Chips are designed to work within set voltages, clock speeds and temperatures. Fault injection pushes them outside those limits for a moment, with a dip in the power supply, a glitch in the clock, an electromagnetic pulse or a focused laser, so that a calculation goes wrong in a way the attacker can use. Classic targets are secure boot checks and cryptographic operations.
AI hardware is a new target. Nagarajan and colleagues showed at DATE 2022 that power and laser faults could cut a spiking neural network’s accuracy by up to 85.65%. In a safety or security device, a fault that quietly stops a detector from detecting is worse than one that crashes it.
Fault injection needs physical access, so it ranks below remote attacks for most systems. For devices in public places, vehicles or the field, physical access is the normal case, and tamper resistance belongs in the AI threat model.