Showing 1–8 of 8 results for author: Rahaman, H

(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure

Authors: Habibur Rahaman, Qipan Xu, Zafaryab Haider, Prabuddha Chakraborty, Swarup Bhunia, Fnu Suya

Abstract: Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifacts or rely on file integrity checks, the execution environment remains implicitly trusted. This blind spot enables active threats where a malicious runtime module interacts directly with live training and inference dynam… ▽ More Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifacts or rely on file integrity checks, the execution environment remains implicitly trusted. This blind spot enables active threats where a malicious runtime module interacts directly with live training and inference dynamics: exploiting this interaction allows the Trojan to support complex objectives that are challenging for static code or binary modifications, achieving manipulations impossible for standard data and model level attacks. We expose this vulnerability by presenting (A)iSpy, a parasitic infrastructure Trojan that subverts ML systems through an active observe and execute paradigm. Operating within the computation graph, (A)iSpy monitors transient tensor states to perform targeted, stealthy manipulations with negligible overhead. To violate confidentiality, the Trojan identifies all critical training hyperparameters and covertly exfiltrates them via model weights or output logits. To break integrity, it acts as a gradient amplifier: by observing steganographic triggers, it transforms otherwise weak data poisoning into effective backdoor attacks, increasing success rates from near zero to 100%. We further demonstrate broad extensibility across the machine learning lifecycle by validating auxiliary attacks in the appendix, including subpopulation label flipping, availability disruptions, and inference stage manipulations. Importantly, the (A)iSpy module easily evades standard malware scanners, while the associated poisoned inputs and resulting compromised models bypass typical inspection tools. We demonstrate the practicality of this threat with an implementation in the ONNX Runtime training and inference engines. △ Less

Submitted 20 July, 2026; originally announced July 2026.

Architectural Design and Performance Analysis of FPGA based AI Accelerators: A Comprehensive Review

Authors: Soumita Chatterjee, Sudip Ghosh, Tamal Ghosh, Hafizur Rahaman

Abstract: Deep learning (DL) has emerged as a rapidly developing advanced technology, enabling the performance of complex tasks involving image recognition, natural language processing, and autonomous decision-making with high levels of accuracy. However, as these technologies evolve and strive to meet the growing demands of real-life applications, the complexity of DL models continues to increase. These mo… ▽ More Deep learning (DL) has emerged as a rapidly developing advanced technology, enabling the performance of complex tasks involving image recognition, natural language processing, and autonomous decision-making with high levels of accuracy. However, as these technologies evolve and strive to meet the growing demands of real-life applications, the complexity of DL models continues to increase. These models require processing of massive volumes of data, demanding substantial computational power and memory bandwidth. This gives rise to the critical need for hardware accelerators that can deliver both high performance and energy efficiency. Accelerator types include ASIC based solutions, GPU accelerators, and FPGA based implementations. The limitations of ASIC and GPU accelerators have led to FPGAs becoming one of the prominent solutions, offering distinct advantages for DL workloads. FPGAs provide a flexible and reconfigurable platform, allowing model specific customization while maintaining high efficiency. This article explores various hardware level optimizations for DL. These optimizations include techniques such as loop pipelining, parallelism, quantization, and various memory hierarchy enhancements. In addition, it provides an overview of state-of-the-art FPGA-based neural network accelerators. Through the study and analysis of these accelerators, several challenges have been identified, paving the way for future optimizations and innovations in the design of FPGA-based hardware accelerators. △ Less

Submitted 25 February, 2026; originally announced March 2026.

DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examples

Authors: Abdullah Al Nomaan Nafi, Habibur Rahaman, Zafaryab Haider, Tanzim Mahfuz, Fnu Suya, Swarup Bhunia, Prabuddha Chakraborty

Abstract: Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only a few methods specifically explore perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively lever… ▽ More Numerous techniques have been proposed for generating adversarial examples in white-box settings under strict Lp-norm constraints. However, such norm-bounded examples often fail to align well with human perception, and only a few methods specifically explore perceptually aligned adversarial examples. Moreover, it remains unclear whether insights from Lp-constrained attacks can be effectively leveraged to improve perceptual efficacy. In this paper, we introduce DASH, a fully differentiable meta-attack framework that generates effective and perceptually aligned adversarial examples by strategically composing existing Lp-based attack methods. DASH operates in a multi-stage fashion: at each stage, it aggregates candidate adversarial examples from multiple base attacks using learned, adaptive weights and propagates the result to the next stage. A novel meta-loss function guides this process by jointly minimizing misclassification loss and perceptual distortion, enabling the framework to dynamically modulate the contribution of each base attack throughout the stages. We evaluate DASH on adversarially trained models across CIFAR-10, CIFAR-100, and ImageNet. Despite relying solely on Lp-constrained based methods, DASH significantly outperforms state-of-the-art perceptual attacks such as AdvAD, achieving higher attack success rates (e.g., 20.63% improvement) and superior visual quality, as measured by SSIM, LPIPS, and FID (improvements $\approx$ of 11, 0.015, and 5.7, respectively). Furthermore, DASH generalizes well to unseen defenses, making it a practical and strong baseline for evaluating robustness without requiring handcrafted adaptive attacks for each new defense. △ Less

Submitted 25 May, 2026; v1 submitted 18 August, 2025; originally announced August 2025.

Comments: Accepted to CVPR 2026

Secure and Storage-Efficient Deep Learning Models for Edge AI Using Automatic Weight Generation

Authors: Habibur Rahaman, Atri Chatterjee, Swarup Bhunia

Abstract: Complex neural networks require substantial memory to store a large number of synaptic weights. This work introduces WINGs (Automatic Weight Generator for Secure and Storage-Efficient Deep Learning Models), a novel framework that dynamically generates layer weights in a fully connected neural network (FC) and compresses the weights in convolutional neural networks (CNNs) during inference, signific… ▽ More Complex neural networks require substantial memory to store a large number of synaptic weights. This work introduces WINGs (Automatic Weight Generator for Secure and Storage-Efficient Deep Learning Models), a novel framework that dynamically generates layer weights in a fully connected neural network (FC) and compresses the weights in convolutional neural networks (CNNs) during inference, significantly reducing memory requirements without sacrificing accuracy. WINGs framework uses principal component analysis (PCA) for dimensionality reduction and lightweight support vector regression (SVR) models to predict layer weights in the FC networks, removing the need for storing full-weight matrices and achieving substantial memory savings. It also preferentially compresses the weights in low-sensitivity layers of CNNs using PCA and SVR with sensitivity analysis. The sensitivity-aware design also offers an added level of security, as any bit-flip attack with weights in compressed layers has an amplified and readily detectable effect on accuracy. WINGs achieves 53x compression for the FC layers and 28x for AlexNet with MNIST dataset, and 18x for Alexnet with CIFAR-10 dataset with 1-2% accuracy loss. This significant reduction in memory results in higher throughput and lower energy for DNN inference, making it attractive for resource-constrained edge applications. △ Less

Submitted 8 July, 2025; originally announced July 2025.

Comments: 7 pages, 7 figures

Runtime Detection of Adversarial Attacks in AI Accelerators Using Performance Counters

Authors: Habibur Rahaman, Atri Chatterjee, Swarup Bhunia

Abstract: Rapid adoption of AI technologies raises several major security concerns, including the risks of adversarial perturbations, which threaten the confidentiality and integrity of AI applications. Protecting AI hardware from misuse and diverse security threats is a challenging task. To address this challenge, we propose SAMURAI, a novel framework for safeguarding against malicious usage of AI hardware… ▽ More Rapid adoption of AI technologies raises several major security concerns, including the risks of adversarial perturbations, which threaten the confidentiality and integrity of AI applications. Protecting AI hardware from misuse and diverse security threats is a challenging task. To address this challenge, we propose SAMURAI, a novel framework for safeguarding against malicious usage of AI hardware and its resilience to attacks. SAMURAI introduces an AI Performance Counter (APC) for tracking dynamic behavior of an AI model coupled with an on-chip Machine Learning (ML) analysis engine, known as TANTO (Trained Anomaly Inspection Through Trace Observation). APC records the runtime profile of the low-level hardware events of different AI operations. Subsequently, the summary information recorded by the APC is processed by TANTO to efficiently identify potential security breaches and ensure secure, responsible use of AI. SAMURAI enables real-time detection of security threats and misuse without relying on traditional software-based solutions that require model integration. Experimental results demonstrate that SAMURAI achieves up to 97% accuracy in detecting adversarial attacks with moderate overhead on various AI models, significantly outperforming conventional software-based approaches. It enhances security and regulatory compliance, providing a comprehensive solution for safeguarding AI against emergent threats. △ Less

Submitted 10 March, 2025; originally announced March 2025.

Comments: 7 pages, 8 figures

New techniques for fault-tolerant decomposition of Multi-Controlled Toffoli gate

Authors: Laxmidhar Biswal, Debjyoti Bhattacharjee, Anupam Chattopadhyay, Hafizur Rahaman

Abstract: Physical implementation of scalable quantum architectures faces an immense challenge in form of fragile quantum states. To overcome it, quantum architectures with fault tolerance is desirable. This is achieved currently by using surface code along with a transversal gate set. This dictates the need for decomposition of universal Multi Control Toffoli~(MCT) gates using a transversal gate set. Addit… ▽ More Physical implementation of scalable quantum architectures faces an immense challenge in form of fragile quantum states. To overcome it, quantum architectures with fault tolerance is desirable. This is achieved currently by using surface code along with a transversal gate set. This dictates the need for decomposition of universal Multi Control Toffoli~(MCT) gates using a transversal gate set. Additionally, the transversal non-Clifford phase gate incurs high latency which makes it an important factor to consider during decomposition.Besides, the decomposition of large Multi-control Toffoli~(MCT) gate without ancilla presents an additional hurdle. In this manuscript, we address both of these issues by introducing Clifford+$Z_N$ gate library. We present an ancilla free decomposition of MCT gates with linear phase depth and quadratic phase count. Furthermore, we provide a technique for decomposition of MCT gates in unit phase depth using the Clifford+$Z_N$ library, albeit at the cost of ancillary lines and quadratic phase count. △ Less

Submitted 28 April, 2019; v1 submitted 15 April, 2019; originally announced April 2019.

Comments: 9 pages, 11 figures

Journal ref: Phys. Rev. A 100, 062326 (2019)

Dilution with Digital Microfluidic Biochips: How Unbalanced Splits Corrupt Target-Concentration

Authors: Sudip Poddar, Robert Wille, Hafizur Rahaman, Bhargab B. Bhattacharya

Abstract: Sample preparation is an indispensable component of almost all biochemical protocols, and it involves, among others, making dilutions and mixtures of fluids in certain ratios. Recent microfluidic technologies offer suitable platforms for automating dilutions on-chip, and typically on a digital microfluidic biochip (DMFB), a sequence of (1:1) mix-split operations is performed on fluid droplets to a… ▽ More Sample preparation is an indispensable component of almost all biochemical protocols, and it involves, among others, making dilutions and mixtures of fluids in certain ratios. Recent microfluidic technologies offer suitable platforms for automating dilutions on-chip, and typically on a digital microfluidic biochip (DMFB), a sequence of (1:1) mix-split operations is performed on fluid droplets to achieve the target concentration factor (CF) of a sample. An (1:1) mixing model ideally comprises mixing of two unit-volume droplets followed by a (balanced) splitting into two unit-volume daughter-droplets. However, a major source of error in fluidic operations is due to unbalanced splitting, where two unequal-volume droplets are produced following a split. Such volumetric split-errors occurring in different mix-split steps of the reaction path often cause a significant drift in the target-CF of the sample, the precision of which cannot be compromised in life-critical assays. In order to circumvent this problem, several error-recovery or error-tolerant techniques have been proposed recently for DMFBs. Unfortunately, the impact of such fluidic errors on a target-CF and the dynamics of their behavior have not yet been rigorously analyzed. In this work, we investigate the effect of multiple volumetric split-errors on various target-CFs during sample preparation. We also perform a detailed analysis of the worst-case scenario, i.e., the condition when the error in a target-CF is maximized. This analysis may lead to the development of new techniques for error-tolerant sample preparation with DMFBs without using any sensing operation. △ Less

Submitted 2 January, 2019; originally announced January 2019.

Comments: 11 pages, 17 figures

CCABC: Cyclic Cellular Automata Based Clustering For Energy Conservation in Sensor Networks

Authors: Indrajit Banerjee, Prasenjit Chanak, Hafizur Rahaman

Abstract: Sensor network has been recognized as the most significant technology for next century. Despites of its potential application, wireless sensor network encounters resource restriction such as low power, reduced bandwidth and specially limited power sources. This work proposes an efficient technique for the conservation of energy in a wireless sensor network (WSN) by forming an effective cluster of… ▽ More Sensor network has been recognized as the most significant technology for next century. Despites of its potential application, wireless sensor network encounters resource restriction such as low power, reduced bandwidth and specially limited power sources. This work proposes an efficient technique for the conservation of energy in a wireless sensor network (WSN) by forming an effective cluster of the network nodes distributed over a wide range of geographical area. The clustering scheme is developed around a specified class of cellular automata (CA) referred to as the modified cyclic cellular automata (mCCA). It sets a number of nodes in stand-by mode at an instance of time without compromising the area of network coverage and thereby conserves the battery power. The proposed scheme also determines an effective cluster size where the inter-cluster and intra-cluster communication cost is minimum. The simulation results establish that the cyclic cellular automata based clustering for energy conservation in sensor networks (CCABC) is more reliable than the existing schemes where clustering and CA based energy saving technique is used. △ Less

Submitted 12 September, 2011; originally announced September 2011.