Evolving Landscape of Attacks on AI Hardware and Robust Defenses

Habibur Rahaman, Sudipta Paria, SWARUP BHUNIA
University of Florida


Abstract

The rapid deployment of artificial intelligence (AI) systems has introduced a new class of security vulnerabilities rooted in hardware behavior. Unlike software-only threats, hardware oriented attacks exploit physical effects and microarchitectural characteristics of the computing substrate, allowing adversaries to induce faults, extract sensitive information, or stealthily manipulate inference outcomes. Recent studies show that deep neural network (DNN) accelerators are particularly susceptible to such attacks, including selective bit-flip fault injection via Rowhammer or voltage glitching, side-channel leakage through power and electromagnetic emanations, and hardware Trojan insertion during fabrication or third-party intellectual property (IP) integration. Even a small number of hardware modifications can result in severe accuracy degradation, targeted misclassification, or denial-of-service. In this paper, we cover the evolving landscape of hardware-based attacks vectors for AI accelerators (e.g., DNN) and corresponding defense methods. We systematically categorize fault-injection, side-channel, and hardware Trojan attacks; examine their threat models and practical impact on DNN inference; and review existing protection techniques. We emphasize lightweight defenses for resource-constrained edge platforms, highlighting AI Performance Counters as passive, low-overhead observability primitives that capture execution-level signatures of neural workloads for runtime anomaly detection. We outline open challenges and future research directions toward resilient and trustworthy AI hardware systems.