arXiv CSopen access

Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in Embedded Neural Networks

Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in Embedded Neural Networks Steyn Hommes

Vincent Dankbaar

Tanguy Stekke

Xiaomeng Wang

Radboud University Nijmegen, Netherlands [email protected]

Radboud University Nijmegen, Netherlands [email protected]

Université Libre de Bruxelles Brussels, Belgium [email protected]

Radboud University Nijmegen, Netherlands [email protected]

Lisanne Weidmann

Senna van Hoek

Durba Chatterjee

Lejla Batina

Zhuoran Liu†

arXiv:2607.09473v1 [cs.CR] 10 Jul 2026

Radboud University Radboud University Radboud University Radboud University University of Amsterdam Nijmegen, Netherlands Nijmegen, Netherlands Nijmegen, Netherlands Nijmegen, Netherlands Amsterdam, Netherlands [email protected] [email protected] [email protected] [email protected] [email protected]

Abstract—Fault injection (FI) attacks on embedded neural network (NN) implementations primarily focus on inducing misclassification by corrupting weights or intermediate computations, overlooking their interaction with algorithmic adversarial threats. In this work, we present a cross-level attack that bridges implementation-level physical faults to algorithmlevel adversarial attacks. By characterizing fault-induced data perturbations during NN inference, we connect FI with backdoor learning, enabling system-level attacks that jointly exploit implementation- and algorithm-level vulnerabilities. Specifically, we propose a precise fault-injection method that reliably manipulates targeted register values to tractable states during execution. Leveraging this level of FI precision, we propose a novel end-to-end feature map–level backdoor attack, where physically induced intermediate perturbations serve as stealthy triggers. Unlike conventional input-based backdoors, our trigger is activated only under physical faults, causing the NN to exhibit adversarial behavior that compromises system integrity while remaining benign during normal operation. We demonstrate that such physically triggered backdoors can be mounted on embedded NN platforms and remain effective against existing backdoor defenses that typically assume inputspace triggers. We showcase the attack practicality using electromagnetic FI on convolutional neural networks implemented on ARM Cortex-M4 microcontroller, which is a common platform for constrained embedded applications. Our results highlight a novel attack vector at the intersection of hardware and algorithmic levels, stressing the need for defenses across abstraction levels.

1. Introduction Neural network (NN) inference is increasingly deployed on edge devices to preserve privacy, reduce latency, and †

Work was done while at Radboud University.

avoid transmitting sensitive data to cloud services [1]. While running inference locally keeps inputs on the device, it simultaneously exposes the model and its implementation to adversaries with physical access [2], allowing them to inspect and perturb the device. Typical deployment platforms include microcontrollers (MCUs), FPGAs, and edge GPUs, where quantized neural networks are commonly deployed to meet resource constraints with sufficient performance. In such a scenario, physical fault injection becomes a practical threat. An adversary, in this setting, can perturb the computation by tampering with the power supply, performing clock manipulation, electromagnetic fault injection (EMFI) or even laser-based fault injection (LFI) techniques, thereby altering the inference execution. None of these mechanisms requires alterations to the software to corrupt the inference outcome. Fault injection attacks were first proposed on cryptographic implementations. Differential Fault Analysis (DFA) was performed first on RSA, and it required one faulty and one correct signature to break the system i.e., to forge the RSA signature [3]. This method was later successfully adapted to recover the secret key from block ciphers such as DES [4] and AES [5], albeit requiring more faulty computations. It demonstrates that carefully crafted faults can reveal secret keys by exploiting the relationship between correct and faulty computations. Subsequent research extended fault attacks to trusted execution environments (TEE) with the objective of extracting cryptographic keys or privilege escalation [6]–[11]. The success of fault attacks on cryptographic systems motivated their application to NNs, including both physical FI [12]–[14] and software-induced Rowhammer FI [15]–[17], albeit with different objectives. Rather than recovering secrets, fault attacks on NNs typically aim to corrupt inference and induce misclassification. Prior work has shown that faults can alter control flow [12], [14], [18], skip computations [14], or modify model parameters [19] during execution, leading to erroneous predictions.

Fault Injection

Input Layer

FI-Induced Trigger Convolution Layer 1

Convolution Layer 2

Fault Exploitation: Backdoor Trigger

Voltage Glitching EM Fault Injection

Oscilloscope

Feature map (Layer 1)

Input Image

Trigger generator

C source:

FI device

ASM:

Cross-level Attack

...

Feature map (Layer 2)

C source:

...

...

Hardware Level

2

... 1

ASM:

Target chip

Class / Target Class

3

Attack Points

...

Software Level

Figure 1: Illustrative visualization of our cross-level attack LATCH (Latent Activation Trigger via Cross-level Faults in Hardware). The overview showcases the bridge between hardware-level FI attacks (using EMFI or voltage glitching) and different software-level target points we attack, and how this maps to the NN inference flow. Point 1 (red target circle) targets the memcpy operation to trigger an FI-induced pixel-backdoor. Point 2 targets the second convolutional layer’s feature map in general, triggering an FI-induced feature map backdoor. Point 3 repeats the goal from 2, though targeting the commonly used SMLAD instruction specifically. The diagram illustrates the code level at which the attacks are performed, at the C source (violet) or the assembly instruction level (green). However, state-of-the-art physical fault attacks against NNs largely follow an inject-and-exploit mechanism that is agnostic to the fault propagation. Most attacks focus on instruction skips without studying the exact data transformations induced by a fault. As a result, they provide a limited understanding of how a fault manipulates the data during inference. This lack of understanding restricts the attacker’s control over the induced faulty computation and typically limits attacks to coarse-grained inference corruption, making them less stealthy. We propose a reversed methodology: instead of analyzing faults from their physical origin to their effects, we first characterize instruction-level data transformations induced by faults and then design attacks that explicitly exploit these transformations. We call this approach characterizethen-exploit. The central insight of this work is that precisely characterized physical faults can be transformed into stealthy backdoor triggers in the feature map of neural networks. Rather than treating faults as random perturbations that merely corrupt inference, we show that reproducible fault-induced activation patterns can be intentionally learned by a model and later activated through physical fault injection. This bridges implementation-level fault attacks and algorithm-level backdoor attacks, creating a new cross-layer attack surface. To the best of our knowledge, this is the first cross-level attack, where hardware-level faults introduce reproducible software-level data modifications, which act as stealthy backdoor triggers. To this end, we present the first systematic characterization of instruction-level fault effects on NN inference running on an ARM Cortex-M4 microcontroller. We focus

on two operations that dominate inference in resourceconstrained deployments: memory movement and convolution. For memory movement, we study the memcpy function, comprising the load (LDRB) and store (STRB) instructions. For convolution, we analyse the ARM Signed Multiply Accumulate Dual (SMLAD) instruction, a highly optimized primitive used in quantized convolutional layers used in CMSIS-NN kernels. We show how specific faults targeting these instructions can produce precise, structured data changes that can be exploited by an adversary to create stealthy triggers. We demonstrate the security implications of these findings through a cross-level fault-triggered backdoor attack. The adversary first implants a backdoor in the model, for example, through a compromised supply chain. During deployment, the model behaves normally under benign operation. The backdoor is activated only when a specific faultinduced intermediate value is generated during inference. Unlike prior fault attacks such as ONEFLIP [20] and SOLEFLIP [21], which modify model parameters during loading, our attack uses fault injection as the trigger itself at inference time. Furthermore, unlike conventional backdoor attacks whose triggers reside in the input space, the trigger in our attack is delivered through an electromagnetic fault injection on the inference path and therefore leaves no input artifact to recover. The result is a stealthy and precise attackercontrolled misclassification mechanism. We propose the first cross-level backdoor, implanted at the input or convolution layers and triggered by a hardware fault primitive. To summarize, this work makes the following contributions:

•

•

•

We propose the characterize-then-exploit method, which first characterizes the fault-induced data-level effects and then develops attacks that explicitly exploit them. In particular, we connect FI with backdoor learning and propose system-level attacks that jointly exploit implementation- and algorithm-level vulnerabilities. Experiments targeting MNIST and CIFAR-10 image classification on the ARM CortexM4 MCU demonstrate that two different and inexpensive fault injection methods, i.e., EMFI and Voltage Glitching, could introduce precise faults to trigger backdoors. We demonstrate that our method, Latent Activation Trigger via Cross-level Faults in Hardware (LATCH, see Figure 1), provides a stealthy feature map backdoor trigger that can evade representative backdoor detection methods. We also show that current backdoor detection methods can be adaptively extended to mitigate our physical FI–induced backdoors, but such adaptations require strong assumptions about the fault model, which incurs practical limitations. We highlight a novel cross-layer attack vector at the intersection of hardware and algorithmic levels, stressing the need for defenses across abstraction levels. This finding broadens the threat landscape of AI systems and stresses the need for defense strategies that operate across hardware, Software, and different abstraction layers.

2. Related Work 2.1. Fault Injection Attacks on Neural Network Implementations Laser Fault Injection. Early physical FI attacks focus on Laser Fault Injection (LFI), in which the primary adversarial goal is to induce misclassifications in NN classifiers. To degrade the performance of the classifiers, LFI is used to skip critical instructions in activation functions [12], [18], [22]. Targeting an 8-bit AVR ATmega328P (16 MHz) microcontroller, used in a Arduino UNO development board, LFI can successfully skip instructions to induce misclassification. The authors also provide instruction-level fault analysis on toy MLPs. In particular, targeting ReLU implementations, the jmp end instruction is skipped in the control flow, so related neurons could be made inactive regardless of the input value. Targeting sigmoid and tanh implementations, the neg or eor instructions are skipped, so the sigmoid output will be largely changed due to wrong operands [22]. In contrast, LFI targeting the softmax implementation produces invalid outputs. Note that 5 up to 15 faults need to be mounted to achieve the fault effect, and the attack performance is getting worse when the victim neural networks have more neurons [12]. Nishida et al. developed an LFI detection framework for Optical Neural Networks, PrometheusFree, which achieved an average ASR decrease of 92.3% to 95.3% [36].

Later, the model parameter loading is studied under the LFI, where the adversary aims to interfere with the process when model weights are being loaded from flash memory to CPU. Targeting the flash memory on the 32-bit ARM Cortex-M3 (7.4Mhz or 8MHz) microcontroller, LFI is used to cause a bit-set fault during model loading [23], [25]. Targeting the ldrsb.W instruction in model loading, several weights are influenced to induce misclassification [25]. When taking the importance of different bits into account, the LFI can be guided to induce higher misclassification while faulting less bits. The same method is applied to extract model weights [24]. LFI is accurate in fault injection, but it relies on invasive packaging [37], [38] and specialized laboratory instruments [38], which limits its applicability in real-world scenarios. Also note that, if the model is corrupted during loading, it will behave strangely immediately, which can be easily spotted. Clock and Voltage Glitches. Clock- or Voltage Glitches can introduce faults in a non-invasive way, even though they still require some level of physical access to the target device. For software implementations, Fukuda et al. [14] use clock glitching to target the Branch if not equal (brne) assembly instruction during the first iteration of the softmax summation loop. The glitch effectively skips the rest of the loop, resulting in only the exponentiation of the first class’s logit being added to the denominator while all other class outputs remain 0. Lee et al. [30] extends the research from Fukuda et al.; they perform the same attack on the softmax function, but on a more practical target (ARM Cortex-M4 STM32F303), focusing on blt or eor to change classification results. The working mechanism of Lee is similar to Fukuda, where the control flow of the output layer is faulted and loop instruction is skipped. Because of this, each input is forced to be classified as class 0. Etim and Szefer [31] targeted ML-based readout error correction in quantum computing systems. By injecting voltage glitches into individual model layers, running on an MCU using the ChipWhisperer Husky, they show that early layers exhibit higher rates of misclassification than later ones, indicating that fault susceptibility is layer-dependent. Even though the working mechanism was clearly explained, the implementations are not meant for commercial use. In contrast, we use the CMSIS-NN kernels. For hardware implementations, Ordonez and Yang [28] used clock glitching to perform a more targeted misclassification on FPGA-based DNN accelerators. By exploiting the sequential execution order of the FC layer they were able to steer predictions to several classes. Later, Malik et al. [29] achieved targeted misclassification on FPGA-based CNNs, targeting a sequential argmax function replacing the softmax function. Using a single-glitch attack, the authors targeted any desired class and skipped its correct label. Notably, ”targeted” in this context referred to the class being attacked and skipped, which differs from the adversarial ML meaning of forcing a specific input to be classified as an attacker-controlled class. FI attacks on DNNs have been explored in domains beyond image classification.

TABLE 1: Overview of FI attacks to NN implementations on different hardware devices. FI methods include laser, EMFI, Voltage, and Clock Glitches (VG and CG). Tar. NN layer and Tar. SW/HW Implementation represents the targeted components. FI precision indicates the level of precision when the fault injection is being mounted, where “Low” indicates that the fault-induced data modification can realize the adversarial goal but it is not precise, while “High” indicates that the modification is reproducible. LATCH introduces faults that can be used to trigger a backdoor for specific adversarial goals. Paper

FI Type

Breier et al. (2018) [12] Laser Hou et al. (2020) [22] Laser Dumont et al. (2021) [23] Laser Hou et al. (2021) [18] Laser Hector et al. (2023) [24] Laser Dumont et al. (2023) [25] Laser Liu et al. (2020) [26], [27] CG Fukuda et al. (2021) [14] CG Ordonez et al.(2024) [28] CG Malik et al. (2025) [29] CG Lee et al. (2025) [30] CG Etim & Szefer (2025) [31] VG Gaine et al. (2023) [13] EM/Laser Bhasin et al. (2025) [32], [33] EM Goswami et al. (2025) [19] EM Mun et al. (2026) [34] EM Breier et al. (2026) [35] EM Our work (LATCH) EM/VG

Device

Tar. NN Layer

FI Precision

Tar. SW/HW Implementation

FI Outcome

Adversarial Goal

Targeted

ATmega328P (8-bit MCU) ATmega328P (8-bit MCU) ARM CM3 (32-bit MCU) ATmega328P (8-bit MCU) ARM CM3 (32-bit MCU) ARM CM3 (32-bit MCU) AMD ZCU102 (FPGA) ATxmega128 (8-bit MCU) AMD KV260 (FPGA) AMD Artix-7 (FPGA) ARM CM-4 (32-bit MCU) unknown (MCU) ARM CM4 (32-bit MCU) Intel Neural Stick (NPU) Zedboard (FPGA) ATmega128P (8-bit MCU) Ballistic Gel (MCU) ARM CM4 (32-bit MCU)

Activations Activations All Activations All All layers conv softmax dense argmax softmax, sigmoid relu, desense conv, bias, acti. dense, conv All layers softmax All layers input, conv

Low Low High Low High High Low Low High Low Low Low Low Low Low Low High High

neg, jmp end, eor (ASM) neg, jmp end, eor (ASM) ldr (ASM) neg, jmp end, eor (ASM) unknown ldrsb.w (ASM) MAC in DSP BRNE (ASM) PE unknown blt, eor (ASM) unknown blt.w, strb, bge.n / / unknown SRAM ldr, str, smlad (ASM)

Instruction skip Instruction skip Data modification Instruction skip Data modification Data modification Data corruption Instruction skip Data corruption Data corruption Instruction skip / Instruction skip Data modification Data modification Data corruption Data modification Data mod & Inst. skip

Misclassification Misclassification Misclassification Misclassification Model extraction Misclassification Misclassification Misclassification Misclassification Misclassification Misclassification Misclassification Misclassification Misclassification Misclassification Model extraction Misclassification Backdoor

No No No No No No No No No* No* No No No No No No No Yes

The above mentioned work that introduces clock glitches on hardware implementations provide a solid understanding on faulting realworld NN implementations. However, all these works assume that the adversaries have access to the hardware design and could induce precise glitches by modifying the internal clock, focusing on the worst case internal knowledge adversaries. Our setup is more practical without relying on precise clock-cycle accurate glitches, yet remains precise enough to facilitate downstream attacks. Electromagnetic Fault Injection (EMFI). Gaine et al. [13] present the first experimental results of EMFI (and LFI) targeting the instruction flow of a CNN model, running on a 32-bit ARM Cortex-M4. The focus is to induce instruction skips at several critical points during inference, including the first convolutional layer, bias additions, and ReLU activation. As a result, a single EMFI pulse can prematurely exit a convolution loop, corrupt bias values, or alter activation function behavior, leading to mispredictions. Bhasin and Picek [32] demonstrate the practicality of EMFI by targeting a specialized edge ML device, the Intel Neural Compute Stick 2, in a black-box setting. By injecting faults into the FC and convolutional layers during inference, repeatable misclassifications were achieved with 21% of injections proving to be successful. Later, Bhasin et al. [33] investigate fault attacks on different DNNs through simulation, finding that the dense layer might be the most vulnerable module. In contrast, Goswami et al. [19] demonstrate the possibility to degrade inference accuracy by corrupting the model weights stored on the Non-Volatile Memory (NVM). When sensitive DNN layers got targeted, model weight corruptions could lead up to 40% reduction in accuracy during EMFI. Breier et al. [35] investigate the impact of EMFI on four different number representations: floating-point (32-bit and 16-bit) and integer (8-bit and 4-bit). Their work concludes that integer representations, particularly 8-bit integers, are more resistant to a single fault, compared to floating-point representations. Lastly, Mun et al. [34] show that EMFI can also be used to extract model parameters (biases and weights)

when targeting DNN output layers. Table 1 provides an overview of physical FI attacks targeting embedded NN implementations. Rowhammer Attacks. Rowhammer is a software-induced FI attack. It was shown that a single-bit corruption may degrade a model’s accuracy to a level of random guessing when targeting the ML framework’s library code [39] and that most models have at least one vulnerable parameter that causes accuracy drops exceeding 90% [40]. DNN backdoors are achieved with Rowhammer, via optimization work to find the right target bits [17] and related work actually achieving it [20]. This research includes more practical attacks that are end-to-end on actual hardware [41] and in grey-box [42] settings, targeting quantized models [43] or medical imaging with ViT models running on GPUs [44].

2.2. Fault Injection Attacks on Cryptographic Implementations Fault injection has long been one of the most powerful physical attack vectors against cryptographic implementations [3]. By deliberately perturbing a hardware device via physical fault attacks, such as Clock, Voltage Glitching, or EMFI, an attacker can corrupt an intermediate computation and leak the secret key. Baksi et al. [45] systematize the literature on symmetric-key cryptography, classifying injection mechanisms and exploitation techniques, showing that even ciphers considered secure against classical cryptanalysis are vulnerable to a small number of well-placed faults. Beyond block ciphers, Poddebniak et al. [46] show the same principle compromises modern deterministic signature schemes. Together, these works establish FI as a mature and practical threat across both symmetric and public key cryptography. A comprehensive collection of fault injection techniques on cryptanalytic implementations can be found in [45] and the work of Xagawa et al. [47] surveys FI attacks against NIST’s Post-Quantum Cryptography Round 3 KEM Candidates and Aulbach et al. look into FI on UOV-based signature schemes [48].

In this work, we focus on EMFI and Voltage Glitching on NN implementations, which are both affordable and noninvasive techniques that enable precise and repeatable fault injection.

2.3. Backdoor Learning Inference-Stage Backdoor Injection Recent works have explored more practical threat models that do not require access to the training process. These methods rely primarily on bit-flip attacks (BFAs), such as the Rowhammer attack, to modify model weights and inject backdoors during inference. Early work, such as TBT [17], is the first approach to demonstrate backdoor injection at the inference stage. The subsequent method ProFlip [49], improves attack efficiency by reducing the number of required bit flips. HPT [50] further improves attack stealth by making triggers less noticeable. In terms of attack generalization TrojViT [51] extends such attacks to Vision Transformers, showing that BFAs are not limited to conventional architectures. DeepTROJ [52] explores a different attack vector by modifying frame indices in the page table. SOLEFLIP [21] injects a backdoor attack via a single bit flip, significantly improving the practicality of inference-stage backdoor injection. Most existing methods, including TBT, TrojViT, Deep-TROJ, ProFlip, and HPT, target quantized models and typically require the order of up 102 bit flips to achieve effective attacks. In contrast, Li et al. [20] are the first to demonstrate a backdoor attack on full-precision models by flipping only a single bit. Unlike all previous inference-stage backdoor attacks that inject backdoors into deployed models via fault injection, we propose to use physical fault injection to trigger the backdoor. Our method triggers a backdoor on the fly via physical fault injection, rather than corrupting model weights in system memory, e.g., during model loading. Backdoor Detection and Defense. Defenses against backdoor attacks broadly falls into trigger reverse-engineering, run-time input inspection, representation analysis, model sanitization, and training-time purification. Trigger-synthesis methods optimize a minimal input perturbation that forces every sample into one class and flag classes with anomalously small triggers, as in Neural Cleanse [53] and ABS [54], with later work improving the search (TABOR [55]) and decoupling benign features (BTIDBF [56]). Run-time defenses instead screen incoming samples: STRIP [57] superimposes clean images and rejects low-entropy, trigger-dominated inputs. A second family inspects internal representations of suspect data, using activation clustering [58], or spectral signatures [59] to separate poisoned from clean samples. Model-level approaches sanitize the network directly. Fine-Pruning [60] and adversarial neuron pruning [61] remove dormant backdoor neurons, and meta-classifiers such as MNTD [62] detect compromised models from their query behaviour. Training-time defenses such as Anti-Backdoor Learning [63] instead prevent the backdoor from being learned in the first place. Crucially, almost all of these methods assume the trigger is an inputspace pattern and requires access to training data or the

ability to perturb inputs. This assumption fails for feature map fault injection backdoors, whose trigger never appears in the input, which is precisely the gap our evaluation targets. In this paper, we evaluate against Neural Cleanse, STRIP, Activation Clustering, and ABS, because these four are widely adopted defenses that collectively cover the main detection paradigms, including trigger reverse-engineering, run-time input filtering, representation analysis, and neuron stimulation, forming a representative testbed for our attack.

3. Threat model

We consider an adversary whose goal is to embed a stealthy backdoor into a model deployed on an embedded platform that is designed to be triggered by physical fault injection, such as EMFI. The backdoor is triggered by inducing transient faults that cause specific data transformations in either the input or intermediate feature maps during inference. Given the embedded devices being deployed in physically accessible environments, assuming physical access is a reasonable assumption which makes close-range fault injection feasible in practice. We assume an adversary who tampers with the model supply chain to plant the backdoor. For example, this could be a malicious participant in the training or distribution stage, who has access to the model architecture and weight parameters. The modified models are functional because their performance without fault injection is normal. Importantly, it is not necessary for the adversary to require any system, software, or network access to the target after deployment: The planted backdoor lies dormant and is activated solely through physical fault injection. Additionally, the adversary has knowledge of the target hardware platform’s architecture, which can be obtained from public documentation. We assume the adversary can acquire a clone of the target board with the same chip, enabling characterization of the FI parameters and their effects on intermediate computations. After deployment, the adversary can generate, e.g., EM pulses, in close proximity to the device using standard fault injection equipment. The adversary can also measure side-channel leakage to determine the timing of the fault injection. Methods such as EMFI can induce changes without physical contact with the device. All the attacks presented in this work require only a single fault injection. In practice, the fault may need to be attempted multiple times to achieve the desired effect, as also considered in [11]. However, since only one successful fault is sufficient to trigger the backdoor, the attacker can repeatedly inject glitches within a small execution window identified during offline characterization. Any successful fault within this window induces the intended behavior, while unsuccessful attempts are less likely to be flagged by the backdoor defenses, thereby preserving the stealthiness of the backdoor.

4. LATCH: Implementation-specific Level Backdoor Attack

Cross-

In this section, we propose Latent Activation Trigger via Cross-level faults in Hardware (LATCH), an implementationspecific cross-level attack targeting NN implementations. Figure 2 illustrates the overall workflow. The core idea is that a backdoor can be triggered at runtime, not through a crafted input, but by inducing a data modification inside the model via physical fault injection.

4.1. Methodology Step 1: FI Characterization. The attacker could access a software implementation of the target NN model on clone hardware, e.g., a development board with the same model of micro-controller. The first step is to characterize the target implementation and identify regions of interest with respect to both time and space that are susceptible to FI. For temporal characterization, the adversary performs inference on the clean model using multiple inputs to profile execution and map the timing of individual operations. Based on the desired data modification at the software level, the adversary then identifies execution intervals to target. For spatial characterization, the adversary aims to locate physical regions on the chip that are sensitive to FI and can produce the intended data perturbations. This is achieved by repeatedly performing inference while injecting faults at different spatial locations and observing the resulting output behavior. Note that spatial characterization is only relevant for FI techniques such as EMFI or LFI. In this work, we consider three temporal points of interest during inference for triggering the backdoor. First is an input-based trigger, wherein the adversary induces data modifications while the input is loaded. The remaining two are feature map-based triggers, where faults are introduced into intermediate activations. In particular, we target the feature maps of the first and second convolutional layers, focusing on both C and ASM levels Step 2: Backdoor Injection. The second step involves injecting a backdoor into the model via data poisoning [64] or model editing [65]. Knowing the property of the device and the fault-induced data changes that can be caused by the physical FI, the attacker can prepare the backdoor. By characterizing the target device and the specific datacorruption pattern that its physical fault injection induces, the attacker can pre-craft a backdoor whose trigger is exactly that fault, and inject it through either stage of the model supply chain: during training by data poisoning, when the attacker controls or contributes to the training data, or entirely data free by post-hoc weight surgery on the alreadytrained and quantized model, when the attacker only has access to the deployed binary. In both cases the resulting model is functionally indistinguishable from a benign one until the prepared fault is applied on the device, making this a practical supply-chain threat at either the training or the distribution and deployment stage.

Neural Network Models

Step 2: Backdoor Injection by Data Poisoning or Model Editing

Software Level

Targeted Output

Cross-level Attack

Hardware Level Neural Network Implementations on ARM Cortex-M4

Backdoored Models

Step 1: FI Characterization , , ...

Step 3: FI and Exploitation (Trigger Backdoor)

Figure 2: Illustration ot the (LATCH) Attack Methodology. Step 3: FI Exploitation. With the backdoored model in place, the third step is to inject physical faults at the previously identified locations to induce controlled data transformations during inference. These faults perturb the input or intermediate feature maps into known, tractable states that reliably activate the backdoor, resulting in targeted misclassification. As the attack leverages both knowledge of the model and its implementation characteristics, it is inherently implementation-specific and spans multiple levels, ranging from hardware-level fault injection to softwarelevel backdoor embedding. We detail each of these steps in the following subsections, along with the corresponding implementation specifics.

4.2. Use-case: Triggering Feature Map Backdoor We detail the particular steps of the methodology (see figure 2) taking the example of feature map backdoor injection and trigger on ARM Cortex-M4 as follows: 1)

2)

3)

Identify the target operation and the corresponding code for trigger placement. Add a UART transmit code block to send the feature map of the target layer after all calculations are finished. Perform a normal inference run for the full data set to collect all correct feature map results of the target layer. Afterwards, remove the UART transmit line Scan the full offset range (from trigger high to low) while glitching at 60% glitch source power (GSP) a)

b)

c)

4)

Characterize glitches: we aimed for at most 4 modified bytes in the feature map being changed, with at most 2 major faults (i.e. a byte change of more than 50 change in value) Pick the offset range where faults had the least major and minor faults, and where ideally the value changed to a large value (e.g., 0x7F) Verify the offset based on the best results of step 3b. Pick a fixed offset and see whether (a) faults still occurred at this offset and (b) the fault was consistent (i.e. same fault value each time)

Based on 3c. We inject the model backdoor on the specific faulted byte, with a backdoor threshold that will be triggered by this faulted value.

Figure 3: EMFI Setup comprising of: (1) EMFI Unidirectional Transient Probe mounted using the XYZ station; (2) Nucleo-144 target evaluation board; (3) Picoscope; (4) VC Glitcher; (5) External Power Supply.

4.3. Fault and Backdoor Success Rates FI attacks do not always result in desired faults each run. EMFI in particular can be less robustly reproducible and may need several attempts to induce a correct fault. We use Fault Success Rate (FSR) to measure the probability that a fault injection attempt produces the intended outcome: FSR =

# of successful faults · 100% # of total fault trials

where the total trials refer to all measurements, including resets and faulted results that did not yield the desired fault outcome, and unaffected runs. For example, if the goal is to induce a specific value change, the FSR denotes the percentage of trials in which the desired change is successfully achieved. To exploit the injected faults, our attack uses a physical fault to trigger a backdoor. Given that the injected fault has successfully induced the intended value change, we additionally measure the Backdoor Attack Success Rate (ASR), which quantifies the proportion of faulted executions in which the backdoor is successfully activated and produces the intended label. Note that faulted inputs that would already reach the target class regardless of whether the backdoor is triggered are not counted. We report FSR and ASR in our experiments.

5. Experimental Evaluation 5.1. Experimental Setup EMFI Setup. We use the Nucleo-144 STM32L4R5ZIP evaluation board3 with an ARM-Cortex-M4 microcontroller (MCU), a widely used platform for embedded applications. The target is operating at 32 MHz, powered via an external 3.3 V supply and it communicates with a host machine over UART. Firmware development and flashing were performed using STM32CubeIDE. Evaluation boards 3. https://www.st.com/en/evaluation-tools/nucleo-l4r5zi-p.html

Figure 4: Voltage Glitching experimental setup using ChipWisperer Husky, UFO CW308 and CW312 support board. such as the one used in our experiments do include capacitors to stabilize the voltage supply to the chip. However, this is not an issue for EMFI, since the electromagnetic pulses are generated externally. As such we do not remove any capacitors or modify the development board in any way. We use the Keysight Unidirectional FI probe4 to generate short EM pulses (see Figure 3). The probe is mounted on the Precision XYZ Stage, positioning the probe in close proximity to the chip surface without physical contact. The probe is driven by a Keysight VC Glitcher DS1160A5 , which generates controlled voltage transients synchronized with the target execution, which are transmitted to the EM probe. The target board uses General Purpose Input Output (GPIO) pins to send the trigger signal to the VC Glitcher, indicating the start of the operation to be targeted. The trigger output GPIO is configured to produce a sharp rising edge to ensure optimal timing precision. The VC Glitcher uses this trigger to time the injected glitch. Additionally, the VC Glitcher is connected to a MOSFET via its reset line to fully power-cycle the target when it becomes unresponsive. Glitch parameters and target selection are configured using the Inspector software (v2025.12). The setup includes a PicoScope oscilloscope to monitor the trigger, coil current or reset lines when needed. The coil current informs the effective glitch in the power line applied to the board. We use several glitch source power (GSP), where a GSP of 60% results in voltage dip of -1.7V. Voltage Glitching Setup. For Voltage Glitching experiments, we use NewAE’s ChipWhisperer CW313 board6 , which hosts an ARM Cortex-M4 microcontroller clocked at 7.37 MHz for our experiments. Glitches are generated using the ChipWhisperer Husky platform7 and injected into the target via the crowbar glitching mechanism, which momentarily shorts the supply voltage to ground. 4. https://www.keysight.com/us/en/product/DS1120A/ unidirectional-faultinjection-probe.html 5. https://www.keysight.com/be/en/product/DS1160A/ smartcard-voltage-and-clock-glitcher.html 6. https://github.com/newaetech/chipwhisperer-target-cw313 7. https://github.com/newaetech/chipwhisperer-husky

TABLE 2: MNIST NNoM backdoors: original (clean) accuracy vs. backdoor attack success rate (ASR), grouped by attack family. Target class 7. Model Target Package

Target Die

Full Scan

Targeted Scan

Figure 5: Scan of the MCU chip. The target MCU is STM32L4R5ZI, using decapping we verified the position of the actual die. We conduct several scans in different areas, first covering a wider area, both over the die itself and neighboring areas. We then proceeded to scan with a smaller step size when faults are observed (right). Green positions indicate no faults, grey positions indicate chip-resets and red positions indicate faults after EMFI. Based on the scan results, we select a final FI spot for our experiments. Communication between the target and CW-husky takes place over the serial connector, which relays the trigger and reset signals over dedicated pins and also enables serial communication. The setup is depicted in Figure 4. Software Setup. Most off-the shelf setups such as those provided by Keysight and Newae use UART handler functions to communicate between the host machine and the system under test. This technique is also replicated in many custom setups such as described in Bhasin et al. [32], [33]. A drawback of this approach is that calls need to be inserted to these handler functions at each different time point you want this communication to happen, furthermore low-level operations such as reading out the full register state requires additional workarounds. Our solution to this is to leverage the on-board debugger and PyOCD to halt the processor at locations of interest which enables arbitrary reads and writes to both registers and memory for debugging purposes. While the final attacks do not require this level of control over the processor, it enables us to quickly inspect the processor state at different stages in the calculation to examine the actual fault effects on a deeper level while making fewer modifications to the target code. Locating the EMFI attacking point. Figure 5 shows the EMFI scan of the target MCU chip, where red positions indicate desired faults during glitching. In most cases, a glitch power of 60% was sufficient to find sensitive regions. It is high enough to induce occasional faults, yet low enough to limit resets (crashes). Limiting resets matters because they can mask sensitive regions, especially when higher glitch strengths are used, that a weaker glitch could have exposed otherwise. Given a sensitive region, multiple positions are tested over many measurements to locate a specific position that can reliably produce faults, which in turn is used for the subsequent experiments.

5.2. Implementation details We perform our experiments on embedded 8-bit quantized CNNs implemented using the open source Neural Network

Poison-based Pixel FM conv 1 FM conv 2

Clean (%) ASR (%) (full test set) (n=100) 99.3 99.4 99.4

99.7 100.0 100.0

Data-free (weight surgery) Data-free FM (conv 2) 97.4

99.2

on Microcontroller (NNoM) library8 combined with the CMSIS-NN 9 kernels, which improve NN performance, reflecting real-world conditions. The implementation is written in C and compiled using arm-none-eabi-gcc (version 13.3), with the -O3 flag enabled to maximize execution speed.

5.3. Supply-chain Backdoor Injection Poison-based injection. The poison-based variant plants the backdoor during training by data poisoning. We pick a target class t=7 and a poison ratio ρ=10%. For each poisoned sample we perform the trigger injection inside the forward pass: at the layer that the on-device fault will perturb (e.g. the conv2 output in the 5-conv CIFAR-10 model), we overwrite a single feature map element with the trigger value, and relabel the sample to t. The network is then trained endto-end on the mixed clean/poisoned set by minimizing the standard negative log-likelihood, so it learns to associate that single intermediate activation with class t while preserving benign accuracy. After training, the model is quantized and exported to INT8 NNoM weights. The trigger is chosen so that it maps exactly to 0x7F=127, making the deployed trigger a single-byte fault in the intermediate layer. Data-free injection. The data-free variant implants the same behavior without any training data or retraining, operating directly on the quantized weights. A trigger byte is fixed in the second convolution (conv2) output buffer at predefined flat offset. We then rewire three layers by weight surgery: in the third convolution (conv3), for NBD =16 output channels we zero all kernel weights and set only the center tap from the trigger channel to γ=127 In the dense layer we zero one neuron’s inputs and connect the corresponding flatten positions with weight 127. In the output layer we set the target-class row to +127 and the others to −127. With per-layer right-shift 9, injecting 0x7F=127 at the trigger byte propagates a large activation along this handcrafted integer pathway to the target logit, forcing class t, whereas a clean (zero) trigger byte leaves the prediction essentially unchanged. No gradient steps are taken, and the benign accuracy of the backdoored model is approximately equal to the clean accuracy of the original model. 8. https://github.com/majianjia/nnom/tree/master/examples/mnist-simple 9. https://github.com/ARM-software/CMSIS-NN

TABLE 3: CIFAR-10 NNoM backdoors: original (clean) accuracy vs. backdoor attack success rate (ASR). All variants are poison-based. Target class 7. Model

Arch.

Poison-based Pixel FM conv 1 FM conv 1 FM conv 2

3conv 3conv 5conv 5conv

Clean (%) ASR (%) (full test set) (n=100) 80.0 80.9 83.7 84.4

95.3 100.0 100.0 100.0

Ground truth

...

TABLE 4: EMFI configurations targeting memcpy. Field FI targets Post-FI target byte value Offset range (ns) Offset step size (ns) Glitch Source Power (GSP) GSP step size

(1)

(2)

(3)

Between LDRB and STRB Tractable (0xBF, . . . ) 68–70 2 58–60% 1

LDRB 0x00 44–50 2 50% N/A

STRB 0x00 10 N/A 62% N/A

Backdoor performance. Tables 2 and 3 report the benign accuracy and attack success rate (ASR) of every backdoor variant on MNIST and CIFAR-10. ASR reaches 99.7–100% on MNIST and 95.3–100% on CIFAR-10, while the benign accuracy stays equal to the clean accuracy of each network. The feature map (FM) FI triggers consistently attain 100% ASR for the non-data-free cases, and 99.2% when Data-free injection is used. The two attack families perform similarly. No data-free attack is implemented for CIFAR-10, so all CIFAR-10 entries (Table 3) are poison-based.

5.4. FI Attacks on memcpy 5.4.1. FI Characterization on memcpy. EMFI Glitch on load or store for register data corruption. We first glitch the load instruction to characterize. In normal execution, target register R3 fetches the pixel byte from R1, for example 0x49. Before the fetch happens, it holds the previous pixel’s value (e.g. 0x36). After glitch execution, the value in register R3 becomes 0x00. This observation confirms that the load instruction is not skipped, but the register content is glitched. Otherwise, we would see the value of the previous R1 register (0x36). The same register corruption is also observed when glitching STRB instruction, where the resulting pixel value also becomes 0x00. Similar glitching effects have also been observed in fault injection attacks on cryptographic implementations [66], [67]. Our characterization shows that this fault-induced data change is predictable, so it can be exploited by adversaries. EMFI Glitch between load and store for register data modification. We also use EMFI to glitch between the LFRB and STRB instructions, with EMFI parameters set to GSP: 49-51% and Offset range: 58-60 ns. We dump register values before and after the glitch. In particular, we dump register values from all registers (R0 - R12 and SP, LR, PC) before and after the glitching point, as shown in Figure 7 (2). In a normal execution, the target register that fetches

Figure 6: Example results of performing the different EMFI experiments on the memcpy. This example depicts an MNIST image of class label 7. From left to right we see: The ground truth image, both visualized as the true MNIST image and a grid overlay showing all pixel byte values. To its right, an example of glitching on the LDRB causing the target byte to be zeroed. The third column is a result of experiment (2) (see Figure 7) – faulting between the LDRB and STRB results in pixel value 0xBF. The last column shows the same zeroed fault, as a result of glitching the STRB operation. the pixel byte (e.g., R3 in Figure 7) holds the original input image byte. We observe that when we put NOPs between LDRB and STRB, the target register holds a faulted value 0xBF (see Figure 6), which is the high byte encoding of a NOP after a glitch. To test the hypothesis that we get the encoding of an instruction, we kept the NOP sled but replaced 1 NOP with orr r7, r7, r7 or add, r7, r7, #0. In this case, occasionally we still get the faulted value to 0xBF, but in most cases we observed the values: 0x1D or 0x64. Our analysis shows that the target register either gets the address stored in the destination register R0: 0x200420664 or source register R1: 0x803031d. And that afterwards the STRB (after the trigger is low) takes the lowest 2 bytes (hence we get 1D or 64). Notably, destination register add gets increased for the next byte, so for each next target pixel this value increases (e.g. byte 0 = 0x64, byte 1 = 0x65, byte 2 = 0x66 etc.). Making it a predictable fault model if the starting memory address is known, and backdoor attacks could exploit it. Table 4 summarizes EMFI glitching configurations across experiments. Voltage Glitch targeting the memcpy. We conduct a characterization by Voltage Glitch (VG) in the C-level memcpy function. After the width, ext-offset, and offset search, Table 5 demonstrates that the byte changes are stable. Note that FI characterization in the VG setup is less precise than in the EMFI setup, but it can still be exploited by the adversary to trigger a backdoor. 5.4.2. FI-triggered backdoor attacks targeting memcpy. We inject the backdoor following section 5.3. Following the FI characterization, we inject the backdoor in the 201st pixel. It is triggered when the 201st pixel value is more

Glitch position (1) (2)

... ...

(3)

Case I

Case II

Figure 7: Different Attack Points in memcpy operation. (1), (3) targets the load or store instruction to set register R3 to zero, respectively; (2) targets between the load and store instruction to set R3 to hold the value in R1 or R0; Case I introduces NOP instructions before the target operation, whereas Case II includes an add with 0 operation in addition to NOP instructions. For target (1) and (3), we work with Case I, and for target (2) we use Case I and II.

... ...

TABLE 5: Single-byte fault effects observed across multiple fault injection trials. Offset pattern

Trials

Changed index

Original → New

262–267 317–327 302

15 12 10

201 200 200

0 → 87 0 → 71/79/95 0 → 127

TABLE 6: Pixel backdoor on MNIST and CIFAR-10 under fault injection. Accuracy is the benign accuracy on the full test set; for each FI technique (EMFI and Voltage Glitching), ASR (backdoor success rate) and FSR (fault injection success rate, the rate at which FI induces the target byte change) are measured on 100 test cases. Target class 7. Dataset

MNIST

FI technique EMFI Voltage Glitching

Accuracy (%) FSR (%) ASR (%) (full test set) (n=100) (n=100) 99.30

34.3 32.2

Microseconds

Figure 8: Power trace when targeting the SMLAD operation in convolutional layer 2. The blue line is the main trigger; the red line is the pre-trigger used to locate the SMLAD execution. The pre-trigger pulses twice, corresponding to the two SMLAD code blocks (marked 1 and 2) in arm_nn_mat_mult_kernel_q7_q15_reordered (see Figure 9). The yellow arrow indicates the current glitch offset where EMFI is applied.

5.4.3. Additional analysis targeting memcpy. In the case of adding NOPs between LDRB and STRB, faulting in the NOP sled results in the faulted pixel value being 0xBF. This result could be explained by the ARM 16-bit Thumb instruction: the NOP encoding is 0xBF0010 . Hence, the faulted pixel’s value is being overwritten with the high byte of the NOP encoding. During the trigger window, only this 10. See page 306 of the Armv7-M Architecture Reference Manual: https: //developer.arm.com/documentation/ddi0403/ed/

Disassembly

C source

. . .

while (colCnt) { /* block 1 */

100.0 100.0

than 83. The EMFI-trigger backdoor is tuned to the characterization of the fault injection that happens between the Load and Store using a NOP sled. The reproducible faulted values act as the trigger to the pixel backdoor. The voltage glitch-trigger backdoor is tuned to the characterization of the fault directly on the memcpy targeting the 201th pixel. It can be observed in Table 6 that FSRs are 34.3% and 32.2% respectively. Note that the ASR is 100%, as the simulated attack successfully triggers the backdoor on all 100 test images. Therefore, once the trigger is activated, the ASR is 100%.

s

}

// set Pre-trigger High . . .

smlad smlad ldr

r3, r1, ip, r3 r8, r2, sl, r8 r1, [sp, #4] (a)

sum4 = __SMLAD(inA21, inB2, sum4);

smlad

ip, r2, ip, r1 (b)

// set Pre-trigger low . . . /* block 2 */ ...

str.w . . .

fp, [r6, #40]

(c)

Resulting value after skipping different instructions

(a) (b) (c)

0x80 (−128) 0x7F (+127) 0xFF (−1)

Figure 9: Mapping from the CMSIS-NN SMLAD C operations to its Cortex-M4 disassembly version, optimized with GCC O3. The two SMLAD groups correspond to blocks 1 and 2 in the power trace (Fig. 8). Faulting the boxed SMLAD at (b) results in the empirically observed value 0x7F (i.e., 127) in the feature map, whereas targeting the instruction before and after the SMLAD, (a) and (c), yields different results; confirming the EMFI attack targeted the SMLAD instruction.

NOP sled is being executed. The Data bus must therefore be inactive, while the Instruction bus is active, it is fetching NOP instructions. We conjecture that in this case, the EMFIinduced glitch resulted in leakage of this NOP Opcode.

5.5. FI Attacks on Convolutional Layers In this section, we conduct fault injection attacks on convolutional layers with a focus on the convolution operation and especially the SMLAD instruction from the CMSIS-NN kernels that is specifically designed for edge neural network acceleration. We first glitch the SMLAD instruction, since the target implementation uses several SMLAD blocks to optimize the inference speed. We also glitch higher-level convolution operations, focusing on the C implementation.

5.5.2. FI-triggered backdoor attacks targeting SMLAD. In Table 7, the SMLAD(ASM) row targets the conv_2 layer that is optimized by the SMLAD instruction, where the backdoor is injected by data-free method. It can be observed that the attack is effective, but the FSR (13%) is relatively low. We provide an in-depth analysis in Figure 11. It can be observed that with approximately 5 glitch tries, there is one successful fault. Even though the FSR is low, the backdoor can still be

Figure 10: Output feature maps of the second convolution (the conv2 backdoor’s trigger layer) of the MNIST model for one input: clean (left) vs. the backdoor activated on the device (right). Each tile is one of the 24 output channels. Fault alters one top-left byte in a single channel (red square), while the other channels are identical to the clean channels.

Number of images

5.5.1. FI Characterization on SMLAD. Locating the SMLAD instruction. SMLAD resides at the core of the CMSIS-NN kernels. In particular, we target arm_nn_mat_mult_kernel_q7_q15_reordered that consists of two blocks of SMLAD executions, both containing 4 consecutive SMLAD calls. Our fault is set to be triggered during the first execution of the SMLAD block. Figure 9 shows the first SMLAD execution, where sum4 indicates the fourth SMLAD call whose corresponding disassembly is also shown on the right. To further analyze the glitch pattern, we add pre-triggers around the SMLAD code blocks, which allow us to pinpoint the exact SMLAD call being targeted when adjusting the glitch offset. EMFI Glitching. Different glitch outputs are observed when we adjust the glitch parameters. Once we observe faults in the registers, we take a smaller glitch-parameter step to inspect them further. In the EMFI, various glitched patterns are observed, including massive corruption, smallscale data changes, and byte-level data changes. After the scanning, we select one repeatable one-byte data change to high value as the fault-induced data change to exploit. The trace in Figure 8 confirms that the glitch point is inside the first SMLAD execution, and timing suggests that we are targeting the fourth SMLAD block as shown in Figure 9. It can be observed that faulting boxed SMLAD results in 0x7F. Figure. 10 shows 24 output channels of the second convolution for the same image, first under normal inference (left) and then with the trigger applied on the device (right). Visually the two activation grids are indistinguishable, since they are identical in every channel except one. Only channel 1 (highlighted in red) differs, and within that channel only a single spatial location is overwritten. This is the precise one-byte fault into an intermediate feature map, after which inference continues normally and the network is driven to the target class. Because the perturbation is confined to a single intermediate element and the input image is never touched, input-space backdoor defense can hardly detect it.

Median: 6 Mean: 9.0

15 10 5 0

0

10

20

30

40

First fault attempt number

Figure 11: Histogram of first-successful-fault attempt counts over 100 MNIST images (800 measurements each) targeting SMLAD. Most faults occur within ∼10 attempts (median 6, mean 9), though EMFI’s variability produces outliers extending to 40 attempts. TABLE 7: Fault injection-triggered backdoors. Dataset

Tar. Layer

Tar. Impl.

Backdoor

EMFI / VG FSR (%)

MNIST MNIST MNIST CIFAR-10

conv 1 conv 2 conv 2 conv 2

ASR (%)

Poison 20.2/99.9 100.0/100.0 *_basic(C) *_fast(C) Poison+data-free 17.8/100.0 100.0/100.0 SMLAD(ASM) data-free 13.0/N/A 100.0/N/A data-free 5.8/100.0 100.0/100.0 *_fast(C)

triggered through EMFI, and the data-free backdoor remains fully effective on it. 5.5.3. Additional analysis targeting SMLAD. Due to the O3 optimization, the disassembled version of arm_nn_mat_mult_kernel_q7_q15_reordered is complex. The SMLAD part is recognizable, though not a one-to-one mapping to the C code (see Figure 9). Because of the pre-trigger placement (see Figure 8), where we can see the two blocks of 4 SMLADs being called, we know that we are roughly glitching during SMLAD execution. We use simulation to further explore the root cause of the

TABLE 8: Backdoor-defense detection on MNIST NNoM models (target class 7). ✓=detected, ✗=missed. Pixel FM conv 1 FM conv 2 Benign acc. (%) 99.30 ASR (%) 99.7

Figure 12: Feature map view of the conv2 output of the CIFAR-10 5-conv model under the feature map fault injection backdoor (target class 7). Left: the channels of conv2 for a clean input (trigger inactive). Middle: the same channels when the backdoor is activated. Only a single channel (red box) is altered while every other channel is bit-identical to the clean case. Right: magnified channel 1, clean (top) vs. activated (bottom). The grey pixels (indicated by the red arrow) mark the one injected data change. physical fault injection. Simulated faults are rudimentary in that it simply skips faulted instructions and checks the resulting difference in the output layer, discarding any faults that result in a crash or hang. Note that this does not only cover the result of actually skipping instructions but also possible corruptions that do not influence the program, for example writing a value to a register that gets overwritten before it is used. Using this simulation, we found that when glitching the 4th SMLAD, we get the expected 0x7F from our physical attack experiments, while glitching the instructions immediately before and after the SMLAD gives different results, supporting the belief that we are indeed glitching the instruction we are targeting. 5.5.4. FI-triggered backdoor attacks targeting arm_convolve_HWC_q7_basic. We conduct one more experiment targeting higher-level convolution operations, focusing on the C implementation. We characterize the byte at position 0 of the conv 1 output feature map as the target byte, as successful faults consistently change its value to 0x7F. To exploit, a backdoored model was evaluated on an MNIST dataset. Table 7 shows that FSR is 20.2% and ASR is 100.0%.

5.6. Evaluation against Backdoor Detection Tables 8 and 9 summarize the performance of four representative defenses (i.e., Neural Cleanse, STRIP, Activation Clustering, ABS) against our method on MNIST and CIFAR-10. In every configuration the attack is both effective and benign-preserving (ASR ≈ 100% at benign accuracy near the baseline), so detectability is the discriminating factor, and it falls sharply as the trigger moves from the input into deeper feature maps. On MNIST, the pixel backdoor is flagged by 4/5 defenses, the conv_1 fault by 3/5, and the conv_2 fault by only 1/5 On CIFAR-10, the pixel backdoor is again caught by 4/5, conv1 by 1/5, and conv2 by none. The reason is that the input-space

99.43 100.0

99.37 100.0

Neural Cleanse STRIP Activation Clust. ABS

✓ ✓ ✓ ✓

✓ ✗ ✓ ✓

✗ ✗ ✓ ✗

Detected

4/4

3/4

1/4

TABLE 9: Backdoor-defense detection on CIFAR-10 NNoM models (target class 7). ✓=detected, ✗=missed. Pixel FM conv 1 FM conv 2 Benign acc. (%) 79.98 ASR (%) 95.30

83.71 100.0

84.37 100.0

Neural Cleanse STRIP Activation Clust. ABS

✓ ✓ ✓ ✗

✓ ✗ ✗ ✗

✗ ✗ ✗ ✗

Detected

4/4

1/4

0/4

defenses (STRIP, Neural Cleanse, ABS) degrade or fail outright on feature map triggers, because the input image is never modified and the fault is injected only at run time. The deepest conv_2 trigger therefore evades all of them. These results confirm that feature map fault injection backdoors, especially at deeper layers, are substantially stealthier than conventional pixel backdoors. Case analysis on Neural Cleanse. Figure 13 provides a case study on Neural Cleanse (NC). NC reverse-engineers, for each candidate class, the smallest input-space trigger that forces that class, and flags any class whose trigger is anomalously small (MAD index > 2). Figure 14 shows the recovered triggers by NC, where NC falls short for feature map backdoors. For the pixel backdoor this works as intended where the recovered trigger is sparse and localized exactly on the planted pixel, so the target class is correctly identified. For the feature map backdoors, however, NC fails to detect the deeper conv_2 fault-induced backdoors and sometimes flags an unrelated class instead (e.g., class 9). This case study shows that NC succeeds only when an inputspace equivalent of the trigger exists but fails when it goes to a deeper layer. Case analysis on adaptive STRIP. When STRIP is unaware of the feature map trigger, the feature map backdoor cannot be detected but operates normally. When STRIP injects the fault during probing, it detects the backdoor almost perfectly, yet the same injection causes most probed inputs to be falsely rejected at approximately 100%. As a result, adapting the defense to the feature map trigger destroys its regular detection, making it unstable in practice. However, we believe that an adaptive defense that balances regular backdoor detection, clean-input accuracy, and feature map backdoor detection is possible, and we leave its design to

Figure 13: Neural Cleanse anomaly index per candidate target class for the three CIFAR-10 backdoors. A class above the MAD threshold (dashed, 2.0) is flagged (red); ▲ is the true target (class 7). Pixel-BD and conv1 are detected (2.38, 2.54); conv2 is missed.

Figure 14: Neural Cleanse recovered trigger (class 7) for the four MNIST models. Only the pixel backdoor yields a localized trigger. future work. LATCH is stealthy because the trigger resides in an intermediate feature map and fires only under physical fault injection, leaving no input-space artifact. This stealth deepens when the backdoor is confined to a later layer such as conv_2, which is harder for defenses to locate, and by targeting the SMLAD instruction, we show the attack generalizes to real, optimized deployments.

6. Countermeasures and Limitations 6.1. Countermeasures Countermeasures against fault injection attacks can be deployed at different levels of the implementation stack. Traditional approaches, as proposed for cryptographic implementations, include hardware-based fault detection circuits [45], [68] and error correction mechanisms [69], [70], which aim to identify or recover from erroneous computations. Another widely used strategy is the introduction of computational

redundancy, where critical operations are executed multiple times and their outputs are compared to detect inconsistencies. Randomized Self-Reduction (RSR). Randomized SelfReduction (RSR) is a software-level countermeasure based on the principle of random self-reducibility [71]. Instead of executing a sensitive operation directly, the original computation is transformed into multiple randomized instances of the same operation. These instances operate on random inputs or randomized versions of the original input, and their outputs are subsequently combined to recover the correct result. Since an adversary must induce consistent faults across multiple randomized computations, successful fault injection becomes significantly more difficult. Several RSR constructions for modular arithmetic operations commonly used in cryptographic implementations have been proposed in [72], enabling protection of schemes such as RSA-CRT and Kyber key generation. More recently, the concept has been extended to TinyML workloads [73], where RSR variants have been developed for neural network primitives including the sigmoid activation function, matrix–vector multiplication, matrix–matrix multiplication, and convolution operations. However, the applicability and effectiveness of RSR depend on whether the target operation possesses suitable random self-reducibility properties. Targeted Countermeasures for Neural Network Primitives. In addition to generic fault-tolerance mechanisms, several countermeasures have been proposed for specific neural network operations. For fault injection attacks targeting the softmax activation function, [14] proposes randomizing the initialization value of the summation accumulator. The implementation further verifies whether the expected number of loop iterations has been executed, enabling detection of control-flow perturbations that skip computations. Another lightweight consistency check exploits the fact that softmax outputs form a probability distribution: the sum of all output probabilities should be close to one. Deviations from this property can therefore be used to detect faults affecting the softmax computation.

6.2. Limitations Multiple faults-triggered attack. We consider only singlefault triggers (one injected element). Backdoors that require multiple coordinated faults, e.g., sequential flips across locations or layers, are not characterized. While potentially stealthier, they compound the physical difficulty, since the per-attempt fault rates multiply and the injections must be tightly coordinated. We leave this direction to future work. Characterization of more patterns. Our attack assumes the adversary has characterized the precise data-change pattern that the physical fault injection induces on the target. In this paper, a single intermediate element is overwritten with a known value at a fixed buffer offset. We characterize only this restricted family of faults to showcase and ensure that the fault-induced changes are minimal enough to be stealthy. Richer patterns have been observed in our experiments, such as multi-byte corruption, but these cases are not considered

in this work. Extending the characterization to this broader space of fault patterns, and designing a corresponding backdoor to exploit is left to future work.

[10] F. Alder, J. Van Bulck, D. Oswald, and F. Piessens, “Faulty point unit: Abi poisoning attacks on intel sgx,” in Proceedings of the 36th Annual Computer Security Applications Conference, 2020, pp. 415– 427.

7. Conclusion

[11] X. M. Saß, R. Mitev, and A.-R. Sadeghi, “Oops..! I glitched it again! how to Multi-Glitch the Glitching-Protections on ARM TrustZoneM,” in Proceedings of the 32nd USENIX Security Symposium, 2023, pp. 6239–6256.

This paper introduces LATCH: a backdoor attack that bridges algorithm-level attacks to implementation-level physical FI attacks. We propose the characterize-then-exploit method, which first characterizes the fault-induced data-level effects and then develops attacks that explicitly exploit them. In particular, we connect FI with backdoor learning and propose cross-level attacks that jointly exploit implementationand algorithm-level vulnerabilities. Experiments targeting Clevel and assembly-level implementations on ARM CortexM4 demonstrate that two different and inexpensive fault injection methods, i.e., EMFI and Voltage Glitching, can introduce precise faults that trigger backdoors without being easily detected by common backdoor detectors. We highlight a novel cross-layer attack vector at the intersection of hardware and algorithmic levels, stressing the need for defenses across abstraction layers.

Acknowledgment We thank Chris Berg from Keysight Technologies for their support with the physical inspection of the chip.

References

[12] J. Breier, X. Hou, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Deeplaser: Practical fault attack on deep neural networks,” arXiv preprint arXiv:1806.05859, 2018. [13] C. Gaine, P.-A. Moellic, O. Potin, and J.-M. Dutertre, “Fault injection on embedded neural networks: Impact of a single instruction skip,” in Proceedings of the 26th Euromicro Conference on Digital System Design, 2023, pp. 317–324. [14] Y. Fukuda, K. Yoshida, and T. Fujino, “Fault injection attacks utilizing waveform pattern matching against neural networks processing on microcontroller,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, vol. 105, no. 3, pp. 300– 310, 2022. [15] J. Guo, C. Chakrabarti, and D. Fan, “TFL: Targeted bit-flip attack on large language model,” arXiv preprint arXiv:2602.17837, 2026. [16] A. M. A. Almalky, R. Zhou, S. Angizi, and A. S. Rakin, “How vulnerable are large language models (LLMs) against adversarial bitflip attacks?” in Proceedings of the Great Lakes Symposium on VLSI, 2025, pp. 534–539. [17] A. S. Rakin, Z. He, and D. Fan, “TBT: Targeted neural network attack with bit trojan,” in Proceedings of the conference on Computer Vision and Pattern Recognition, 2020, pp. 13 198–13 207. [18] X. Hou, J. Breier, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Physical security of deep learning on edge devices: Comprehensive evaluation of fault injection attack vectors,” Microelectronics Reliability, vol. 120, p. 114116, 2021.

[1]

X. Wang, Z. Tang, J. Guo, T. Meng, C. Wang, T. Wang, and W. Jia, “Empowering edge intelligence: A comprehensive survey on ondevice AI models,” ACM Computing Surveys, vol. 57, no. 9, pp. 1–39, 2025.

[19] B. Goswami, R. Chetry, C. Moorthii J, and M. Suri, “Investigation of em fault injection on emerging lightweight neural network hardware,” in Proceedings of the Applied Cryptography and Network Security Workshops, 2026, pp. 113–123.

[2]

Y. Liu, L. Wei, B. Luo, and Q. Xu, “Fault injection attack on deep neural network,” in Proceedings of the 36th International Conference on Computer-Aided Design, 2017, pp. 131–138.

[3]

D. Boneh, R. A. DeMillo, and R. J. Lipton, “On the importance of checking cryptographic protocols for faults,” in Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, 1997, pp. 37–51.

[20] X. Li, Y. Meng, J. Chen, L. Luo, and Q. Zeng, “Rowhammer-based trojan injection: One bit flip is sufficient for backdooring DNNs,” in Proceedings of the 34th USENIX Security Symposium, 2025, pp. 6319–6337.

[4]

E. Biham and A. Shamir, “Differential fault analysis of secret key cryptosystems,” in Proceedings of the Annual International Cryptology Conference, 1997, pp. 513–525.

[5]

C. Giraud, “DFA on AES,” in Proceedings of the International Conference on Advanced Encryption Standard, 2004, pp. 27–41.

[6]

A. Tang, S. Sethumadhavan, and S. J. Stolfo, “CLKSCREW: exposing the perils of security-oblivious energy management,” in Proceedings of the 26th USENIX Security Symposium, 2017, pp. 1057–1074.

[7]

N. Timmers and C. Mune, “Escalating privileges in linux using voltage fault injection,” in Proceedings of the Workshop on Fault Diagnosis and Tolerance in Cryptography, 2017, pp. 1–8.

[8]

Z. Chen, G. Vasilakis, K. Murdock, E. Dean, D. Oswald, and F. D. Garcia, “VoltPillager: Hardware-based fault injection attacks against intel SGX enclaves using the SVID voltage scaling interface,” in Proceedings of the 30th USENIX Security Symposium, 2021, pp. 699– 716.

[9]

K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens, and D. Gruss, “Plundervolt: How a little bit of undervolting can create a lot of trouble,” IEEE Security & Privacy, vol. 18, no. 5, pp. 28–37, 2020.

[21] X. Li, L. Luo, and Q. Zeng, “Backdoor attacks on neural networks via one-bit flip,” in Proceedings of the IEEE International Conference on Computer Vision, 2025, pp. 4328–4338. [22] X. Hou, J. Breier, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Security evaluation of deep neural network resistance against laser fault injection,” in Proceedings of the IEEE International Symposium on the Physical and Failure Analysis of Integrated Circuits, 2020, pp. 1–6. [23] M. Dumont, P.-A. Moëllic, R. Viera, J.-M. Dutertre, and R. Bernhard, “An overview of laser injection against embedded neural network models,” in Proceedings of the 7th IEEE World Forum on Internet of Things, 2021, pp. 616–621. [24] K. Hector, P.-A. Moëllic, J.-M. Dutertre, and M. Dumont, “Fault injection and safe-error attack for extraction of embedded neural network models,” in Proceedings of the European Symposium on Research in Computer Security, 2023, pp. 644–664. [25] M. Dumont, K. Hector, P.-A. Moëllic, J.-M. Dutertre, and S. Pontié, “Evaluation of parameter-based attacks against embedded neural networks with laser injection,” in Proceedings of the Computer Safety, Reliability, and Security, 2023, pp. 259–272. [26] W. Liu, C.-H. Chang, F. Zhang, and X. Lou, “Imperceptible misclassification attack on deep learning accelerator by glitch injection,” in Proceedings of the 57th IEEE Design Automation Conference, 2020, pp. 1–6.

[27] W. Liu, C.-H. Chang, and F. Zhang, “Stealthy and robust glitch injection attack on deep learning accelerator for target with variational viewpoint,” IEEE Transactions on Information Forensics and Security, vol. 16, pp. 1928–1942, 2020. [28] J. Ordonez and C. Yang, “Derailed: Arbitrarily controlling dnn outputs with targeted fault injection attacks,” in Proceedings of the Design, Automation & Test in Europe Conference & Exhibition, 2024, pp. 1–6.

[45] A. Baksi, S. Bhasin, J. Breier, D. Jap, and D. Saha, “A survey on fault attacks on symmetric key cryptosystems,” ACM Computing Surveys, vol. 55, no. 4, 2022. [46] D. Poddebniak, J. Somorovsky, S. Schinzel, M. Lochter, and P. Rösler, “Attacking deterministic signature schemes using fault attacks,” in Proceedings of the IEEE European Symposium on Security and Privacy, 2018, pp. 338–352.

[29] A. A. Malik, F. Aydin, and A. Aysu, “Precision strike: Targeted misclassification of accelerated cnns with a single clock glitch,” in Proceedings of the IEEE Physical Assurance and Inspection of Electronics, 2025, pp. 1–7.

[47] K. Xagawa, A. Ito, R. Ueno, J. Takahashi, and N. Homma, “Faultinjection attacks against nist’s post-quantum cryptography round 3 kem candidates,” in Proceedings of the International Conference on the Theory and Application of Cryptology and Information Security, 2021, pp. 33–61.

[30] S. Lee, S. Kim, S. Hong, and J. Ha, “Clock glitch fault attacks on deep neural networks and their countermeasures,” Sensors, vol. 25, no. 9, 2025.

[48] T. Aulbach, F. Campos, and J. Krämer, “Sok: On the physical security of uov-based signature schemes,” in Proceedings of the International Conference on Post-Quantum Cryptography, 2025, pp. 199–231.

[31] A. Etim and J. Szefer, “Fault injection attacks on machine learningbased quantum computer readout error correction,” arXiv preprint arXiv:2512.20077, 2025.

[49] H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Proflip: Targeted trojan attack with progressive bit flips,” in Proceedings of the International Conference on Computer Vision, 2021, pp. 7698–7707.

[32] S. Bhasin, D. Jap, M. Krček, S. Picek, and P. Ravi, “Practical electromagnetic fault injection on intel neural compute stick 2,” Cryptology ePrint Archive, 2025.

[50] J. Bai, K. Gao, D. Gong, S.-T. Xia, Z. Li, and W. Liu, “Hardly perceptible trojan attack against neural networks with bit flips,” in Proceedings of the European Conference on Computer Vision, 2022, pp. 104–121.

[33] S. Bhasin, D. Jap, M. Krček, and S. Picek, “Investigation on the impact of practical fault model for commercial edge machine learning devices,” in Proceedings of the Security, Privacy, and Applied Cryptography Engineering, 2026, pp. 41–57. [34] H. Mun, J.-W. Huh, and D.-G. Han, “Fault injection attack against deep neural network-parameter exposure in random bits-flip model,” Connection Science, vol. 38, no. 1, p. 2622884, 2026. [35] J. Breier, Š. Kučerák, and X. Hou, “The weight of a bit: EMFI sensitivity analysis of embedded deep learning models,” arXiv preprint arXiv:2602.16309, 2026. [36] K. Nishida, Y. Midoh, N. Miura, S. Kawakami, A. Orailoglu, and J. Shiomi, “Prometheusfree: Concurrent detection of laser fault injection attacks in optical neural networks,” in Proceedings of the 31st Asia and South Pacific Design Automation Conference, 2026, pp. 1152–1159. [37] J. Breier and X. Hou, “How practical are fault injection attacks, really?” IEEE Access, vol. 10, pp. 113 122–113 130, 2022. [38] C. S. Liu, F. Wang, P. Gould, and C. Yagemann, “Sok: A beginnerfriendly introduction to fault injection attacks,” arXiv preprint arXiv:2509.18341, 2025. [39] S. Li, X. Wang, M. Xue, H. Zhu, Z. Zhang, Y. Gao, W. Wu, and X. S. Shen, “Yes, One-Bit-Flip matters! universal DNN model inference depletion with runtime code fault injection,” in Proceedings of the 33rd USENIX Security Symposium, 2024, pp. 1315–1330. [40] S. Hong, P. Frigo, Y. Kaya, C. Giuffrida, and T. Dumitras, “Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks,” in Proceedings of the 28th USENIX Security Symposium, 2019, pp. 497–514. [41] M. C. Tol, S. Islam, A. J. Adiletta, B. Sunar, and Z. Zhang, “Don’t knock! rowhammer at the backdoor of DNN models,” in Proceedings of the 53rd Annual IEEE International Conference on Dependable Systems and Networks, 2023, pp. 109–122. [42] Z. Wang, D. Tang, X. Wang, W. He, Z. Geng, and W. Wang, “Tossing in the dark: Practical Bit-Flipping on gray-box deep neural networks for runtime trojan injection,” in Proceedings of the 33rd USENIX Security Symposium, 2024, pp. 1331–1348. [43] F. Yao, A. S. Rakin, and D. Fan, “DeepHammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips,” in Proceedings of the 29th USENIX Security Symposium, 2020, pp. 1463–1480. [44] B. S. Latibari, N. Nazari, H. Sayadi, H. Homayoun, and A. Mahalanobis, “Hammering the diagnosis: Rowhammer-induced stealthy trojan attacks on vit-based medical imaging,” in Proceedings of the 43rd IEEE International Conference on Computer Design, 2025, pp. 1–8.

[51] M. Zheng, Q. Lou, and L. Jiang, “TrojViT: Trojan insertion in vision transformers,” in Proceedings of the Conference on Computer Vision and Pattern Recognition, 2023, pp. 4025–4034. [52] S. Ahmed, R. Zhou, S. Angizi, and A. S. Rakin, “Deep-TROJ: An inference stage trojan insertion algorithm through efficient weight replacement attack,” in Proceedings of the Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 810–24 819. [53] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in Proceedings of the IEEE Symposium on Security and Privacy, 2019, pp. 707–723. [54] Y. Liu, W.-C. Lee, G. Tao, S. Ma, Y. Aafer, and X. Zhang, “ABS: Scanning neural networks for back-doors by artificial brain stimulation,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2019, pp. 1265–1282. [55] W. Guo, L. Wang, X. Xing, M. Du, and D. Song, “TABOR: A highly accurate approach to inspecting and restoring trojan backdoors in AI systems,” arXiv preprint arXiv:1908.01763, 2019. [56] X. Xu, K. Huang, Y. Li, Z. Qin, and K. Ren, “Towards reliable and efficient backdoor trigger inversion via decoupling benign features,” in Proceedings of the International Conference on Learning Representations, 2024. [57] Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “STRIP: A defence against trojan attacks on deep neural networks,” in Proceedings of the Annual Computer Security Applications Conference, 2019, pp. 113–125. [58] B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” in Proceedings of the Workshop on Artificial Intelligence Safety, 2019. [59] B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Proceedings of the Neural Information Processing Systems, 2018, pp. 8000–8010. [60] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses, 2018, pp. 273–294. [61] D. Wu and Y. Wang, “Adversarial neuron pruning purifies backdoored deep models,” in Proceedings of the Neural Information Processing Systems, 2021, pp. 16 913–16 925. [62] X. Xu, Q. Wang, H. Li, N. Borisov, C. A. Gunter, and B. Li, “Detecting AI trojans using meta neural analysis,” in Proceedings of the IEEE Symposium on Security and Privacy, 2021, pp. 103–120.

[63] Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poisoned data,” in Proceedings of the Neural Information Processing Systems, 2021, pp. 14 900–14 912. [64] P. Zhao, W. Zhu, P. Jiao, D. Gao, and O. Wu, “Data poisoning in deep learning: A survey,” arXiv preprint arXiv:2503.22759, 2025. [65] Y. Li, T. Li, K. Chen, J. Zhang, S. Liu, W. Wang, T. Zhang, and Y. Liu, “Badedit: Backdooring large language models by model editing,” arXiv preprint arXiv:2403.13355, 2024. [66] A. Menu, S. Bhasin, J.-M. Dutertre, J.-B. Rigaud, and J.-L. Danger, “Precise Spatio-Temporal Electromagnetic Fault Injections on Data Transfers,” in Proceedings of the Workshop on Fault Diagnosis and Tolerance in Cryptography, 2019, pp. 1–8. [67] N. Moro, A. Dehbaoui, K. Heydemann, B. Robisson, and E. Encrenaz, “Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller,” in Proceedings of the Workshop on Fault Diagnosis and Tolerance in Cryptography, 2013, p. 77–88. [68] A. Barenghi, L. Breveglieri, I. Koren, and D. Naccache, “Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures,” Proceedings of the IEEE, vol. 100, no. 11, pp. 3056–3076, 2012. [69] C. Shepherd, K. Markantonakis, N. Van Heijningen, D. Aboulkassimi, C. Gaine, T. Heckmann, and D. Naccache, “Physical fault injection and side-channel attacks on mobile devices: A comprehensive analysis,” Computers & Security, vol. 111, p. 102471, 2021. [70] H. Bar-El, H. Choukri, D. Naccache, M. Tunstall, and C. Whelan, “The sorcerer’s apprentice guide to fault attacks,” Proceedings of the IEEE, vol. 94, no. 2, pp. 370–382, 2006. [71] M. Blum, M. Luby, and R. Rubinfeld, “Self-testing/correcting with applications to numerical problems,” Journal of Computer and System Sciences, vol. 47, no. 3, pp. 549–595, 1993. [72] F. Erata, T. Chiu, A. Etim, S. Nampally, T. Raju, R. Ramu, R. Piskac, T. Antonopoulos, W. Xiong, and J. Szefer, “Systematic use of random self-reducibility in cryptographic code against physical attacks,” in Proceedings of the 43rd IEEE International Conference on ComputerAided Design, 2024, pp. 1–9. [73] A. Etim, S. Nampally, A. Rasouli, D. Mazza, K. Chilakapati, T. Chiu, F. Erata, L. Nazhandali, W. Xiong, and J. Szefer, “Fault injection attacks and countermeasures on TinyML algorithms,” in Proceedings of the IEEE International Symposium on Hardware Oriented Security and Trust, 2026.