{"id":"6b2c2aae-b0f5-4acf-a3f5-ba2b8a64a5ca","arxiv_id":"2411.16712","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Hardware trojans that corrupt microring resonators in optical CNN accelerators can cut accuracy by up to 80%, and L2 regularization plus noise-aware training recovers much of the loss.","lead":"This paper simulates hardware trojan attacks on the microring resonators of an optical CNN accelerator and shows that classification accuracy can fall by up to 80% when only 10% of the resonators are corrupted. It then shows that training with L2 regularization and Gaussian noise recovers most of that accuracy loss in most attack scenarios.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"All quantitative claims rest on an unvalidated simulator whose weight-to-MR mapping and corruption model are not specified; a 0%-attack control and single-weight corruption test are needed to establish that the reported accuracy drops are not simulator artifacts.","rationale":"The reader's weakest assumption is precisely the fidelity of the unvalidated Python simulator. I agree with that assessment. The paper's central quantitative claims—the 7.49%–80.46% accuracy drops and the recovery percentages—are entirely generated by a simulator whose weight-to-MR mapping and corruption model are not described in enough detail to reproduce or verify. This is not a minor implementation detail; it is the load-bearing foundation of the paper's contribution. Without a demonstration that the simulator faithfully represents the CrossLight accelerator, the reported numbers could be artifacts of arbitrary modeling choices. The proposed concrete test (0%-attack control and single-weight corruption) is a necessary first check: if the simulator cannot reproduce baseline accuracies and cannot predict the effect of a single corrupted weight, then the aggregate attack results are meaningless. The secondary issue of selecting the noise standard deviation on the same attack scenarios is a legitimate concern but is less fundamental than the simulator fidelity. Given that the paper's contribution is a susceptibility analysis and a mitigation study, both of which depend on the simulator, a conditional verdict is appropriate pending validation. I do not find grounds to move to reject, but the paper should not be accepted without the simulator being made available and passing basic sanity checks.","tokens_in":10211,"tokens_out":8364,"duration_ms":78224,"concrete_test":"Validate the simulator with a 0%-attack control: compute inference accuracy for each of the three models with no attacked MRs and verify it matches the original PyTorch accuracy. Then corrupt one known weight (e.g., set it to zero) and compare the simulator's accuracy change to an analytical prediction. If the control fails or the single-weight prediction deviates by more than a few percent, the mapping/corruption model is not faithful, and the reported attack results are not credible.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section IV states the simulator was built from \"device, circuit, and component level characteristics\" of CrossLight [7] and attacks were realized \"by modifying the models' parameters based on their mapping to the ONN accelerator.\" The paper never gives the mapping algorithm (e.g., how convolution kernels are tiled onto the 20×20 CONV MR banks or FC weights onto 150×150 banks), nor the exact corruption equations for the two attack vectors. For off-resonance actuation it is unclear whether the affected weight is set to zero, multiplied by a residual coupling factor, or replaced with a random value; for thermal hotspots the relation between the temperature change from the HotSpot heatmap, the resonance shift in Eq. (2), and the resulting weight corruption is not quantified. Because these unspecified modeling choices directly determine the attacked weight tensors, the headline drops (7.49%–80.46%) and recovery percentages (up to 5.4%, 21.2%, 30.7%) are functions of an unvalidated and under-specified simulator. If the mapping or corruption model does not match CrossLight's actual behavior, the central susceptibility claim is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper investigates hardware trojan (HT) attacks on microring resonators (MRs) in a non-coherent optical CNN accelerator based on the CrossLight architecture. Two attack vectors are considered: MR actuation attacks (off-resonance) and thermal hotspot attacks, targeting 1%, 5%, and 10% of MRs in the CONV block, FC block, and the entire accelerator. The authors report accuracy drops up to 7.49% to 80.46% for 10% MR attacks across three CNN models (MNIST CNN, ResNet18, VGG16 variant). They then propose software-based mitigations—L2 regularization and Gaussian noise-aware training—and report that the best variants recover up to 5.4%, 21.2%, and 30.7% of the accuracy drops for the three models, respectively.","tokens_in":10430,"tokens_out":5983,"duration_ms":50506,"significance":"If the quantitative results are reliable, this is the first systematic study of HT attacks on non-coherent ONN accelerators and the first to propose software-based defenses for such attacks. The threat model is plausible, the use of the HotSpot tool for thermal analysis is a reasonable choice, and the mitigation direction (regularization and noise-aware training) is well-motivated by prior work in other hardware accelerators. However, the central quantitative claims rest entirely on a Python simulator that is not released, not validated against fabricated hardware or a published benchmark, and not specified in enough detail to reproduce. The susceptibility direction is credible, but the specific accuracy drops and recovery percentages should be treated as illustrative unless the simulator is made available and validated.","major_comments":[{"comment":"The simulator is under-specified and unvalidated. The paper states that \"we developed a comprehensive Python simulator that modeled the accelerator based on device, circuit, and component level characteristics defined in [7]\" and that attacks were realized \"by modifying the models' parameters based on their mapping to the ONN accelerator,\" but it never provides the weight-to-MR mapping algorithm (e.g., how convolution kernels are tiled onto the 20×20 CONV VDP units or how FC weights are mapped to the 150×150 banks), nor the exact corruption equations for the two attack vectors. For actuation attacks, it is unclear whether an off-resonance MR sets the affected weight to zero, multiplies it by a residual coupling factor, or replaces it with a random value. For thermal hotspot attacks, the relation between the HotSpot temperature map, the resonance shift in Eq. (2), and the resulting weight corruption is not quantified. Because these modeling choices directly determine the attacked weight tensors, the headline drops (7.49%–80.46%) and recovery percentages are functions of an unvalidated and underspecified simulator. Please provide the mapping and corruption models in detail, release the simulator code, and validate it against at least a 0%-attack control (e.g., reproducing the baseline accuracy of the models on the chosen datasets) or a published ONN hardware result.","section":"Section IV"},{"comment":"The mitigation hyperparameters are selected on the test attack scenarios, making the reported recovery percentages optimistic. In Section VI, the authors state that \"different models achieve optimal robustness with different noise standard deviations\" and identify l2+n3, l2+n5, and l2+n2 as the most robust configurations for MNIST, ResNet18, and VGG16, respectively. This selection is based on Fig. 8, which summarizes accuracy results across the same attack scenarios used later for the final evaluation in Fig. 9. This is a form of test-set overfitting: the chosen noise standard deviation is tuned to the exact attack cases whose recovery is then reported. Please select hyperparameters using a held-out validation set (e.g., a separate set of random MR corruption patterns) or report the expected recovery across the full grid of noise standard deviations, so that the mitigation effectiveness is not circular.","section":"Section VI"},{"comment":"The attack intensity metric is inconsistent between the two attack vectors. The text says that \"1%, 5%, and 10% of the MRs\" are targeted for both actuation and hotspot attacks, but then states that \"we simulate 10 different uniformly distributed combinations of individual random MRs (for actuation attacks) and banks of MRs (for hotspot attacks) being targeted by HTs for the 1%, 5%, and 10% cases.\" Targeting banks is not the same as targeting individual MRs; the paper does not explain how a bank-level selection is converted into an MR-level percentage or whether the same percentage refers to the fraction of banks. This ambiguity affects the comparability of the two attack types and the precise meaning of the central claim \"by just targeting 10% of MRs.\" Please specify the exact selection procedure for hotspot attacks, including the number of banks, the number of MRs per bank, and how the 1%, 5%, and 10% figures are computed.","section":"Section IV"},{"comment":"The baseline accuracies of the CNN models are never reported numerically. The figures show horizontal lines labeled as baseline accuracy, but the text does not give the clean-data top-1 accuracies for MNIST, CIFAR-10, or Imagenette. Without these numbers, the reported accuracy drops (e.g., 7.49% for MNIST) cannot be interpreted in context—a drop from 99% to 91.5% is far less severe than a drop from 10% to 2.5%. Please report the baseline accuracy for each original model and for each robust model variant, along with the standard deviation across the 10 simulation runs.","section":"Sections IV and VI"}],"minor_comments":[{"comment":"The phrase \"up to 7.49% to 80.46%\" is awkward; consider replacing it with \"ranging from 7.49% to 80.46%\" or \"up to 80.46%.\"","section":"Abstract and Section VI"},{"comment":"There is a typo in the sentence \"This is due to the massive size of VGG16 model which requires mutliple mappings for each layer\" — \"mutliple\" should be \"multiple.\"","section":"Section IV"},{"comment":"The statement that robust models \"recover up to 5.4%, 21.2%, and 30.7% of the accuracy drops\" is ambiguous: it is unclear whether these percentages are absolute percentage points or the percentage of the drop that is recovered relative to the original drop. Please clarify the basis of these recovery figures.","section":"Section VI"},{"comment":"Equation (1) appears garbled in the manuscript (e.g., the symbols for effective index and resonance order are not rendered). Please ensure the equation is typeset correctly.","section":"Section II"},{"comment":"The text refers to Fig. 8 as a \"box and whiskers plot,\" but the figure appears to show scattered points across the 10 runs rather than box plots. Either update the description or replace the figure with a proper box plot.","section":"Section V"},{"comment":"It is not clear whether the Gaussian noise in \"noise-aware training\" is added to the weights, activations, or both. Please specify the exact training procedure, including when and where the noise is injected.","section":"Section V"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an important and timely security issue for photonic accelerators, but the quantitative results depend on an unavailable and underspecified simulator. I strongly encourage the editor to ask the authors to release the simulator code and provide a detailed mapping/corruption model, and to require a 0%-attack validation plus a separate validation set for hyperparameter selection. Without these, the specific numbers should not be cited in downstream work."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, this is the first susceptibility analysis of actuation and thermal-hotspot hardware trojans on a non-coherent optical CNN accelerator, using CrossLight as the substrate. That part is new and useful. Second, the headline accuracy drops (up to 80.46%) and recovery percentages are generated by a Python simulator that is neither released nor validated, and the weight-to-MR mapping and corruption equations are never specified. The direction of the result is plausible; the magnitude is not independently checkable.\n\nWhat the paper does well: it separates CONV vs. FC attack targets, tests 1%, 5%, and 10% attack intensities, shows hotspot attacks beat actuation because they corrupt clusters of weights, and shows model architecture determines which block matters more. The mitigation study—L2 regularization plus Gaussian noise-aware training—is a sensible, cheap defense, and the intuition that weight corruption behaves like noise is reasonable. The simulations look internally consistent: the susceptibility ordering across models and blocks tracks intuition about where parameters matter. This is real work, not a strawman.\n\nThe load-bearing weakness is the simulator. Section IV says it was built from device, circuit, and component characteristics in [7] and attacks were realized by modifying model parameters based on their mapping to the accelerator, but the mapping algorithm is never given—how convolution kernels tile onto 20x20 MR banks, how FC weights map onto 150x150 banks—and the corruption model is not quantified. For actuation, is the affected weight zeroed, multiplied by a residual coupling, or replaced with a random value? For hotspot attacks, what temperature change from the HotSpot tool feeds into Eq. (2) and how does the resonance shift translate into weight corruption? These are exactly the choices that determine the reported drops. A 0%-attack control and a single-weight corruption test would establish that the simulator is not doing something trivial. Also minor but real: the mitigation analysis selects the Gaussian noise standard deviation per model as the best performer in Fig. 8, which is post-hoc; the reported recovery numbers are the best-case, not a fair average. Self-citations are heavy but mostly to the group's own prior CrossLight and photonic accelerator work, which is legitimate context.\n\nWho is this for: the ONN security subfield and anyone building photonic accelerators who wants a first map of attack surfaces. A serious referee should engage, not desk-reject, but the review should be conditional on releasing the simulator and specifying the mapping and corruption details. As is, the concept is worth one round of major revision.","headline":"First quantitative map of MR trojan effects on a non-coherent ONN accelerator, but the numbers rest on an unreleased and under-specified simulator.","tokens_in":10955,"tokens_out":1884,"would_cite":false,"duration_ms":19188,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hardware trojans that corrupt 10% of microring resonators can drop CNN accuracy by up to 80.46%, and training-time defenses recover much of the loss.","keywords":["hardware trojan","optical neural network accelerator","microring resonator","CNN inference security","actuation attack","thermal hotspot attack","L2 regularization","noise-aware training"],"falsifier":"Make a physical non-coherent optical MAC bank, force 10% of its microring resonators off resonance and create localized heating on another 10%, then compare the observed classification accuracy drops on MNIST, CIFAR-10, and Imagenette models with the predicted 7.49%, 26.4%, and 80.46% numbers; a substantial mismatch would show the simulator's corruption model is wrong.","tokens_in":10025,"feed_emoji":"🔐","tokens_out":8195,"duration_ms":70236,"temperature":0.7,"pith_summary":"This paper argues that optical CNN accelerators, while promising for energy-efficient inference, create a new hardware-security surface: hardware trojans that disrupt microring resonators can severely degrade classification accuracy. Targeting just 10% of the resonators in a state-of-the-art non-coherent optical accelerator produces accuracy drops of 7.49% to 80.46% across MNIST, ResNet18, and VGG16, with thermal hotspot attacks more damaging than actuation attacks. The paper claims that two ordinary training-time techniques, L2 regularization and Gaussian noise-aware training, recover a significant fraction of that loss without any hardware changes. If those results hold, optical accelerators need fault and security analysis before deployment, but low-cost software defenses can blunt much of the damage.","feed_headline":"Trojans in optical AI chips cut accuracy up to 80%","feed_subtitle":"Attacking just 10% of microring resonators wrecks CNN models; L2 and noise-aware training recover much of the damage.","key_machinery":"The central objects are microring resonators (MRs), tunable ring waveguides that resonate at a wavelength $\\lambda_{\\mathrm{MR}}$ set by the ring radius, resonance order, and effective index; each MR imprints one weight or activation onto its wavelength channel. The two attack mechanisms are actuation attacks, where hardware trojans in the signal-modulation circuits force an MR off resonance, and thermal hotspot attacks, where trojans in the thermo-optic tuning circuits raise local temperature and shift resonances by $\\Delta\\lambda_{\\mathrm{MR}} = \\Gamma_{\\mathrm{Si}}(\\delta n_{\\mathrm{Si}}/\\delta T)(\\lambda_{\\mathrm{MR}}/n_g)\\Delta T$. The mitigation machinery is software-only: L2 regularization adds a squared-weight penalty to the loss, and noise-aware training injects Gaussian noise into model layers during training, making trained weights less sensitive to the corruption these attacks introduce.","core_discovery":"On the paper's own terms: a hardware trojan in an optical CNN accelerator can corrupt individual microring resonators either by forcing them off resonance through the actuation circuitry or by shifting their resonance wavelength through localized heating. Because those resonators physically imprint weights and activations during matrix-vector multiplications, corrupting 10% of them reduces classification accuracy by 7.49%, 26.4%, and 80.46% for the MNIST model, ResNet18, and the VGG16 variant in the worst hotspot cases. The paper further claims that training the models with L2 regularization combined with Gaussian noise-aware training recovers up to 5.4%, 21.2%, and 30.7% of those drops, with each model needing a different noise level. The contribution is a susceptibility and mitigation analysis for this attack class, not a hardware demonstration.","pith_inferences":["The same two attack classes likely transfer to any non-coherent photonic accelerator that uses MR banks for MAC operations, so the paper's susceptibility pattern is probably broader than the one architecture analyzed.","The paper assumes random MR compromise, but an adversary who targets high-salience weights mapped to specific resonators could potentially exceed the reported accuracy drops.","The training-time defense suggests a practical deployment recipe, choosing the per-model Gaussian noise level after characterizing expected attack intensity, but the paper leaves open how to pick that level online without knowing the attack.","If validated on hardware, the results imply that photonic accelerators need lightweight thermal and resonance monitoring alongside training-time defenses, because 10% hotspot attacks on large models are only partially recoverable in software."],"forward_implications":["An attacker needs to compromise only 10% of MRs to cause severe accuracy loss, so optical accelerators should treat MR actuation and tuning circuits as critical trust boundaries.","Larger models that map multiple layers onto shared VDP blocks suffer more, meaning model size and layer-sharing amplify hardware-attack impact.","Thermal hotspot attacks are more dangerous than actuation attacks at equal MR counts because they corrupt clusters of parameters at once.","L2 regularization plus Gaussian noise-aware training can recover most lost accuracy for 1% and 5% attacks, and can even raise accuracy above the original baseline through improved generalization.","At the extreme 10% attack level on a very large model, software-only recovery is incomplete, so residual risk remains."],"supporting_citations":[{"why":"Supplies the accelerator architecture, MR bank dimensions, and device/circuit characteristics that the simulator uses to map CNN layers and attacks.","marker":"[7]"},{"why":"Supplies the thermo-optic resonance-shift equation used to model thermal hotspot attacks.","marker":"[20]"},{"why":"Supplies the thermal simulation method used to generate hotspot heatmaps for the attack analysis.","marker":"[27]"},{"why":"Supplies the L2 regularization formulation that the mitigation training adopts.","marker":"[30]"},{"why":"Supplies the rationale that reducing variance in neuron output strengths lowers attack-induced accuracy loss.","marker":"[31]"},{"why":"Supplies the noise-aware training method that the paper adapts to Gaussian noise for HT mitigation.","marker":"[32]"}],"fun_headline_variants":["Optical chip trojans slash CNN accuracy by 80%","Trojans in photonic AI accelerators cut accuracy up to 80%","Hardware trojans in optical nets drop CNN accuracy 80%","10% of resonators corrupted: up to 80% accuracy loss","Optical trojan on 10% MRs costs up to 80% accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"All of the drop and recovery figures come from a software simulator that models the accelerator from reference [7]'s device characteristics, not from measurements on fabricated chips, so the reported numbers stand or fall on whether the simulator's weight-to-resonator mapping and corruption physics match real hardware.","fun_headline_variants_meta":{"raw":{"variants":["Optical chip trojans slash CNN accuracy by 80%","Trojans in photonic AI accelerators cut accuracy up to 80%","Hardware trojans in optical nets drop CNN accuracy 80%","10% of resonators corrupted: up to 80% accuracy loss","Optical trojan on 10% MRs costs up to 80% accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000229,"raw_usage":{"total_tokens":1479,"prompt_tokens":943,"completion_tokens":536,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":559,"completion_tokens_details":{"reasoning_tokens":438}},"tokens_in":559,"tokens_out":536,"duration_ms":5454,"temperature":1.0,"reasoning_tokens":438,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:24:03.390839+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Make a physical non-coherent optical MAC bank, force 10% of its microring resonators off resonance and create localized heating on another 10%, then compare the observed classification accuracy drops on MNIST, CIFAR-10, and Imagenette models with the predicted 7.49%, 26.4%, and 80.46% numbers; a substantial mismatch would show the simulator's corruption model is wrong.","supporting_citations":[{"cited_title":"CrossLight: A cross- layer optimized silicon photonic neural network accelerator ,","cited_arxiv_id":null,"evidence_quote":"Supplies the accelerator architecture, MR bank dimensions, and device/circuit characteristics that the simulator uses to map CNN layers and attacks."},{"cited_title":"GHOST: A Graph Neural Network Accelerator using Silicon Photonics ,","cited_arxiv_id":null,"evidence_quote":"Supplies the thermo-optic resonance-shift equation used to model thermal hotspot attacks."},{"cited_title":"Available: https://github.com/uvahotspot/HotSpot","cited_arxiv_id":null,"evidence_quote":"Supplies the thermal simulation method used to generate hotspot heatmaps for the attack analysis."},{"cited_title":"Analyzing fusion of regularization techniques in the deep learning ‐based intrusion detection system,","cited_arxiv_id":null,"evidence_quote":"Supplies the L2 regularization formulation that the mitigation training adopts."},{"cited_title":"Noise-resilient and high -speed deep learning with coherent silicon photonics ,","cited_arxiv_id":null,"evidence_quote":"Supplies the rationale that reducing variance in neuron output strengths lowers attack-induced accuracy loss."},{"cited_title":"Noise-Resilient DNN: Tolerating Noise in PCM - Based AI Accelerators via Noise -Aware Training ,","cited_arxiv_id":null,"evidence_quote":"Supplies the noise-aware training method that the paper adapts to Gaussian noise for HT mitigation."}],"review_version":1}