This content will become publicly available on June 22, 2027

Title: Security Analysis of Microscaling Formats Under Fault Injection on a RISC-V Edge Platform
A single fault in a shared block exponent can silently corrupt an entire neural-network inference block. Microscaling (MX) formats, which share one 8-bit exponent across 32 elements to reduce storage and bandwidth cost, propagate this fault through a barrel shifter to every element simultaneously. This paper presents a security analysis of five MX-compatible 8-bit formats on a unified RISC-V coprocessor, combining a comparative format study with state-monitor-assisted fault attribution under voltage underscaling and clock glitching. Across the five-format comparison, the proposed LOG8-MAX format achieves the lowest observed fault rate at the lowest hardware cost (905 LUTs), while MXFP8-E5M2 is the most vulnerable (27 silent faults on QNN, 65,536× worst-case amplification) and the most expensive (2,178 LUTs). The experiments identify two primary fault mechanisms: shared-exponent amplification across all formats, and reduction-operator containment specific to the LOG8-MAX comparator tree. A 129-bit state monitor shows that the first silent fault under undervoltage does not always originate in the shared exponent: CPU-path faults can appear earlier with the coprocessor state still intact. Shared-exponent corruption, when it occurs, remains the catastrophic failure mode because it corrupts an entire block simultaneously. These results show that MX format encoding and internal observability are both security-relevant design choices for edge-AI inference hardware.  more » « less
Award ID(s):
2219810
PAR ID:
10681571
Author(s) / Creator(s):
;
Publisher / Repository:
LNCS Springer
Date Published:
Format(s):
Medium: X
Location:
Stony Brook, NY
Sponsoring Org:
National Science Foundation
More Like this
  1. Microscaling (MX) formats share one exponent across an element block, creating a new fault surface: a single-bit flip in the shared exponent corrupts all block elements simultaneously. Five MX compatible 8-bit encodings (MXINT8, MXFP8-E4M3, MXFP8-E5M2, LOG8-SUM, and LOG8-MAX) are compared through exhaustive single-bit weight fault injection across four workloads using gate level simulation on the CAPRI1 RISC-V SoC, with the primary workload additionally validated on fabricated silicon. Format choice alone can substantially change vulnerability. Three MX-specific mechanisms explain this variation: block-shared exponent amplification, attention routing inversion from exponent-field faults, and log-domain fault filtering in the max-reduction variant. No single format dominates all axes: LOG8-MAX leads speed and energy but is limited by accuracy on some attention workloads, MXINT8 provides the strongest fault resilience with full accuracy, and LOG8-SUM offers a balanced compromise across speed, accuracy, and resilience. MX element encoding should be treated not only as an accuracy-efficiency choice, but also as a security-relevant design decision. 
    more » « less
  2. This paper deals with the fault tolerance of Triplet Networks (TNs). Results based on extensive analysis and simulation by fault injection are presented for new schemes. As in accordance with technical literature, stuck-at faults are considered in the fault model for the training process. Simulation by fault injection shows that the TNs are not sensitive to this type of fault in the general case; however, an unexcepted failure (leading to network convergence to false solutions) can occur when the faults are in the negative subnetwork. Analysis for this specific case is provided and remedial solutions are proposed (namely the use of the loss function with regularized anchor outputs for stuck-at 0 faults and a modified margin for stuck-at 1/-1 faults). Simulation proves that false solutions can be very efficiently avoided by utilizing the proposed techniques. Random bit-flip faults are then considered in the fault model for the inference process. This paper analyzes the error caused by bit-flips on different bit positions in a TN with Floating-Point (FP) format and compares it with a fault- tolerant Stochastic Computing (SC) implementation. Analysis and simulation of the TNs confirm that the main degradation is caused by bit-flips on the exponent bits. Therefore, protection schemes are proposed to handle those errors; they replace least significant bits of the FP numbers with parity bits for both single- and multi-bit errors. The proposed methods achieve superior performance compared to other low-cost fault tolerant schemes found in the technical literature by reducing the classification accuracy loss of TNs by 96.76% (97.74%) for single-bit (multi-bit errors).  
    more » « less
  3. This work presents SPHINCSLET, the first fully standard-compliant and area-efficient hardware implementation of the SLH-DSA algorithm, formerly known as SPHINCS+, a post-quantum digital signature scheme. SPHINCSLET is designed to be parameterizable across different security levels and hash functions, offering a balanced trade-off between area efficiency and performance. Existing hardware implementations either feature a large area footprint to achieve fast signing and verification or adopt a coprocessor-based approach that significantly slows down these operations. SPHINCSLET addresses this gap by delivering a 4.7 × reduction in area compared to high-speed designs while achieving a 2.5 × to 5 × improvement in signing time over the most efficient coprocessor-based designs for a SHAKE256-based SPHINCS+ implementation. The SHAKE256-based SPHINCS+ FPGA implementation targeting the AMD Artix-7 requires fewer than 10.8K LUTs for any security level of SLH-DSA. Furthermore, the SHA-2-based SPHINCS+ implementation achieves a 2 × to 4 × speedup in signature generation across various security levels compared to existing SLH-DSA hardware, all while maintaining a compact area footprint of 6K to 15K LUTs. This makes it the fastest SHA-2-based SLH-DSA implementation to date. With an optimized balance of area and performance, SPHINCSLET can assist resource-constrained devices in transitioning to post-quantum cryptography. 
    more » « less
  4. In-memory computing (IMC) provides energy- efficient solutions to deep neural networks (DNN). Most IMC de- signs for DNNs employ fixed-point precisions. However, floating- point precision is still required for DNN training and complex inference models to maintain high accuracy. There have not been float-point precision based IMC works in the literature where the float-point computation is immersed into the weight memory storage. In this work, we propose a novel floating-point precision IMC macro with a configurable architecture that supports both normal 8-bit floating point (FP8) and 8-bit block floating point (BF8) with a shared exponent. The proposed FP-IMC macro implemented in 28nm CMOS demonstrates 12.1 TOPS/W for FP8 precision and 66.6 TOPS/W for BF8 precision, improving energy-efficiency beyond the state-of-the-art FP IMC macros. 
    more » « less
  5. Barrett modular reduction and multiplication are essential primitives for efficient modular computation in cryptographic schemes, including post-quantum standards such as module lattice-based (ML) key encapsulation mechanism (KEM) and ML-digital signature algorithm (DSA). To protect against faults that compromise correctness and security, we introduce the first efficient fault-detection mechanisms tailored to these operations. For modular reduction, we leverage word-based representations with compact word-sum checks that exploit algebraic input-output relations to ensure computational integrity. For modular multiplication, we adopt a tunable hybrid strategy: early stages apply word-sum checks, while later stages use partial recomputation with encoded inputs, providing robust protection against injected faults. Formal analysis, fault-injection simulations, and hardware/software implementations show that our methods detect a wide range of faults with minimal performance and area overhead. Evaluation results demonstrate overheads of 3.43% and 7.15% for 512-bit and 1024-bit inputs in modular reduction, and 26.47% and 27.22% for 2048-bit inputs in modular multiplication in the number of clock cycles in software. Moreover, in hardware, we observed reasonable overheads: less than 27.5% in area and 2.1% in delay for modular reduction, and less than 23.5% in area and 16.2% in delay for modular multiplication. These results confirm the practicality of our methods for secure yet effcient integration. 
    more » « less