Source-linked AI summary
FINN-Tro: Exploiting Verification Gaps in Dataflow Inference Accelerators
Qazi Arbab Ahmed, Suraj Karki, Thorsten Jungeblut
TL;DR
FINN’s compilation pipeline has a verification gap: functional checks can miss malicious hardware triggered by temporal conditions and specific inputs. FINN-Tro inserts a counter-triggered Trojan into the final MVAU, and its persistent Bias Addition configuration sharply reduces accuracy on both evaluated datasets while throughput and runtime stay close to baseline.
Problem
FINN functional simulation checks outputs at selected build steps but cannot detect malicious logic triggered by temporal conditions and specific inputs.
Source: §I · p. 1Method
FINN-Tro inserts a counter-triggered hardware Trojan into the final MVAU, combining two trigger modes with three payload types.
Source: §I · pp. 1–2, C. Trojan-inserted MVAU Layer · p. 4Results
Persistent Bias Addition reduces accuracy from 92.96% to 10.12% on MNIST and from 84.19% to 10.00% on CIFAR-10, while throughput and runtime remain close to baseline.
Source: B. Performance Evaluation · p. 5Takeaways & Limitations
FINN-Tro remained undetected throughout the design flow and activated on a PYNQ-Z1 board, motivating stronger design-time verification.
Source: §V · p. 5
Abstract
from arXiv · showhide
The growing adoption of dataflow accelerators for neural network inference introduces new attack surfaces that existing verification methodologies fail to address. Inference ac- celeration frameworks such as FINN, which transform quantized neural networks into FPGA-deployable dataflow architectures, implicitly assume semantic equivalence between the software model and the synthesized hardware. In this work, we in- troduce the FINN-Tro attack, which identifies and exploits a critical verification gap in the FINN compilation pipeline that enables stealthy hardware Trojan insertion without modifying the original quantized model. The Trojan is placed in the last Matrix-Vector Activation Unit (MVAU) layer and supports two counter-based trigger modes, periodic and persistent, and three payload types: bias addition, logit swapping, and bias subtraction, resulting in six different configurations. FINN-Tro is evaluated on an MNIST feed-forward network and a CIFAR-10 convolutional neural network deployed on a PYNQ-Z1 board. Across the evaluated configurations, accuracy reductions range from 0.90% to 82.84%, while throughput and runtime remain close to the corresponding baseline designs. The most severe configuration, persistent Bias Addition, reduces accuracy from 92.96% to 10.12% on MNIST and from 84.19% to 10.00% on CIFAR-10. The inserted logic introduces modest implementation overhead, with maximum LUT and FF increases of 6.71% and 7.49% for MNIST, and 2.50% and 3.98% for CIFAR-10, respectively. Our findings reveal that widely used pre- and post- compilation verification flows are insufficient for detecting such temporally delayed hardware manipulations, motivating the need for stronger verification mechanisms in accelerator toolchains.
I. INTRODUCTION
FPGA dataflow accelerators offer parallel, flexible DNN inference, but reliance on third-party compilation flows creates a verification gap: temporal, input-dependent hardware Trojans can escape functional simulation. FINN-Tro exploits this gap with configurable triggers and payloads, producing accuracy degradation while remaining undetected by FINN functional simulation.
I. INTRODUCTION
- FINN functional simulation checks outputs at selected build steps but cannot detect malicious logic triggered by temporal conditions and specific inputs.A rogue employee or supply-chain attacker controlling the compilation environment can insert Trojan logic into generated HLS C++ code.Source: §I · p. 1
- FINN-Tro is a systematic methodology for inserting hardware Trojans into FINN-generated FPGA accelerators without changing the trained DNN model.The attack targets the FINN compilation pipeline.Source: §I · p. 1
- The Trojan targets the final MVAU, which generates classification logits, and combines Periodic or Persistent triggers with Bias Addition, Logit Swap, or Bias Subtraction payloads.The evaluation uses an MNIST feed-forward network and a CIFAR-10 CNN deployed on a PYNQ-Z1 FPGA.Source: §I · pp. 1–2
- Accuracy degradation ranges from 0.90% to 82.84% across FINN-Tro configurations, with small overhead and no detection by FINN functional simulation.The attack exploits a verification gap in the FINN compilation pipeline during layer specialization.Source: §I · p. 2
II. RELATED WORK
Prior work examines FPGA accelerator attacks across deployment stages and accelerator structures, but the cited approaches do not address FINN’s specific verification gap for model-preserving Trojan insertion. FINN-Tro targets the FINN MVAU with a counter-based trigger and six configurations.
II. RELATED WORK
- Prior FPGA-based AI accelerator attacks span design-flow, bitstream, and post-configuration stages –; Warnecke et al. demonstrated a Vitis AI DPU LOAD-engine Trojan that intercepts selected model parameters, causing misclassification with 0.24% circuit overhead.Lomet et al. passively extracted FINN accelerator folding factors and quantization levels with over 95% accuracy from on-chip power traces. Other attacks target faults and bit flips, bounding boxes, and Transformer and SNN accelerators,.Source: §II · p. 2
- Existing approaches do not address the FINN-specific verification gap that permits malicious logic insertion without modifying the original DNN model.The related-work discussion frames FINN-Tro as addressing this gap.Source: §II · p. 2
- FINN-Tro targets the FINN MVAU with a counter-based trigger and six configurations.The overview and placement are illustrated in Figures 2 and 3.Source: Figure 2 · p. 2, §II · p. 3, Figure 3 · p. 3
III. METHODOLOGY
FINN-Tro modifies the FINN compilation pipeline at HLS code generation to insert malicious logic into an MVAU layer. The method comprises Trojan specification and Trojan insertion.
III. METHODOLOGY
- FINN-Tro targets the FINN compilation pipeline used to generate FPGA-based DNN accelerators.The method inserts malicious logic into synthesizable HLS C++ generated for an MVAU layer.Source: §III · p. 3
- The method has two phases: Trojan specification and Trojan insertion.The insertion occurs at the HLS code-generation stage.Source: §III · p. 3
- Malicious logic is inserted into synthesizable HLS C++ generated for an MVAU layer.Source: §III · p. 3
A. Threat Model
The threat model assumes an attacker can modify FINN’s compilation flow and software components but cannot access the training dataset or trained model. FINN-Tro attaches Trojan attributes during layer specialization and generates the malicious MVAU logic during HLS code generation, where single-input, reset-state verification misses the behavior.
A. Threat Model
- The attacker can modify FINN’s compilation flow and software components, especially layer specialization and the HLS backend, but lacks access to the training data and trained model.The objective is controlled inference misbehavior under trigger conditions while preserving normal behavior otherwise.Source: A. Threat Model · p. 3
B. Trojan Insertion in FINN Data-flow Build
- FINN converts a quantized model through FINN-ONNX, graph optimizations, and hardware-specific transformations, with verification during transformations.After lowering to hardware-specific layers and HLS code, the representation is tightly coupled to the hardware implementation.Source: B. Trojan Insertion in FINN Data-flow… · p. 3
- FINN-Tro attaches trigger and payload attributes to the target MVAU during layer specialization, then inserts the logic through the PrepareIP HLS C++ template.The quantized graph and trained weights remain unchanged; modification is limited to HLS generation.Source: B. Trojan Insertion in FINN Data-flow… · p. 3
- FINN’s verification checks a single input and resets design state each time, preventing detection of the inserted behavior at any pipeline stage.The Trojan modifies final-MVAU logits before Label Select, enabling controlled misclassification.Source: B. Trojan Insertion in FINN Data-flow… · p. 3
C. Trojan-inserted MVAU Layer
The Trojan extends the FINN MVAU with internal trigger and payload logic that conditionally modifies output logits while preserving the original interface and computation.
C. Trojan-inserted MVAU Layer
- The modified MVAU preserves its original interface and computation while adding a conditional path that modifies output logits before downstream transmission.Its standard compute block and Trojan logic are contained within the same HLS-generated IP core.Source: C. Trojan-inserted MVAU Layer · pp. 3–4
- The MVAU stores computed outputs in an internal FIFO and reconstructs the complete logit vector for Trojan processing.The standard block performs matrix-vector multiplication, activation, and thresholding using trained weights and thresholds.Source: C. Trojan-inserted MVAU Layer · p. 4
- Periodic mode activates the payload every N-th inference and resets the counter, whereas persistent mode activates at inference N and stays active.An inference counter and latched flag determine activation.Source: C. Trojan-inserted MVAU Layer · p. 4
- The payload can increase or decrease a target-class logit by a specified bias, or swap the logits of two selected classes.The trigger and payload operate within the MVAU IP, independently of downstream Top-K selection and runtime software control.Source: C. Trojan-inserted MVAU Layer · p. 4
A. Experimental Setup
The evaluation compares baseline accelerators and six FINN-Tro variants across MNIST and CIFAR-10 models deployed on a PYNQ-Z1 FPGA.
A. Experimental Setup
- Two models are evaluated: a 4-layer MNIST feed-forward network and a 12-layer CIFAR-10 CNN, with one baseline and six FINN-Tro variants per model.Both use FINN v0.10.1, binary quantization across layers, HLS-based MVAU layers, identical folding parameters, and zero DSP usage.Source: A. Experimental Setup · p. 4
- All accelerators are deployed on a Xilinx PYNQ-Z1 board containing an AMD Zynq xc7z020-1clg400 FPGA and dual-core ARM Cortex-A9 processor.The MNIST and CIFAR-10 layer-wise model details are presented in Tables I and II.Source: A. Experimental Setup · p. 4, Table I · p. 4, Table II · p. 5
- Performance is measured using accuracy, throughput, and runtime on a batch of 1000 images at a fixed 100 MHz clock frequency.The passage specifies those evaluation conditions; it does not provide further table contents for the model layer-wise details.Source: A. Experimental Setup · p. 5
- The six attack variants combine Bias Addition, Logit Swap, or Bias Subtraction with Periodic or Persistent triggering.The trigger period N and bias b are fixed at 5 and 255, respectively.Source: A. Experimental Setup · p. 5
B. Performance Evaluation
Across MNIST and CIFAR-10, FINN-Tro can sharply reduce accuracy while keeping throughput and runtime close to baseline.
B. Performance Evaluation
- Accuracy falls from 92.96% to 10.12% on MNIST and from 84.19% to 10.00% on CIFAR-10 under persistent Bias Addition (A1-T1).Across all configurations, throughput and runtime remain close to baseline; periodic configurations produce more moderate accuracy degradation because the payload activates only every N-th inference.Source: B. Performance Evaluation · p. 5
C. FPGA Resource Utilization
FINN-Tro adds limited hardware and power overhead while retaining performance comparable to baseline accelerators.
C. FPGA Resource Utilization
- LUT utilization rises by at most 6.71% for MNIST and 2.50% for CIFAR-10, while FF usage rises by at most 7.49% and 3.98%, respectively.On-chip power remains within 9 mW of the respective baselines.Source: C. FPGA Resource Utilization · p. 5
- LUTRAM increases by at most 4.51% for MNIST and 0.05% for CIFAR-10, while BRAM increases by at most 6.90% and 1.01%, respectively.The MNIST baseline uses 25.83% LUTs, 4.08% LUTRAM, 18.80% FFs, and 10.36% BRAM at 1.642 W; CIFAR-10 uses 47.87% LUTs, 11.70% LUTRAM, 29.70% FFs, and 71.07% BRAM at 2.085 W.Source: C. FPGA Resource Utilization · p. 5
- Relative overhead decreases with increasing network depth, and Trojan variants remain difficult to distinguish through conventional resource and power profiling.Overall, the variants maintain performance comparable to the baseline accelerators.Source: C. FPGA Resource Utilization · p. 5
V. CONCLUSION
FINN-Tro inserts counter-triggered malicious logic into the final MVAU without changing the quantized model or trained weights. It remained undetected through the design flow while degrading accuracy with near-baseline throughput and runtime; future work will broaden its scope and assess checkers.
V. CONCLUSION
- FINN-Tro remained undetected through the design flow and activated on PYNQ-Z1, degrading accuracy while maintaining near-baseline throughput and runtime with modest hardware overhead.The Trojan combines Periodic and Persistent triggers with Bias Addition, Logit Swap, and Bias Subtraction payloads.Source: §V · p. 5
- The Trojan is inserted into the final MVAU without modifying the original quantized model or trained weights.Its counter-based triggers and three payload types yield six configurations.Source: §V · p. 5
- Future work will extend evaluation to deeper networks and input-conditioned triggers, and investigate verification checkers as potential countermeasures.Source: §V · p. 5