overflow Trap
Cloud-based control is prevalent in many modern control applications. Such applications require security for the sake of data secrecy and system safety. The presented research proposes an encrypted adaptive control framework that can be secured for cloud computing with encryption and without issues caused by encryption overflow and large execution delays. This objective is accomplished by implementing a somewhat homomorphic encryption (SHE) scheme on a modified model reference adaptive controller with accompanying encryption parameter tuning rules. Additionally, this paper proposes a virtual false data injection attack (FDIA) trap based on the SHE scheme. The trap guarantees a probability of attack detection by the adjustment of encryption parameters, thus protecting the system from malicious third parties. The formulated algorithm is then simulated, verifying that after tuning encryption parameters, the encrypted controller produces desired plant outputs while guaranteeing detection or compensation of FDIAs. With the utilization of this novel control framework, adaptively controlled systems will maintain data confidentiality and integrity against malicious adversaries.
more »
« less
- Award ID(s):
- 2112793
- PAR ID:
- 10653716
- Publisher / Repository:
- IEEE Transactions on Industrial Cyber-Physical Systems
- Date Published:
- Journal Name:
- IEEE Transactions on Industrial Cyber-Physical Systems
- Volume:
- 3
- ISSN:
- 262 - 272
- Page Range / eLocation ID:
- 262 to 272
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Searchable Encryption (SE) has been extensively examined by both academic and industry researchers. While many academic SE schemes show provable security, they usually expose some query information (e.g., search patterns) to achieve high efficiency. However, several inference attacks have exploited such leakage, e.g., a query recovery attack can convert opaque query trapdoors to their corresponding keywords based on some prior knowledge. On the other hand, many proposed SE schemes require significant modification of existing applications, which makes them less practical, weak in usability, and difficult to deploy. In this paper, we introduce a secure and practical SE scheme with provable security strength for cloud applications, called IDCrypt, which improves the search efficiency and enhanced the security strength of SE using symmetric cryptography. We further point out the main challenges in securely searching on multiple indexes and sharing encrypted data between multiple users. To address the above issues, we propose a token-adjustment scheme to preserve the search functionality among multi-indexes, and a key sharing scheme which combines Identity-Based Encryption (IBE) and Public-Key Encryption (PKE). Our experimental results show that the overhead of IDCrypt is fairly low.more » « less
-
Networkedcontrol systems are vulnerable to manipulation via data injection to observed states and control commands, resulting in undesired state trajectories and system instabilities. Adversarial attacks against such systems can be implemented in the form of undetectable attacks such that an observer never notices deviations from expected behavior. Even when protected by homomorphic encryption, these systems remain vulnerable to stealthy and perfectly undetectable attacks due to the malleability of encrypted data. This research develops a defense architecture against such undetectable attacks through the fusion of two complementary detection protocols working in conjunction with encryption. The mechanism’s strengths and weaknesses are analyzed for affine transformation-based perfectly undetectable attacks and covert attacks. The attacks are implemented against a mobile robot, and defense performance is analyzed, resulting in a robust defense mechanism that outperforms previous undetectable attack detection methods in terms of detection accuracy and reliability across the two representative attack types.more » « less
-
This work focuses on the problem of enhancing cyberattack detection capabilities in process control systems subject to multiplicative cyberattacks. First, the relationship between closed-loop stability and attack detectability with respect to a class of residual-based detection schemes is rigorously analyzed. The results are used to identify a set of controller parameters (called "attack-sensitive" controller parameters) under which an attack can destabilize the closed-loop system. The selection of attack-sensitive controller parameters can enhance the ability to detect attacks, but can also degrade the performance of the attack-free closed-loop system. To balance this trade-off, a novel active attack detection methodology employing controller parameter switching between the nominal controller parameters (chosen on the basis of standard control design criteria) and the attack-sensitive controller parameters, is developed. The proposed methodology is applied to a chemical process example to demonstrate its ability to detect multiplicative sensor-controller communication link attacks.more » « less
-
Connected and autonomous vehicles (CAVs) rely on communication channels to improve safety and efficiency. However, this connectivity leaves them vulnerable to potential cyberattacks, such as false data injection (FDI) attacks. We can mitigate the effect of FDI attacks by designing secure control techniques. However, tuning control parameters is essential for the safety and security of such techniques, and there is no systematic approach to achieving that. In this article, our primary focus is on cooperative adaptive cruise control (CACC), a key component of CAVs. We develop a secure CACC by integrating model-based and learning-based approaches to detect and mitigate FDI attacks in real-time. We analyze the stability of the proposed resilient controller through Lyapunov stability analysis, identifying sufficient conditions for its effectiveness. We use these sufficient conditions and develop a reinforcement learning (RL)-based tuning algorithm to adjust the parameter gains of the controller, observer, and FDI attack estimator, ensuring the safety and security of the developed CACC under varying conditions. We evaluated the performance of the developed controller before and after optimizing parameters, and the results show about a 50% improvement in accuracy of the FDI attack estimation and a 76% enhancement in safe following distance with the optimized controller in each scenario.more » « less
