{"id":"https://openalex.org/W7225467246","doi":"https://doi.org/10.1145/3862333","title":"Gem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization Framework","display_name":"Gem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization Framework","publication_year":2026,"publication_date":"2026-11-07","ids":{"openalex":"https://openalex.org/W7225467246","doi":"https://doi.org/10.1145/3862333"},"language":"en","primary_location":{"id":"doi:10.1145/3862333","doi":"https://doi.org/10.1145/3862333","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3862333","pdf_url":null,"source":{"id":"https://openalex.org/S136160450","display_name":"ACM Transactions on Embedded Computing Systems","issn_l":"1539-9087","issn":["1539-9087","1558-3465"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-b","cwts-core","dongbi-c","jufo-1","norway-1","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Embedded Computing Systems","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3862333","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101621151","display_name":"Haoyu Wang","orcid":"https://orcid.org/0000-0002-9298-622X","observed_orcids":["https://orcid.org/0000-0002-9298-622X"]},"institutions":[{"id":"https://openalex.org/I40120149","display_name":"University of Oxford","ror":"https://ror.org/052gg0110","country_code":"GB","type":"education","lineage":["https://openalex.org/I40120149"]},{"id":"https://openalex.org/I43439940","display_name":"University of Southampton","ror":"https://ror.org/01ryk1543","country_code":"GB","type":"education","lineage":["https://openalex.org/I43439940"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Haoyu Wang","raw_affiliation_strings":["Engineering Science, University of Oxford","University of Southampton"],"raw_orcid":"https://orcid.org/0000-0002-9298-622X","affiliations":[{"raw_affiliation_string":"Engineering Science, University of Oxford","institution_ids":["https://openalex.org/I40120149"]},{"raw_affiliation_string":"University of Southampton","institution_ids":["https://openalex.org/I43439940"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036239832","display_name":"Haosen Yu","orcid":"https://orcid.org/0000-0002-6174-8579","observed_orcids":["https://orcid.org/0000-0002-6174-8579"]},"institutions":[{"id":"https://openalex.org/I43439940","display_name":"University of Southampton","ror":"https://ror.org/01ryk1543","country_code":"GB","type":"education","lineage":["https://openalex.org/I43439940"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Haosen Yu","raw_affiliation_strings":["University of Southampton"],"raw_orcid":"https://orcid.org/0000-0002-6174-8579","affiliations":[{"raw_affiliation_string":"University of Southampton","institution_ids":["https://openalex.org/I43439940"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049234679","display_name":"Ahmad Atamli","orcid":"https://orcid.org/0000-0002-9271-8794","observed_orcids":["https://orcid.org/0000-0002-9271-8794"]},"institutions":[{"id":"https://openalex.org/I43439940","display_name":"University of Southampton","ror":"https://ror.org/01ryk1543","country_code":"GB","type":"education","lineage":["https://openalex.org/I43439940"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ahmad Atamli","raw_affiliation_strings":["University of Southampton"],"raw_orcid":"https://orcid.org/0000-0002-9271-8794","affiliations":[{"raw_affiliation_string":"University of Southampton","institution_ids":["https://openalex.org/I43439940"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002449223","display_name":"Basel Halak","orcid":"https://orcid.org/0000-0003-3470-7226","observed_orcids":["https://orcid.org/0000-0003-3470-7226"]},"institutions":[{"id":"https://openalex.org/I43439940","display_name":"University of Southampton","ror":"https://ror.org/01ryk1543","country_code":"GB","type":"education","lineage":["https://openalex.org/I43439940"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Basel Halak","raw_affiliation_strings":["University of Southampton"],"raw_orcid":"https://orcid.org/0000-0003-3470-7226","affiliations":[{"raw_affiliation_string":"University of Southampton","institution_ids":["https://openalex.org/I43439940"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3991999924182892,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.3991999924182892,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.361299991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.16590000689029694,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/smaug","display_name":"Smaug","score":0.7850000262260437},{"id":"https://openalex.org/keywords/data-poisoning-attacks","display_name":"data poisoning","score":0.7350000143051147},{"id":"https://openalex.org/keywords/reverse-engineering-attacks","display_name":"reverse engineering attacks","score":0.6880000233650208},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.8050000071525574},{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.6140000224113464},{"id":"https://openalex.org/keywords/large-language-model-security","display_name":"large language model security","score":0.6759999990463257},{"id":"https://openalex.org/keywords/energy-overhead","display_name":"energy overhead","score":0.3140000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.788100004196167},{"id":"https://openalex.org/C2777062904","wikidata":"https://www.wikidata.org/wiki/Q545406","display_name":"Toolchain","level":3,"score":0.727400004863739},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6604999899864197},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.5527999997138977},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5128999948501587},{"id":"https://openalex.org/C206729178","wikidata":"https://www.wikidata.org/wiki/Q2271896","display_name":"Scheduling (production processes)","level":2,"score":0.4350999891757965},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.41909998655319214},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.41290000081062317},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3725999891757965},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35530000925064087},{"id":"https://openalex.org/C17020691","wikidata":"https://www.wikidata.org/wiki/Q139677","display_name":"Operator (biology)","level":5,"score":0.33550000190734863},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.33500000834465027},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.32739999890327454},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.32359999418258667},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32109999656677246},{"id":"https://openalex.org/C2742236","wikidata":"https://www.wikidata.org/wiki/Q924713","display_name":"Efficient energy use","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.2913999855518341},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.28619998693466187},{"id":"https://openalex.org/C90509273","wikidata":"https://www.wikidata.org/wiki/Q11012","display_name":"Robot","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.2840999960899353},{"id":"https://openalex.org/C158600405","wikidata":"https://www.wikidata.org/wiki/Q5054566","display_name":"Causal inference","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.2793999910354614},{"id":"https://openalex.org/C42935608","wikidata":"https://www.wikidata.org/wiki/Q190411","display_name":"Field-programmable gate array","level":2,"score":0.2709999978542328},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C28420585","wikidata":"https://www.wikidata.org/wiki/Q2665075","display_name":"Timing attack","level":4,"score":0.2662000060081482},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.259799987077713}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3862333","doi":"https://doi.org/10.1145/3862333","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3862333","pdf_url":null,"source":{"id":"https://openalex.org/S136160450","display_name":"ACM Transactions on Embedded Computing Systems","issn_l":"1539-9087","issn":["1539-9087","1558-3465"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-b","cwts-core","dongbi-c","jufo-1","norway-1","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Embedded Computing Systems","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3862333","doi":"https://doi.org/10.1145/3862333","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3862333","pdf_url":null,"source":{"id":"https://openalex.org/S136160450","display_name":"ACM Transactions on Embedded Computing Systems","issn_l":"1539-9087","issn":["1539-9087","1558-3465"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-b","cwts-core","dongbi-c","jufo-1","norway-1","poland-70","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Embedded Computing Systems","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":49,"referenced_works":["https://openalex.org/W2106562406","https://openalex.org/W2117539524","https://openalex.org/W2123596153","https://openalex.org/W2154614244","https://openalex.org/W2157225945","https://openalex.org/W2164936607","https://openalex.org/W2251939518","https://openalex.org/W2748789698","https://openalex.org/W2760837370","https://openalex.org/W2774423163","https://openalex.org/W2794325560","https://openalex.org/W2937910684","https://openalex.org/W2946609015","https://openalex.org/W2980200167","https://openalex.org/W2998617917","https://openalex.org/W3004659153","https://openalex.org/W3016542674","https://openalex.org/W3035367371","https://openalex.org/W3040179722","https://openalex.org/W3097528158","https://openalex.org/W3102175148","https://openalex.org/W3133644504","https://openalex.org/W3160537445","https://openalex.org/W3178941450","https://openalex.org/W3183900321","https://openalex.org/W3186375654","https://openalex.org/W3213773220","https://openalex.org/W4206683875","https://openalex.org/W4244024631","https://openalex.org/W4249553981","https://openalex.org/W4285404754","https://openalex.org/W4293434030","https://openalex.org/W4317209778","https://openalex.org/W4378470669","https://openalex.org/W4384155496","https://openalex.org/W4385583910","https://openalex.org/W4387319216","https://openalex.org/W4388192029","https://openalex.org/W4389476278","https://openalex.org/W4389476312","https://openalex.org/W4389518760","https://openalex.org/W4391182414","https://openalex.org/W4398879428","https://openalex.org/W4399405055","https://openalex.org/W4401306886","https://openalex.org/W4402263537","https://openalex.org/W4404133631","https://openalex.org/W4405655184","https://openalex.org/W4415314744"],"related_works":["https://openalex.org/W4416342045","https://openalex.org/W3186623954","https://openalex.org/W4415736028","https://openalex.org/W7152090922","https://openalex.org/W4313645430","https://openalex.org/W3105084904","https://openalex.org/W7203842733","https://openalex.org/W4293434030","https://openalex.org/W6903786680","https://openalex.org/W4402442323"],"abstract_inverted_index":{"Deep":[0],"Learning":[1],"(DL)":[2],"accelerators":[3],"are":[4,100,206],"widely":[5],"adopted":[6],"for":[7,52,118],"their":[8],"efficiency":[9],"and":[10,12,17,31,67,85,96,105,129,146,152,155,179,190,208,223,273,286,301],"cost-effectiveness,":[11],"increasingly":[13],"embedded":[14],"in":[15,122],"robots":[16],"autonomous":[18],"vehicles.":[19],"Their":[20],"heterogeneous":[21,54,124],"architectures,":[22],"however,":[23],"introduce":[24],"security":[25],"threats":[26],"across":[27],"the":[28,74,110,119,175,201,234,239,263,276,296],"chip":[29],"lifecycle,":[30],"existing":[32],"exploration":[33],"tools":[34],"cover":[35],"them":[36],"only":[37],"partially,":[38],"especially":[39],"before":[40],"deployment.":[41],"We":[42],"propose":[43],"Gem5-Shark":[44],",":[45,77,80,84],"a":[46,261,267,281,287],"framework":[47],"built":[48],"on":[49,162,299],"Gem5-Aladdin\u2019s":[50],"Smaug":[51],"cycle-level":[53],"SoC":[55],"simulation.":[56],"It":[57],"integrates":[58],"eight":[59],"configurable":[60],"threat":[61,115],"vectors,":[62],"comprising":[63],"seven":[64],"active":[65],"attacks":[66],"one":[68,123],"passive":[69],"Reverse-Engineering":[70],"(RE)":[71],"analysis,":[72],"spanning":[73],"dataset":[75],"integrity":[76],"model":[78,106],"compilation":[79],"System-on-Chip":[81],"(SoC)":[82],"communication":[83,184],"accelerator":[86,144],"execution":[87],"stages.":[88],"The":[89,218],"two":[90],"compilation-stage":[91],"attacks,":[92],"Operator":[93,156],"Attack":[94,98],"(OPAtt)":[95],"Tiling":[97,141],"(TAtt),":[99],"new":[101],"to":[102,139,150,160,172,188,195,250],"this":[103],"work":[104],"toolchain":[107],"compromise,":[108],"while":[109],"remaining":[111],"vectors":[112],"adapt":[113],"prior":[114],"models,":[116],"unified":[117],"first":[120],"time":[121],"simulator.":[125],"Across":[126],"Minerva,":[127],"LeNet-5,":[128],"VGG-16,":[130],"Data":[131,197],"Poisoning":[132],"Attacks":[133,142,157,182,199,212],"reduce":[134],"inference":[135],"accuracy":[136,159,232],"by":[137,148,186,193,270],"up":[138,149,171,187,194,249],"97.7%,":[140],"increase":[143],"cycles":[145],"energy":[147],"44%":[151],"56%,":[153],"respectively,":[154],"drive":[158],"near-random":[161],"full":[163],"test":[164],"sets":[165],"with":[166,230],"an":[167],"attack":[168,265],"success":[169],"rate":[170],"0.93.":[173],"At":[174],"system":[176],"level,":[177],"Denial-of-Service":[178],"Flit":[180],"Loss":[181],"raise":[183],"latency":[185,216],"30\u00d7":[189],"memory":[191],"delays":[192],"84\u00d7,":[196],"Swapping":[198],"flip":[200],"prediction":[202],"once":[203],"weight":[204],"tiles":[205],"swapped,":[207],"False":[209],"Flag":[210],"Scheduling":[211],"add":[213],"over":[214,293],"7\u00d7":[215],"overhead.":[217],"RE":[219],"analysis":[220],"recovers":[221],"convolutional":[222],"fully":[224],"connected":[225],"structure":[226],"from":[227],"finish-flag":[228,264,289],"timing":[229,274],"0.978":[231],"when":[233],"attacker":[235],"can":[236],"calibrate":[237],"against":[238],"target,":[240],"but":[241],"not":[242],"per-layer":[243],"hyperparameters.":[244],"On":[245],"pretrained":[246],"LLMs":[247],"of":[248,295],"8B":[251],"parameters,":[252],"as":[253,255],"few":[254],"20":[256],"poisoned":[257],"fine-tuning":[258],"samples":[259],"implant":[260],"backdoor,":[262],"slows":[266],"decoder":[268],"layer":[269],"4.3":[271],"\u00d7,":[272],"reveals":[275],"context":[277],"length.":[278],"Two":[279],"defenses,":[280],"compiler-stage":[282],"tiling":[283],"range":[284],"check":[285],"host-side":[288],"watchdog,":[290],"each":[291],"remove":[292],"99%":[294],"injected":[297],"overhead":[298],"CNNs":[300],"LLMs.":[302]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-08T00:00:00"}