Tree-based hardware malware detectors show far fewer critical faults than function-based models

The five-minute version

Hardware malware detectors are vulnerable to faults that can silently degrade security; the study finds that tree-based detectors have a low critical-fault fraction (5.7%) but a high silent-fault fraction (70.2%), while function-based detectors are more prone to critical faults (14.3%). Fault injection across 453,174 sites shows that ensembles, especially Bagging, eliminate critical faults in almost all cases, and a selective hardening strategy can cut worst-case recall loss from 60.1 to 3.3 percentage points with a 35% area budget. The evidence is based on exhaustive simulated fault injection rather than measured silicon, and the authors note several limitations that temper the conclusions.

What they found 3

• In a 4-HPC J48 decision tree, only 3.9% of fault sites cause evasion while 51.5% are silent, and the worst single fault drops recall from 97.0% to 36.9%.

  “In a 4-HPC J48 decision tree, only 3.9% of the 3,910 fault sites cause evasion, while 51.5% are silent; the worst single fault drops malware recall from 97.0% to 36.9%.”

• Bagging ensembles eliminate critical faults in almost all configurations, achieving zero criticality in 33 out of 34 comparisons.

  “Bagging achieved zero criticality in 33 comparisons, including all 17 at four HPCs.”

• Selective hardening of 16 out of 115 structural units in a J48 detector reduces the predicted worst-case recall loss from 60.1 to 3.3 percentage points.

  “For the representative J48 detector, protecting 16 of 115 structural units reduced the predicted maximum single-fault recall loss from 60.1 to 3.3 percentage points.”

What undercuts it the paper’s own results

• Tree-based detectors had a lower mean critical-fault fraction than function-based detectors, 5.7% versus 14.3%. However, their mean metric-silent fraction was 70.2%, showing that stable aggregate detection metrics do not establish detector integrity.

Stated limits 3

• Injection level, faults are injected into the structural model of each detector rather than into a gate netlist, which makes the fault ... architectural and portable but excludes faults introduced by synthesis itself; we expect the two levels to agree on the family ordering, but we have not shown it.
• Coverage of instance-based detectors, the KNN configurations store their training set rather than parameters, and our site enumeration does not yet address stored-sample fault, so the KNN rows
• Hardening evaluation, Algorithm 1 selects units and predicts residual risk, and the sweep of Fig. 5 uses an area apportionment rather than measured layout; implementing the hardened variants and carrying them through a physical-design flow would replace the predicted budget axis with measured silicon and allow the predicted residual risk to be verified empirically.

What’s new here 4

• Introduces a fault taxonomy (evasion, denial-of-service, silent, noisy, degraded) based on security impact rather than mean accuracy loss.
• Provides a comprehensive fault injection analysis across 140 HMD configurations covering multiple classifier families and ensemble methods.
• Identifies and quantifies silent faults that leave recall and false-positive rates unchanged, a previously unmeasured failure mode.
• Proposes and evaluates a selective hardening algorithm that targets a small subset of structural units to dramatically reduce worst-case recall loss.

Artifacts & methods 5

• Hardware Malware Detector (HMD)system
• Fault injection models (decision stuck-at, parameter bit flips)primitive
• Selective hardening algorithm (Algorithm 1)system
• Dataset of 144 trained detector configurationsdataset
• Simulation framework for exhaustive fault evaluationevaluation

Topics