[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82362-en":3,"doc-seo-82362-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82362,687197207919,"Theodora","https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552",8,"Research & Report","Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in Embedded Neural Networks","Fault injection (FI) attacks on embedded neural networks often target weight or intermediate-computation corruption to force misclassification, without considering their interaction with algorithmic adversarial threats. This work introduces a cross-level method that links implementation-level physical faults to algorithm-level adversarial backdoor learning. By inducing controllable perturbations in targeted execution registers, physically triggered intermediate feature-map perturbations act as stealthy triggers that remain benign under normal operation. Electromagnetic FI on ARM Cortex-M4 CNNs confirms practical deployment and effectiveness against defenses assuming input-space triggers.","Triggering Stealthy Feature Map Backdoors via Physical Fault Injection in  \nEmbedded Neural Networks  \nSteyn Hommes  \nRadboud University Nijmegen, Netherlands [steyn.hommes@ru.nl](steyn.hommes@ru.nl)  \nVincent Dankbaar  \nRadboud University Nijmegen, Netherlands [vincent.dankbaar@ru.nl](vincent.dankbaar@ru.nl)  \nTanguy Stekke  \nUniversite´ Libre de Bruxelles Brussels, Belgium [tanguy.stekke@gmail.com](tanguy.stekke@gmail.com)  \nLisanne Weidmann Senna van Hoek  \nRadboud University Radboud University Nijmegen, Netherlands Nijmegen, Netherlands [lisanne.weidmann@ru.nl](lisanne.weidmann@ru.nl) [senna.vanhoek@ru.nl](senna.vanhoek@ru.nl)  \nDurba Chatterjee Lejla Batina  \nRadboud University Radboud University Nijmegen, Netherlands Nijmegen, Netherlands [durba.chatterjee@ru.nl](durba.chatterjee@ru.nl) [lejla@cs.ru.nl](lejla@cs.ru.nl)  \nXiaomeng Wang  \nRadboud University Nijmegen, Netherlands [xiaomeng.wang@ru.nl](xiaomeng.wang@ru.nl)  \nZhuoran Liu†  \nUniversity of Amsterdam Amsterdam, Netherlands [z.liu@uva.nl](z.liu@uva.nl)  \narXiv :2607 .09473v 1 [ cs .CR] 10 Jul 2026  \nAbstract—Fault injection (FI) attacks on embedded neural network (NN) implementations primarily focus on inducing misclassification by corrupting weights or intermediate computations, overlooking their interaction with algorithmic adversarial threats. In this work, we present a cross-level attack that bridges implementation-level physical faults to algorithmlevel adversarial attacks. By characterizing fault-induced data perturbations during NN inference, we connect FI with backdoor learning, enabling system-level attacks that jointly exploit implementation- and algorithm-level vulnerabilities. Specifically, we propose a precise fault-injection method that reliably manipulates targeted register values to tractable states during execution. Leveraging this level of FI precision, we propose a novel end-to-end feature map–level backdoor attack, where physically induced intermediate perturbations serve as stealthy triggers. Unlike conventional input-based backdoors, our trigger is activated only under physical faults, causing the NN to exhibit adversarial behavior that compromises system integrity while remaining benign during normal operation. We demonstrate that such physically triggered backdoors can be mounted on embedded NN platforms and remain effective against existing backdoor defenses that typically assume inputspace triggers. We showcase the attack practicality using electromagnetic FI on convolutional neural networks implemented on ARM Cortex-M4 microcontroller, which is a common platform for constrained embedded applications. Our results highlight a novel attack vector at the intersection of hardware and algorithmic levels, stressing the need for defenses across abstraction levels.  \n1. Introduction  \nNeural network (NN) inference is increasingly deployed  \non edge devices to preserve privacy, reduce latency, and † Work was done while at Radboud University.  \navoid transmitting sensitive data to cloud services [1] . While running inference locally keeps inputs on the device, it simultaneously exposes the model and its implementation to adversaries with physical access [2], allowing them to inspect and perturb the device. Typical deployment platforms include microcontrollers (MCUs), FPGAs, and edge GPUs, where quantized neural networks are commonly deployed to meet resource constraints with sufficient performance. In such a scenario, physical fault injection becomes a practical threat. An adversary, in this setting, can perturb the computation by tampering with the power supply, performing clock manipulation, electromagnetic fault injection (EMFI) or even laser-based fault injection (LFI) techniques, thereby altering the inference execution. None of these mechanisms requires alterations to the software to corrupt the inference outcome.  \nFault injection attacks were first proposed on cryptographic implementations. Differential Fault Analysis (DFA) was performed f","cbCaifHUI2VbjhSO","https://ap.wps.com/l/cbCaifHUI2VbjhSO","pdf",6114464,1,16,"English","en",105,"# Introduction\n# Cross-Level Attack Overview\n## LATCH Concept and Figure 1","[{\"question\":\"What problem does the work address about fault injection and adversarial threats?\",\"answer\":\"It addresses that typical FI attacks focus on corrupting weights or intermediate computations to cause misclassification, while ignoring how these faults can be used to connect to algorithm-level adversarial/backdoor threats.\"},{\"question\":\"How does the proposed trigger work compared with conventional input-based backdoors?\",\"answer\":\"The trigger is activated only during physical faults. It relies on physically induced intermediate perturbations, so the model behaves benignly under normal (no-fault) execution.\"},{\"question\":\"What hardware and technique are used to demonstrate practicality?\",\"answer\":\"The authors demonstrate practicality using electromagnetic FI on convolutional neural networks implemented on an ARM Cortex-M4 microcontroller.\"}]",1784179924,40,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"triggering-stealthy-feature-map-backdoors-via-physical-fault-injection-in-embedded-neural-networks","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/triggering-stealthy-feature-map-backdoors-via-physical-fault-injection-in-embedded-neural-networks/82362/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the work address about fault injection and adversarial threats?","Question",{"text":75,"@type":76},"It addresses that typical FI attacks focus on corrupting weights or intermediate computations to cause misclassification, while ignoring how these faults can be used to connect to algorithm-level adversarial/backdoor threats.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed trigger work compared with conventional input-based backdoors?",{"text":80,"@type":76},"The trigger is activated only during physical faults. It relies on physically induced intermediate perturbations, so the model behaves benignly under normal (no-fault) execution.",{"name":82,"@type":73,"acceptedAnswer":83},"What hardware and technique are used to demonstrate practicality?",{"text":84,"@type":76},"The authors demonstrate practicality using electromagnetic FI on convolutional neural networks implemented on an ARM Cortex-M4 microcontroller.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":28,"slug":118},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]