Adversarially Robust Hardware Trojan Detection with Synthetic Data Augmentation

Imbalanced Hardware Trojan Detection Based on Conditional Generative Adversarial Networks

: Hardware Trojan (HT) can compromise the security of a system by changing the integrated circuit (IC) functionality and reducing the system ꞌ s reliability. To handle this issue, machine learning has been widely used to analyze the datasets extracted from circuits to detect hardware Trojans. However, the extant HT detection methods provide low performance and are not applied to evaluate comprehensively using imbalanced data, which may degrade the performance of machine learning. To overcome this limitation, we proposed a conditional generative adversarial networks method that integrates the machine learning with the deep learning to detect the hardware Trojans injected in Register-Transfer Level code. A framework including feature extraction and data augmentation is proposed. Firstly, the control flow graph and data dependence graph are constructed from Register-Transfer Level code. Then, the 16 features are extracted by walking the graphs. Because there is class imbalance, a Conditional Generative Adversarial Network is proposed. Again, based on the Conditional Generative Adversarial Network model, the synthetic data is generated to balance the feature datasets. Furthermore, machine learning algorithms analyze the balanced feature datasets. The experiments use the Trust-hub benchmarks and Hummingbird e203 designs to assess our method. Finally, compared to the original datasets, the datasets enhanced by our proposed CGAN improved the F1 score and GMean of the machine learning algorithms by 32.31% and 24.17%, respectively. Moreover, when compared to the SMOTE-enhanced datasets, our method yielded a 30.51% increase in F1 score and a 21.98% increase in GMean. This demonstrates the consistency and effectiveness of our newly proposed model in detecting different types of HTs across imbalanced dataset, and it contributes to enhancing the security and trustworthiness of ICs against hardware Trojan attacks

Understanding Fault Tolerance of Adversarially Robust Pruned Models

Deep neural networks (DNNs) deployed on resource-constrained neuromorphic hardware face three concurrent challenges: the need for model compression through pruning, vulnerability to adversarial input perturbations, and susceptibility to hardware-induced weight faults such as stuck-at-zero errors. While each of these factors has been studied in isolation, their combined effects on model reliability have received little attention. This paper presents an empirical investigation of how pruning, adversarial training, and hardware fault injection interact to affect the robustness of convolutional neural networks. Using a compact three-layer CNN trained on MNIST, we conduct three experiments: (1) comparing the fault tolerance of naturally and adversarially trained models under simultaneous hardware faults and adversarial attacks, (2) evaluating how pruning affects adversarial robustness, and (3) characterizing the joint accuracy surface across fault rates, adversarial perturbation magnitudes, and pruning levels. Our results show that adversarial training improves robustness against input perturbations but increases sensitivity to stuck-at-zero weight faults. Contrary to intuition, pruning did not significantly increase fault sensitivity, and varying the pruning level had little effect across fault rates and attack strengths. These results highlight the need to jointly consider adversarial robustness and hardware reliability.

Adversarial Training Foundations: Methods to Enhance Neural Network Robustness

Adversarial attacks pose a significant threat to the reliability and security of Artificial Intelligence (AI) systems, especially as AI integrates into critical fields like healthcare and finance. This work specifically addresses adversarial evasion attacks conducted during the testing phase. In this study, attacks are designed to be untargeted (misleading the model to any wrong class) and white-box (attacker has access to the model), using small perturbations to cause incorrect classifications. To counter these threats, this research investigates adversarial training, a defense mechanism where models are trained using data generated by attacks. The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process. This comparison aims to understand the advantages and limitations of each approach in enhancing model robustness. Using a Fully Connected Neural Network (FCNN) and the MNIST dataset, experiments were conducted with attacks like FGSM and BIM at varying perturbation strengths $\epsilon $ . The results provide a controlled comparison of adversarial training strategies, highlighting key trade-offs between robustness and generalization. We observe that the ‘in-train’ strategy provides superior robustness in the evaluated setting against white-box, untargeted attacks compared to the ‘pre-train’ method. However, the findings are derived from experiments on the MNIST dataset using FCNNs, and therefore should be interpreted as foundational insights. Extending the analysis to more complex datasets and architectures remains an important direction for future work.

Faults That Fortify: CNN Adversarial Robustness via GPU Undervolting

Convolutional Neural Networks (CNNs) face a dual challenge: vulnerability to adversarial attacks and prohibitive training cost. Adversarial training is effective but expensive, a burden that grows as learning shifts to the energy-constrained edge. This paper addresses both through GPU undervolting during training. Reducing supply voltage introduces stochastic perturbations that act as implicit regularization, improving robustness while lowering power. We characterize undervolting-induced faults at the bit level, then train LeNet, VGG-6, and MobileNetV3 on MNIST and CIFAR-10 under two training regimes, standard and adversarial, each at nominal and undervolted voltage, and evaluate all models against adversarial attacks. In both regimes, the undervolted model consistently achieves higher adversarial accuracy than its nominal-voltage counterpart, showing that hardware-induced faults strengthen even adversarial training. Because dynamic power scales quadratically with supply voltage, these robustness gains arrive with substantial energy savings. GPU undervolting is therefore a readily deployable hardware-level defense requiring no algorithmic change, and opens a promising direction in which robustness and energy efficiency move together.

Enhancing robustness of deep learning-based malware detection against adversarial attacks

Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection

Machine learning-based intrusion detection systems (IDSs) often suffer from class imbalance and vulnerability to adversarial attacks, leading to degraded detection performance and reduced robustness. This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative Adversarial Network (BGAN) for flow-based intrusion detection using the CICIDS2017 dataset. BGAN serves a dual purpose by generating synthetic minority-class samples to mitigate data imbalance and producing adversarial samples to evaluate model robustness. Experimental results demonstrate that BGAN augmentation improves TabTransformer's Macro-F1 score from 82.96% to 86.50%, with the largest class-wise improvement observed for Web_Attack (F1 score: 0.29 to 0.61). Robustness evaluation shows that all non-augmented models experienced a 100% Performance Drop Rate (PDR) under adversarial testing, whereas all BGAN-augmented models achieved negative PDR values, indicating improved resilience. Furthermore, the augmented TabTransformer maintained stable and low False Triggered Rate (FTR) values (1.51%-2.92%) across all noise levels, compared with the BGAN-augmented Decision Tree, which reached 49.09% under benign perturbations. These findings demonstrate that BGAN consistently enhances both class balance and adversarial robustness, while the proposed BGAN-TabTransformer framework provides an effective and adaptive intrusion detection solution for adversarial network environments.