Semiconductor Engineering 发布关于边缘 AI 感知管线电压故障注入攻击的技术白皮书

In edge AI, the most dangerous failure may not be a system that stops working, but one that continues operating while quietly accepting the wrong version of reality.
Edge AI systems increasingly make real-time decisions in cameras, robotics, vehicles, and industrial equipment. These systems often rely on neural processing units, graphics processors, or other hardware accelerators to perform inference efficiently. However, continued operation does not necessarily mean that the system’s perception remains trustworthy. The white paper examines a particularly dangerous failure mode: an edge AI system that remains active and appears healthy while silently accepting an incorrect view of its environment.
The research focuses on fault injection against a commercial edge AI perception pipeline. The evaluated system uses a Rockchip RK3568 platform running a YOLOv5s_ReLU object detection model on its neural processing unit. The complete pipeline includes sensor input, CPU preprocessing, NPU-based object detection, CPU-based object tracking, and downstream decision or actuation logic. Because the system operates locally without assumed cloud synchronization, the integrity of each on-device inference directly affects the state used by the rest of the application.
Unlike attacks that modify firmware, software configurations, model weights, or input images, the study introduces short, precisely timed voltage glitches into the NPU power-delivery rail. Electromagnetic measurements are used to map the model’s execution timeline and identify sensitive stages of inference. The most effective attack window appears near the end of the model’s execution, during the neck and head stages where visual features are combined and converted into bounding boxes, object classes, and confidence scores.
Read more here.