Paper deep dive
Hardware Trojan Threats to Multi-Chiplet Photonic Neural Network Accelerators
Sudeep Pasricha
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 9/12/2026, 3:16:37 AM
Summary
This paper analyzes Hardware Trojan (HT) threats to Multi-Chiplet Photonic Neural Network Accelerators (MCPNAs), focusing on confidentiality, integrity, and availability risks introduced by distributed architectures and third-party chiplets. It details attack vectors such as optical snooping via microring retuning, integrity corruption through thermal hotspots and actuation manipulation, and availability degradation via DDoS attacks on inter-chiplet communication. The paper also discusses countermeasures including process-variation-based authentication, resilient training, and trust-aware routing.
Entities (10)
Relation Signals (9)
Multi-Chiplet Photonic Neural Network Accelerator → isvulnerableto → Hardware Trojan
confidence 98% · However, their distributed architecture and reliance on third-party chiplets introduce significant hardware security risks. This paper examines Hardware Trojan (HT) threats to MCPNAs
Hardware Trojan → compromises → Confidentiality
confidence 95% · A first class of attacks targets confidentiality... HTs embedded in MR tuning circuits can maliciously retune detector MRs... enabling covert snooping
Hardware Trojan → compromises → Integrity
confidence 95% · A second attack class targets the integrity of photonic neural computations... HTs inserted into MR actuation circuitry can force devices into off-resonance states
Hardware Trojan → compromises → Availability
confidence 95% · A third class of attacks targets system availability... malicious chiplets can coordinate distributed denial-of-service (DDoS) attacks
Microring Resonator → istargetof → Hardware Trojan
confidence 92% · HTs may manipulate microring tuning or thermal control... HTs inserted into MR actuation circuitry can force devices into off-resonance states
SOTERIA → addresses → Confidentiality
confidence 90% · In SOTERIA [5], [6], we showed that HTs... enabling covert snooping... SOTERIA further demonstrated that photonic process variations can be exploited as a security asset
SafeLight → addresses → Integrity
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-chiplet photonic neural network accelerators (MCPNAs) combine photonic computation, photonic communica-tion, and heterogeneous chiplet integration to enable scalable and energy-efficient AI acceleration. However, their distributed archi-tecture and reliance on third-party chiplets introduce significant hardware security risks. This paper examines Hardware Trojan (HT) threats to MCPNAs across three dimensions: confidentiality, integrity, and availability.
Tags
Links
- Source: https://arxiv.org/abs/2609.06796v1
- Canonical: https://arxiv.org/abs/2609.06796v1
Trouble viewing inline? Open PDF directly →
Full Text
11,324 characters extracted from source content.
Expand or collapse full text
Hardware Trojan Threats to Multi-Chiplet Photonic Neural Network Accelerators Sudeep Pasricha Department of Electrical and Computer Engineering Colorado State University sudeep@colostate.edu Special Session Paper Abstract—Multi-chiplet photonic neural network accelerators (MCPNAs) combine photonic computation, photonic communica- tion, and heterogeneous chiplet integration to enable scalable and energy-efficient AI acceleration. However, their distributed archi- tecture and reliance on third-party chiplets introduce significant hardware security risks. This paper examines Hardware Trojan (HT) threats to MCPNAs across three dimensions: confidentiality, integrity, and availability. Index Terms—Multi-chiplet systems, silicon photonics, network-on-interposer, hardware security, AI acceleration. I. INTRODUCTION The adoption of 2.5D chiplet integration provides a promis- ing path toward scaling photonic neural network acceler- ators beyond the limits of monolithic designs. In multi- chiplet photonic neural network accelerator (MCPNA) ar- chitectures, such as our work in [1] (see Fig. 1) and that of others [2], [3], photonic compute chiplets com- municate with memory chiplets through a silicon-photonic interposer using wavelength-division multiplexing (WDM). The architecture relies on microring resonators (MRs), pho- tonic gateways, wavelength-routing structures, photodetectors, and thermo/electro-optic tuning circuits [4] distributed across chiplets and the interposer. While this organization enables scalable and energy-efficient AI acceleration, MCPNAs also expose a larger attack surface than monolithic accelerators, across the supply chain. We consider a threat model where Hardware Trojans (HTs) are introduced into untrusted compute, memory, gateway, or inter- poser chiplets during design, fabrication, or integration. HTs may manipulate microring tuning or thermal control, snoop optical signals, or disrupt inter-chiplet traffic, independently or through collusion. The resulting perturbations are difficult to detect due to the inherent sensitivity of photonic devices to wavelength, temperature, and process variations. The secu- rity objectives are therefore to protect model confidentiality, integrity, and system availability. I. CONFIDENTIALITY ATTACKS A first class of attacks targets confidentiality. The MCPNA employs shared optical waveguides carrying multiple WDM channels between chiplets. In SOTERIA [5], [6], we showed that HTs embedded in MR tuning circuits can maliciously retune detector MRs to partially resonate with neighboring Fig. 1: Multi-chiplet photonic neural network accelerator (MCPNA) architecture [1]. Such architectures are increasingly susceptible to Hardware Trojan (HT) attacks that compromise confidentiality, integrity, and availability. wavelengths, enabling covert snooping of optical channels with little impact on legitimate communication. In an MCPNA, such attacks can reveal weight values fetched from memory chiplets, intermediate activations exchanged between compute chiplets, and proprietary model parameters. As future systems increasingly integrate third-party chiplets, such leakage poses a significant threat to model confidentiality and intellectual property protection. SOTERIA further demonstrated that photonic process vari- ations can be exploited as a security asset rather than merely a reliability challenge. The framework derives unclonable authentication and encryption keys from process-variation sig- natures of photonic devices, protecting communications from snooping attacks. In future MCPNAs, these ideas could be extended to chiplet authentication, trusted onboarding, and secure photonic communication protocols. Process-variation- based photonic fingerprints offer a particularly attractive mech- anism for establishing trust in externally sourced chiplets. I. INTEGRITY ATTACKS A second attack class targets the integrity of photonic neural computations. The MCPNA in [1] extends the CrossLight architecture [7] by distributing photonic MAC units across multiple compute chiplets, with MRs encoding neural-network weights and activations. As shown in SafeLight [8], HTs inserted into MR actuation circuitry can force devices into off- resonance states, corrupting weight or activation encoding and causing incorrect computations. As neural-network layers are distributed across chiplets, errors originating in one chiplet can propagate through subsequent computations and inter-chiplet communications, impacting the entire inference pipeline. SafeLight also identified thermal hotspot attacks as an especially potent HT payload. By manipulating thermo-optic tuning circuits, malicious circuitry can generate localized heating that shifts resonance wavelengths for multiple MRs. In MCPNAs, where dense photonic MAC arrays share a common interposer substrate, thermal coupling can extend the impact of an attack far beyond the compromised device. A Trojan in one compute chiplet may therefore influence neighboring MRs or even adjacent chiplets. Ultimately, it was shown that even when only a small fraction of MRs are compromised, significant accuracy degradation can occur. Further, the thermal hotspot attacks often cause larger accuracy degradation than actuation attacks because they simultaneously corrupt clusters of parameters rather than isolated weights. Mitigating integrity attacks requires both hardware and algo- rithmic resilience. SafeLight demonstrated that L2 regulariza- tion and noise-aware training significantly improve tolerance to HT-induced perturbations. In future MCPNAs, these tech- niques could be combined with runtime thermal monitoring, resonance tracking, hardware redundancy, and chiplet-level fault containment. Such cross-layer approaches would allow neural networks to tolerate device-level attacks while enabling runtime detection of abnormal photonic behavior. IV. AVAILABILITY ATTACKS A third class of attacks targets system availability. MCP- NAs depend on high-bandwidth inter-chiplet communication through photonic gateways and interposer networks, making these resources attractive targets. SCRIPT [9] showed how malicious chiplets can coordinate distributed denial-of-service (DDoS) attacks by concentrating traffic on critical communi- cation resources. Although originally developed for electronic interposers, the threat model applies naturally to photonic systems. A compromised chiplet could inject excessive traffic, monopolize wavelength channels, overwhelm gateway inter- faces, or coordinate with other malicious chiplets to create congestion on critical optical paths. MCPNAs are particularly vulnerable because communica- tion between memory and compute chiplets often follows predictable routes through dedicated gateways. An attacker exploiting this predictability can create congestion hotspots that increase latency and reduce accelerator utilization. Recon- figurable photonic interposers may introduce additional vulner- abilities if HTs manipulate gateway or wavelength allocation decisions to reduce effective bandwidth. SCRIPT points toward trust-aware routing as a promising defense. By incorporating chiplet trust levels into routing decisions and introducing path obfuscation, randomized route selection, and load balancing, the framework reduces an adver- sary’s ability to exploit critical communication paths. In pho- tonic chiplet accelerators, these principles can be extended to wavelength assignment, gateway selection, and photonic path management through techniques such as dynamic wavelength hopping and adaptive interposer reconfiguration. V. CONCLUSIONS Multi-chiplet photonic neural network accelerators (MCP- NAs) offer a scalable and energy-efficient platform for future AI workloads, but their distributed architecture introduces new Hardware Trojan (HT) attack surfaces. This paper highlighted how HTs can compromise confidentiality through photonic in- terconnect snooping, integrity through microring actuation and thermal attacks, and availability through coordinated denial- of-service attacks on inter-chiplet communication resources. We discussed emerging countermeasures including photonic authentication, resilient model training, runtime monitoring, and trust-aware routing. These observations underscore the need for holistic cross-layer security frameworks to ensure trustworthy operation of next-generation photonic chiplet- based AI systems. As future photonic AI platforms scale to support workloads such as LLMs [10], graph learning [11], and vision-based generative AI [12], effective protection will require cross-layer defenses spanning trusted chiplet onboard- ing, secure photonic communication, resilient model training, runtime anomaly detection, thermal management, and trust- aware network orchestration. VI. ACKNOWLEDGEMENTS This research was supported in part by National Science Foundation grant CCF-2450615. R EFERENCES [1] F. Sunny, E. Taheri, M. Nikdast, and S. Pasricha, “Machine learning accelerators in 2.5 d chiplet platforms with silicon photonics,” in Design, Automation & Test in Europe Conference (DATE). IEEE, 2023, p. 1–6. [2] Y. Li, A. Louri, and A. Karanth, “Sprint: A high-performance, energy- efficient, and scalable chiplet-based accelerator with photonic intercon- nects for cnn inference,” IEEE TPDS, vol. 33, no. 10, 2021. [3] C. Xia, H. Zhang, Y. Chen, and A. S. Barnard, “Siphon: Silicon photonic computing based chiplet accelerator for deep learning,” IEEE journal on emerging and selected topics in circuits and systems, 2025. [4] S. Pasricha and M. Nikdast, “A survey of silicon photonics for energy- efficient manycore computing,” IEEE Design & Test, vol. 37:4, 2020. [5] S. V. R. Chittamuru, I. G. Thakkar, V. Bhat, and S. Pasricha, “Soteria: Exploiting process variations to enhance hardware security with photonic noc architectures,” in IEEE/ACM Design Automation Conference, 2018. [6] S. V. R. Chittamuru, I. G. Thakkar, S. Pasricha, S. S. Vatsavai, and V. Bhat, “Exploiting process variations to secure photonic noc architec- tures from snooping attacks,” IEEE TCAD, vol. 40, no. 5, 2020. [7] F. Sunny, A. Mirza, M. Nikdast, and S. Pasricha, “Crosslight: A cross-layer optimized silicon photonic neural network accelerator,” in ACM/IEEE design automation conference (DAC). IEEE, 2021. [8] S. Afifi, I. Thakkar, and S. Pasricha, “Safelight: Enhancing security in optical convolutional neural network accelerators,” in Design, Automa- tion & Test in Europe Conference (DATE). IEEE, 2025, p. 1–7. [9] E. Taheri, P. Aghanoury, S. Pasricha, M. Nikdast, and N. Sehatbakhsh, “Script: A multi-objective routing framework for securing chiplet sys- tems against distributed dos attacks,” in ACM Great Lakes Symposium on VLSI, 2024, p. 78–85. [10] S. Afifi, F. Sunny, M. Nikdast, and S. Pasricha, “Tron: Transformer neural network acceleration with non-coherent silicon photonics,” in ACM Great Lakes Symposium on VLSI, 2023, p. 15–21. [11] S. Afifi, F. Sunny, A. Shafiee, M. Nikdast, and S. Pasricha, “Ghost: A graph neural network accelerator using silicon photonics,” ACM Transactions on Embedded Computing Systems, vol. 22, no. 5s, 2023. [12] T. Suresh, S. Afifi, and S. Pasricha, “Difflight: Generative diffusion model acceleration with silicon photonics,” IEEE Design & Test, 2025.