Silent Blindness: Fault Vulnerability of Hardware Malware Detectors

• The study injects decision stuck-at faults and parameter bit flips across a published detector design space, including trees, rules, function-based, and Bayesian models.The analyzed configurations span counter budgets and ensembles; the hardware implementations were validated bit-exactly against trained models.Source: §I · pp. 1–2
• Structural faults can have distinct security consequences: evasion lowers recall, denial of service raises false positives, and silent faults leave both metrics unchanged.Silent faults therefore cannot be distinguished from healthy detectors by output monitoring alone.Source: §I · p. 1
• In a 4-HPC J48 tree, 3.9% of 3,910 fault sites cause evasion and 51.5% are silent; in a 4-HPC SGD detector, 28% of 25 sites cause evasion and 44% cause denial of service.The worst single J48 fault drops recall from 97.0% to 36.9%; a single SGD bit flip drives recall to 0%.Source: §I · p. 1
• The paper introduces a security-consequence fault taxonomy and examines how counter-budget reduction and ensembling change vulnerability.The taxonomy labels faults as evasion, denial of service, silent, noisy, or degraded.Source: §I · p. 2
• 14.3% versus 5.7%: completed configurations show a mean critical-fault fraction about 2.5 times higher for function-based than tree-based detectors.Comparator-based detectors expose more fault sites than multiply-accumulate detectors, yet a smaller fraction of their faults is critical; site count is a poor vulnerability proxy.Source: §I · p. 2
• Selective hardening uses critical-fault concentration to choose structural units for protection under disjoint-unit, additive-cost, and ideal-correction assumptions.The method uses an exact minimax selection algorithm to assess normalized protection cost against residual worst-case recall loss.Source: §I · p. 2

• Prior HPC malware-detection work explores pipeline integration,, ensembles,, programmable monitoring, workload-specific counters, and practical counter budgets –.Other work addresses feature sets, workload-adaptive detection costs, semantic explanations, comparative rankings, field deployments, and routed silicon –.Source: §II · p. 2
• Earlier literature does not examine how a detector behaves when its own logic is damaged; this study addresses that gap.Existing detector-input attacks and defenses assume the detector's logic is intact and correct –.Source: §II · p. 2
• Ransomware-specific HPC detectors include early-warning classifiers, CNNs for unseen families, lightweight IoT and edge monitors,, and classifiers tested against obfuscation –.These detectors use implementation logic exposed to the same fault surface considered in this study.Source: §II · p. 2
• Prior work also describes physical faulting options such as localized voltage manipulation and undervolting that disables on-chip sensors, [41].Source: §II · p. 2
• DNN fault defenses target vulnerable weight memory [44]–, whereas many HMD families use combinational comparator and gating logic without weight memory.The paper adapts criticality-guided selective protection to HMDs and presents its work as the first fault analysis of HPC-based malware detectors at complete-design-space scale.Source: §II · p. 3

A. Fault models

• Both fault types represent physical failure mechanisms that could result from deliberate attack or a defect in a deployed detector.Source: A. Fault models · p. 3
• Decision stuck-at faults force a comparator output, rule-condition result, table entry, or ensemble verdict permanently to one value.The model captures stuck-at-0 or stuck-at-1 behavior, including shorted or open nets, latched glitches, and devices that no longer switch.Source: A. Fault models · p. 3
• Parameter bit-flips invert one stored bit in a threshold, rule bound, table interval, model weight, or ensemble vote weight.Integer thresholds use their 32-bit representation; real-valued weights use IEEE-754 sign, exponent, and mantissa positions.Source: A. Fault models · p. 3

B. Adversary

• The adversary seeks to execute malware undetected, can induce a limited number of faults, cannot rewrite the logic, and is not assumed to read detector parameters.The number of faults required is the cost metric.Source: B. Adversary · p. 3
• The same fault states can arise from manufacturing defects or aging, and silent-fault fractions indicate failures that output-level tests may not notice.Source: B. Adversary · p. 3

A. Detectors and validated baselines

• The experiment spans 18 classifiers, four counter budgets, and AdaBoost and Bagging ensembles; baseline RTL matched its software model across the full dataset with zero mismatches.The validated software model also matched recorded per-instance predictions of the original trained classifiers.Source: A. Detectors and validated baselines · p. 3

B. Injection level

• Faults are injected into architectural structures rather than gate netlists, making fault sites interpretable and portable across implementations but excluding synthesis-introduced faults.Agreement between architectural and physical fault levels remains unvalidated.Source: B. Injection level · p. 3

C. Evaluation convention

• Each faulted detector is evaluated on the same 7,400 instances as its baseline, measuring paired changes in recall and false-positive rate.This evaluates changes on the available study instances, not detection performance on unseen programs.Source: C. Evaluation convention · p. 3

D. Security-semantic classification

• Critical faults are evasion faults with at least 5 pp recall loss; denial-of-service faults are reported separately, and family ordering persists as τR varies from 1 to 10 pp.The taxonomy also distinguishes noisy, silent, and degraded outcomes; silence means both recall and false-positive-rate changes are below 0.1 pp.Source: D. Security-semantic classification · p. 4

A. Attack surface: size versus density (RQ1)

• 4.77 million tree fault sites versus 12,410 function-family sites coexist with 5.3% versus 14.3% critical-fault fractions, respectively.Fig. 1 plots enumerated site count against critical-fault percentage for each configuration.Source: A. Attack surface: size versus density… · p. 4, Figure 1 · p. 5
• Comparator-based detectors spread decisions across many individually inert nodes, whereas multiply-accumulate detectors concentrate them in a few load-bearing weights.The result is a much larger tree attack surface but a lower chance that any individual tree fault is critical.Source: A. Attack surface: size versus density… · p. 4
• Table III distinguishes exhaustive configurations, with zero sampling uncertainty for their enumerated fault sets, from completed random samples; it asserts no campaign-wide sampling margin.Source: Table III · p. 5

B. The silent majority (RQ2)

• 72.3% of tree faults and 68.4% of rule faults are metric-silent, changing recall and false-positive rate by less than 0.1 pp.Metric silence can still conceal changes in individual predictions or malware-subclass recall.Source: B. The silent majority (RQ2) · p. 5, Figure 2 · p. 5

C. Where criticality lives (RQ2)

• Root comparator faults reduce recall by 19.5 pp on average, with a maximum 60 pp reduction; faults below depth ten have almost no mean effect.The damage distribution is heavy-tailed rather than uniform.Source: C. Where criticality lives (RQ2) · p. 5, Figure 3 · p. 5

D. The counter budget trades silicon for fragility (RQ3)

• For SGD, reducing counters from 16 to 2 raises criticality from 18.8% to 46.7%; SMO rises from 23.5% to 33.3%, but falls from 36.0% at four counters to 33.3% at two.The counter-reduction trade-off is substantially stronger for linear detectors than for tree and rule detectors.Source: D. The counter budget trades silicon… · pp. 5–6

E. Ensembles buy redundancy, not accuracy (RQ4)

• Bagging reduced criticality in 31 of 34 classifier/budget triples and achieved zero criticality in 33 comparisons, including all 17 at four HPCs.AdaBoost increased criticality in four comparisons.Source: E. Ensembles buy redundancy, not… · p. 6
• With ten equally weighted votes, no single faulty Bagging member can move the majority, reducing criticality to 0.0% for almost every base learner.For the multilayer perceptron, Bagging’s worst-case recall never falls below 63.6%, whereas a single-detector fault can drive recall to 0%.Source: E. Ensembles buy redundancy, not… · p. 6
• For high-assurance or physically exposed deployments, the paper frames ensemble redundancy as fault tolerance rather than value in detection score.Under a silicon constraint and benign threat model, it retains the single-tree detector as the preferred choice.Source: E. Ensembles buy redundancy, not… · p. 6

VI. CRITICALITY-GUIDED SELECTIVE HARDENING (RQ5)

• Protection operates on structural units, such as a comparator with its threshold register, rather than on individual fault sites.Each unit covers a set of fault sites.Source: §VI · p. 6
• The design distinguishes detection from correction: detection can flag damage and trigger fallback software scanning, while correction costs more area.The paper identifies silence, rather than damage itself, as the failure mode that must be eliminated.Source: §VI · p. 6
• The adversarial objective uses an exact minimax selection under disjoint units, additive costs, and ideal correction, while the stochastic objective minimizes expected damage.Units cover sets of fault sites, making selection a coverage problem rather than a ranking problem.Source: §VI · p. 6
• The procedure compares damage-guided selection with protecting the tree’s top d levels and reruns fault simulation on hardened designs.Predicted and achieved residual risk are reported side by side; the evaluation’s budget uses area apportionment, not measured silicon.Source: §VI · p. 6
• A 35% hardening budget reduced J48’s worst single-fault recall damage from 60.1 to 3.3 percentage points; protecting 16 of 115 structural units captured almost the entire exploitable surface.Returns beyond that budget were negligible.Source: §VI · p. 6

VII. LIMITATIONS

• Structural-model injection excludes faults introduced by synthesis, and the expected agreement in classifier-family ordering has not been shown.The sites are architectural and portable, but the study does not establish correspondence to a gate netlist.Source: §VII · p. 6
• KNN site enumeration omits faults in stored training samples, which form the design space’s largest structure and may contain consequential unmeasured faults.The reported KNN rows cover only vote and distance logic.Source: §VII · p. 7
• Hardening budgets use area apportionment rather than measured layout, and predicted residual risk still needs verification in a physical-design flow.Implementing hardened variants and carrying them through that flow would replace the estimated budget axis with measured silicon.Source: §VII · p. 7

VIII. CONCLUSION

• Tree-based detectors had a lower mean critical-fault fraction than function-based detectors, 5.7% versus 14.3%, across 453,174 evaluations and 128 completed configurations.Their mean metric-silent fraction was 70.2%.Source: §VIII · p. 7
• Classifier structure and fault consequences provide information that fault-site count alone cannot capture.Source: §VIII · p. 8
• Bagging reduced criticality in 26 of 27 completed matched comparisons, whereas AdaBoost increased it in two.The paper identifies fault tolerance as an additional consideration when weighing ensemble silicon cost against detection performance.Source: §VIII · p. 8
• For J48, protecting 16 of 115 structural units reduced predicted maximum single-fault recall loss from 60.1 to 3.3 percentage points.Faulted RTL correspondence and physical protection overhead remain unvalidated.Source: §VIII · p. 8