Deep neural networks (DNNs) have been extensively deployed in intelligent applications such as autonomous driving and medical diagnosis. However, increasing occurrences of transient hardware faults can induce bit-flip errors, severely degrading prediction accuracy. Existing fault-tolerance methods typically adopt lightweight designs, employing static analysis or heuristic rules to set fixed clipping thresholds for activation functions in order to limit error propagation. However, such static configurations lack adaptability and may fail to achieve optimal robustness. To address this limitation, we propose SRCo, a Sharpness-aware Minimization and Reinforcement Learning-based Co-optimization framework for enhancing fault tolerance against bit-flip errors. SRCo synergistically integrates Sharpness-Aware Minimization (SAM) and Reinforcement Learning (RL) to enable both general-purpose robust training and adaptive, fine-grained threshold optimization. The framework consists of two complementary modules: (1) a Reinforcement Learning-guided dynamic SAM robust training module, which adaptively adjusts the training strategy to steer the model toward flatter minima in the loss landscape, thereby enhancing stability in the parameter space; (2) an RL-driven adaptive activation boundary optimization module, where an agent interacts with a simulated fault-injection environment to automatically discover optimal, layer-wise clipping thresholds. Extensive experiments across diverse DNN application scenarios demonstrate that SRCo consistently outperforms state-of-the-art approaches such as Ranger, ClipAct, and ProACT, achieving up to 93.43
The dependability of AI models relies largely on the reliability of the underlying hardware. Hardware aging attacks can compromise the computing substrate and disrupt AI models over the long run. In this work, we present a new hardware aging attack that exploits commutative properties of addition to disrupt the multiply-and-add operation that forms the backbone of almost all AI models. By permuting the inputs of an adder, the attack preserves functional correctness while inducing unbalanced stress among transistors, accelerating delay degradation in the circuit. Unlike prior approaches that rely on input manipulation, additional trojan circuitry, etc., the proposed method incurs virtually no area or software overhead. Experimental results with two types of multipliers, different bit widths, a mix of AI models and datasets demonstrate that the proposed attack degrades inference accuracy by up to 64
With the increasing adoption of Fully Homomorphic Encryption (FHE) for privacy-preserving Machine Learning (ML) and Deep Learning (DL), the security of encrypted training and inference remains a critical yet underexplored challenge. While conventional ML models are known to be vulnerable to evasion and backdoor attacks, it is not well understood whether similar threats persist in the encrypted domain. This work investigates the feasibility of both evasion and backdoor attacks on FHE-enabled ML models, focusing on three prominent libraries: TenSEAL, Concrete ML, and UniHENN. Although prior research has demonstrated encrypted evasion attacks on simple datasets in both public-key and symmetric-key settings, our work implements the attack in a key-independent scenario and provides insights into the nuances of the attack, showing that while it is straightforward to conduct attacks in TenSEAL and UniHENN, a different strategy based on MLIR-level representation is required for Concrete ML. We also introduce, for the first time, a study of backdoor attacks in the encrypted domain. We particularly focus on patch level backdoor attacks. Furthermore, we analyze the feasibility of backdoor attacks in TenSEAL and Concrete ML (version 1.5), highlighting structural differences that influence their vulnerability. Our findings demonstrate that FHE-enabled models remain susceptible to both evasion and backdoor attacks, underscoring the need for stronger defenses in encrypted ML systems.
Data security is becoming a major issue with the rise of microgrids. Sensitive data on energy production and consumption must be protected. A high level of security is essential to ensuring the efficient operation of vital services supplied by renewable energies. Blockchain, through the smart contracts and consensus algorithms, offers an ideal security solution. However, this technology requires a lot of computing and energy resources. It is crucial to choose a consensus algorithm tailored to the specific needs of the microgrid in terms of security, performance and energy consumption. The high energy consumption of blockchain is seen by researchers as a major limitation to its use in many decentralized networks such as microgrids. This article proposes an optimal choice of consensus algorithm and type of blockchain, based on security, energy consumption and computing resources. To achieve this, a review of the consensus algorithms used in microgrids was carried out, and the data obtained was used to build a decision tree for their selection. The proposed model was evaluated for different sizes of local electricity networks, and this approach enabled a microgrid sizing workflow to be proposed that takes security requirements into account. The results will enable the design of microgrid architectures and components that are compatible with decentralized cybersecurity technologies without affecting their operation.
Autonomous systems in adversarial environments derive operational authority from sensor inputs whose integrity is itself contested. Binary sensor attestation fails under partial degradation multipath interference, calibration drift, transient denial of service forcing all-or-nothing lockout responses that are operationally inadequate. This article specifies SATA (Sensor Attestation and Trust Anchoring), a TPM-anchored protocol specification that computes a continuous trust scalar τ ∈ [0, 1] from a sliding window of cryptographically committed attestation records. SATA combines six replay-resistance barriers ECDSA P-256 signature, 256-bit CSPRNG nonce, TPM monotonic counter, PCR quote (TPM2_Quote), per-sensor sequence, and hardware tick-clock age yielding a signature-barrier unforgeability bound P_forge < 2− 128 under a formally specified A1/A2 adversary model, stated and proved as Theorem 1, with explicit degradation analysis under a physical (A3) adversary. A weighted Dempster Shafer fusion layer provides Byzantine fault tolerance f ≤ ⌊(n-1)/3⌋ and preserves the ignorance distrust distinction, anchored in a TPM 2.0 hardware root of trust. The state machine is checked by TLA+ bounded model checking across 18,892 reachable states with zero violations of eight safety invariants, and a 10,000-run Monte Carlo campaign provides implementation-conformance and parameter-sensitivity evidence, explicitly distinguished from the analytical guarantee of Theorem 1. SATA is presented as a complement to RATS/SGX/PSA attestation, addressing the intersection of continuous trust quantification, hardware anchoring, formal specification, and multi-sensor operation under adversarial pressure.
