This thesis investigates and discusses Hardware Trojans (HTs), which targets hardware accelerators dedicated to accelerating Neural Network (NN) models. The HTs discussed specifically attack and modify the values of critical and vulnerable weights and biases within the NN, causing reductions in performance that could have devastating consequences in vital infrastructure in areas such as aviation, military, or healthcare. This thesis aims to raise awareness of this type of attack, encouraging more research to counter the threat these HTs pose.

This thesis presents two methods for identifying critical weights in an NN, one utilizing Partial Derivatives (PDs) and another using Mixed Integer Programming (MIP). The capabilities and viability of these methods were tested using two Convolutional Neural Networks (CNNs), a LeNet-5 model, and a customized version of the LeNet-5 model named LeNet-5_v2. These models and the methods were created using Python, TensorFlow, and Keras.

Using the hls4ml library in Python and Keras, a quantized and sparsified LeNet-5 model was converted to an High Level Synthesis (HLS) implementation and, further on, exported as an Intellectual Property (IP) core for usage in Vivado, Xilinx’s software for synthesizing and analyzing Hardware Description Language (HDL) designs, which supports System-on-Chip (SoC) development and HLS. Using a Zybo Z7-20 Field-Programmable Gate Array (FPGA), an equivalent LeNet5 classifier was implemented and evaluated. Four different HTs were developed and incorporated (separately) into the IP core and FPGA using Vitis HLS. The critical weights to target by each HT were identified using one of the two methods for identifying critical weights, specifically the one using partial derivatives. Of the four HTs, two aimed to maximize the impact on performance (accuracy) of the CNN model, reducing the model’s classification capabilities as much as possible. The remaining two HTs focused on minimally reducing the model’s accuracy, lowering it down to 80% as a means for preserving the HT’s stealth and avoiding detection.

Out of all four HTs developed and evaluated, it was determined that the HT that attacked both hidden layers in the model and aimed to make a minimal accuracy reduction (to 80%) was the best. Said HT reduced the accuracy to 78.50% while adding an overhead of 72 Look-Up Tables (LUTs), 6 Look-Up Table Random Access Memorys (LUTRAMs), 527 Flip-Flops (FFs), 0.5 Block Random Access Memorys (BRAMs) and increasing the power usage by 9 mW. Overall, this increased the systems overhead by about 0.1597% (LUTs), 0.6438% (LUTRAMs), 1,241% (FFs), 0.7874% (BRAMs), and 0,5257% (power usage), respectively.