{"id":"52d894f8-697e-4126-a1a1-15949958bbec","arxiv_id":"2502.05046","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A first security analysis of in-sensor computing, presenting a board/chip/device attack taxonomy and two proof-of-concept attacks.","lead":"This paper analyzes hardware security risks in in-sensor computing systems, where sensors also do computing. It compares these risks with traditional sensor systems and predicts new attack scenarios at board, chip, and device level.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Demo 2 (Section IV.B) does not implement in-sensor computing: it uses a conventional CMOS sensor plus an external Py-Feat classifier, so the empirical support for a unique board-level ISC attack surface is invalid.","rationale":"The reader's weakest assumption exactly identifies the most load-bearing concern: Demo 2 is not an in-sensor computing system. I agree with that assessment. The paper's strongest claim is that ISC systems face unique hardware security challenges, and the two demos are presented as proof-of-concept evidence. Demo 1 is a device-level illustration using a DG-FE-TFET and a simulated counterfeit material change; it is conceptual and does not independently validate the board-level claims. Demo 2 is the only empirical board-level demonstration, but it uses a conventional OV7670 image sensor and an external Py-Feat classification model, which is a textbook TSC configuration. The attack is applied to the serial bus between sensor and computation unit, which is not an ISC-specific attack surface. Moreover, without a TSC baseline experiment, the claim that ISC resilience 'will be increasingly important than TSC systems' is unsupported. This is not a matter of disagreement with consensus; it is an internal mismatch between the defined notion of ISC and the demonstrated system. The paper's taxonomy and conceptual attack-surface analyses remain useful, and the device-level demo is a reasonable starting point, so the appropriate verdict remains CONDITIONAL rather than a full rejection. The 'first work' claim also deserves scrutiny because the literature comparison is limited, but the Demo 2 mismatch is the more concrete and decisive weakness.","tokens_in":6747,"tokens_out":3166,"duration_ms":33116,"concrete_test":"Redesign Demo 2 using a true in-sensor computing vision sensor (e.g., a sensor with in-pixel or in-sensor reservoir/CNN classification that emits only classification results or compressed features) and apply the identical illumination/temperature interference. Run the same attack on a TSC baseline with the same sensor plus an external classifier, and compare classification accuracy and failure modes. If the ISC configuration does not show greater degradation or qualitatively different attack paths, the claim of a distinct board-level ISC attack surface is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim that ISC systems have unique hardware security challenges rests in part on two proof-of-concept demos. Demo 2, described in Section IV.B and Fig. 8, uses an OV7670 conventional CMOS image sensor that sends image data over a serial data bus to a Py-Feat machine-learning model for emotion classification. In this configuration, computation is performed outside the sensor, after data conversion and transmission; this matches the definition of Traditional Sensor-involved Computing (TSC), not In-Sensor Computing (ISC). The demonstrated environmental-interference attack injects noise on the communication bus between the sensor and the computation unit, an attack surface that exists in TSC systems generally. No in-sensor computation is present, and no TSC baseline is run, so the experiment cannot establish that ISC systems are more vulnerable or that the attack is new. This invalidates one of the two provided empirical demonstrations and weakens the claim that these demos 'inspire new countermeasure designs against unique hardware security threats in ISC systems.' Without a valid alternative board-level ISC demonstration, the empirical support for the board-level attack analysis is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper surveys in-sensor computing (ISC) research, argues that ISC systems introduce new hardware security challenges at board, chip, and device levels, contrasts these with traditional sensor-involved computing (TSC), and presents two proof-of-concept demos: a counterfeit attack on a ferroelectric tunnel FET (FET) based gustatory system and an environmental interference attack on an optical sensor-based emotion recognition system. The paper claims to be the first work to analyze security challenges in ISC systems and to compare TSC and ISC security.","tokens_in":6961,"tokens_out":3881,"duration_ms":39665,"significance":"If the analysis is supported, the paper would make a useful contribution by systematically categorizing ISC attack surfaces and motivating countermeasure research. The structured literature review and the three-level attack taxonomy are valuable framing devices, and the paper identifies plausible threat vectors, such as analog side-channel leakage and counterfeit device-level attacks. However, the empirical substantiation is currently weak: Demo 2 does not actually implement in-sensor computation, and Demo 1 is only a conceptual simulation without quantitative results. The paper is best read as a position paper that outlines potential threats rather than a validated experimental study.","major_comments":[{"comment":"Demo 2 does not implement an in-sensor computing system as defined in Section I. The setup uses a conventional CMOS sensor (OV7670) transmitting image data over a serial data bus to an external Py-Feat classifier, which is a traditional sensor-involved computing (TSC) configuration, not ISC. Since no computation occurs inside the sensor and no TSC baseline is provided, the experiment cannot establish that ISC systems are uniquely vulnerable to environmental interference at the board level, nor that the attack is new to ISC. This invalidates one of the two proof-of-concept demonstrations and weakens the central claim that the demos inspire countermeasures against unique ISC hardware security threats.","section":"Section IV.B and Fig. 8"},{"comment":"Demo 1 is described only qualitatively: the I-V characteristic change and the resulting detection output offset are depicted in Fig. 7(c) and (d) without any numerical data, simulation results, error bars, or repeatability metrics. The claim that a small change in FE-oxide thickness in a counterfeit device leads to a wrong biomolecule recognition is therefore unsupported. As this is the only demonstration of the device-level counterfeit attack, the empirical basis for that attack surface is not established.","section":"Section IV.A and Fig. 7"},{"comment":"The entries in Table I, such as 'ISC attacks require full knowledge of the entire system' and 'attack detection is complicated', are presented as established facts but are not derived from the demos or a systematic analysis. Some entries conflate limited accessibility with requiring full knowledge, and the threat models differ substantially across board-, chip-, and device-level ISC. The paper should present these comparisons explicitly as hypotheses or support them with concrete case studies and a defined attacker model.","section":"Section III.A and Table I"}],"minor_comments":[{"comment":"The claim 'to the best of our knowledge, this is the first work that analyzes security challenges in ISC systems' is stated twice without a systematic search of security literature in adjacent paradigms such as processing-in-memory, analog computing, or sensor security; please temper the claim to 'to our knowledge' and describe the search criteria.","section":"Abstract and Section I"},{"comment":"The phrase 'proof-the-concept' appears twice and should be corrected to 'proof-of-concept'.","section":"Section IV.B and VI"},{"comment":"The y-axis of the 'historical progress' chart is not labeled; please clarify whether the chart plots cumulative publication counts or a different metric, and describe the search and selection methodology for the literature data in Fig. 3.","section":"Figure 2"},{"comment":"Reference [28] is formatted as 'I. OmniVision Technologies'; the correct style is 'OmniVision Technologies' without the initial.","section":"Reference [28]"},{"comment":"The sentence 'analog signals may reveal more details than the digital format since analog signals have frequency, magnitude, and phase' is unclear because digital signals also carry these properties; please specify which physical attributes of the analog sensor output are measurably more informative to an attacker.","section":"Section III.B.1"}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea—that the move from TSC to ISC changes the attack surface—is timely and worth exploring, but the current manuscript overstates the evidence: one demo is not an ISC system and the other is conceptual. I recommend major revision to either re-frame the demos as illustrative of TSC-adjacent risks and add a real ISC demonstration, or to reposition the paper as a forward-looking threat analysis with clearly labeled hypotheses. The 'first work' claim should be carefully checked against the broader hardware-security literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper gives the first systematic security framing for in-sensor computing, and that framing is worth engaging with. The board/chip/device taxonomy is sensible, the comparison with traditional sensor-involved computing is clarifying, and it identifies genuinely new attack surfaces: analog signal side-channels, counterfeit material substitution at the device level, and the difficulty of probing in 3D-integrated systems. For a community mostly focused on materials and performance, this is a useful starting point.\n\nWhat the paper does well is reason from the ISC architecture to plausible threats without hand-waving. Table I, for example, captures real differences in attack accessibility and detection difficulty. Section III on the design flow is also a good contribution: the observation that material modeling is a trust boundary early in the flow is correct and underappreciated.\n\nThe soft spots are in the demonstrations. Demo 2 is not an ISC system. The OV7670 sends image data over a serial bus to an external Py-Feat model; that is traditional sensor-involved computing. What the demo shows is that a low-cost circuit on the bus can corrupt data and change classification, which is an existing attack surface in TSC. Without a true ISC comparison, it cannot support the claim that ISC systems are uniquely vulnerable to environmental interference. Demo 1 is only a conceptual simulation: the FE-oxide thickness change is assumed, and the I-V curves and frequency offset are illustrative, not measured. There are no error bars, no repeatability, no baseline.\n\nThese weaknesses matter because the paper leans on the demos to support its novelty claim. But they do not sink the qualitative analysis. The attack scenarios at the board and chip levels are plausible and arrived at by reasoning from the architecture, not from the demos themselves. The \"first work\" claim is overstrong given the limited prior-art search; hardware security venues publish short papers and workshop items, and the authors should check more carefully before claiming a first.\n\nWho this is for: researchers in hardware security who need a map of where ISC systems are exposed, and ISC device researchers who haven't thought about security. They will get the most value from the taxonomy and the design-flow discussion.\n\nRecommendation: send it to peer review. It deserves a serious referee. The authors should be pushed to reposition Demo 2 explicitly as a TSC baseline or replace it with a real ISC setup, and to soften the first-work claim. The core analysis is solid enough to build on.","headline":"A useful first security taxonomy for in-sensor computing, but the two demos overclaim what they prove; the qualitative analysis deserves a referee.","tokens_in":7454,"tokens_out":1399,"would_cite":true,"duration_ms":17050,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that in-sensor computing systems, by fusing sensing and computation, create new hardware security threats at board, chip, and device levels that existing digital defenses cannot catch.","keywords":["in-sensor computing","hardware security","fault attack","counterfeit attack","analog side-channel","health monitoring","3D integration","environmental interference"],"falsifier":"Replace the external classifier in Demo 2 with an in-sensor implementation of the same emotion-recognition function, keep the same low-cost light-controlled circuit, and compare output labels under identical illumination. If the label does not flip, the demo does not establish the board-level ISC attack.","tokens_in":6560,"feed_emoji":"🛡️","tokens_out":8722,"duration_ms":81114,"temperature":0.7,"pith_summary":"In-sensor computing (ISC) puts sensing, memory, and computation in one compact unit so data are processed where they are collected, saving energy and latency for health monitors and wearables. This paper sets out to establish that this fusion creates a hardware-security problem that cannot be handled by extending traditional sensor-involved computing (TSC) defenses: the same compaction removes the probing points, digitization steps, and interface boundaries that existing security tools rely on. Claiming to be the first security analysis of ISC systems, it compares attack accessibility, prior knowledge, tools, and detection difficulty between TSC and ISC, and it predicts new attack scenarios at the board, chip, and device levels. Two proof-of-concept demos ground the claims: a counterfeit material in a ferroelectric biosensor flips a biomolecule-detection output, and a low-cost light-controlled circuit on a sensor data bus changes an emotion-classification conclusion. The paper's point is that security must be designed into the material and device phase of ISC, not bolted on afterward.","feed_headline":"In-sensor computing opens new attack routes at every level","feed_subtitle":"Counterfeit materials and light-based interference can silently corrupt health-monitoring results.","key_machinery":"The central object is a three-level attack-surface decomposition of ISC systems — board, chip, and device — keyed to how sensing and computation are integrated. At each level the paper identifies what an attacker must know and what tools are needed: board-level attacks exploit the analog link between sensor and computation and the sensor's sensitivity to its environment; chip-level attacks target vertical interconnects and untrusted 3D-integration entities; device-level attacks require full understanding of the sensing material and are the hardest to detect. A comparison table against traditional sensor-involved computing carries the argument that ISC trades easier access for harder detection. The demos provide the physical anchors: a double-gate ferroelectric tunnel FET gustatory sensor shows a counterfeit-oxide-induced shift in the current-voltage characteristic that produces a wrong recognition output, and an optical sensor wired to an external classification model shows light-induced interference flipping the predicted emotion.","core_discovery":"On its own terms, the paper's central claim is that in-sensor computing systems have a distinct security profile: compared with traditional sensor-involved computing, ISC reduces remote accessibility but demands more attacker knowledge, more customized tools, and makes attacks harder to detect. Because an ISC system's sensing and computing behavior is fixed by material properties and device mechanisms, the design and modeling stage becomes security-critical; a malicious foundry can tamper with both analog and digital parts, and counterfeit materials can shift device characteristics in ways that surface only after full data processing. At board level, environmental interference and analog-format side channels attack sensor data before digitization; at chip level, 3D-stacked interconnects create new fault-injection points; at device level, customized counterfeit attacks need full sensor knowledge and are hard to diagnose for lack of probing locations. The two demos are offered as evidence that these attacks are physically realizable and as starting points for countermeasure design.","pith_inferences":["If the trend holds, the strongest countermeasures will use the sensing physics itself — for example, fingerprinting material response or treating the sensor's characteristic curve as a tamper-evident seal — since digital authentication has no natural anchor in a fused analog device.","A direct testable extension is to measure detection latency for a deliberately inserted counterfeit ferroelectric layer in a true device-level ISC versus an equivalent traditional chain; the paper's delayed-detection claim predicts a measurable lag.","The board-level demo implies a broader statement the authors do not make: any system that trusts an unauthenticated analog sensor-to-computation link, ISC or not, is open to low-cost environmental manipulation; ISC matters because it deliberately removes the digitization that would otherwise bound the attack."],"forward_implications":["If the paper's analysis is right, ISC design flows must treat the material and device modeling phase as a security stage, because a tampered material changes every result the device will ever produce.","Existing digital countermeasures — probing, authentication, and validation tools — will not transfer cleanly to ISC because analog fault signals can look like sensor noise and there are few intermediate checkpoints.","Health-monitoring ISC devices deployed in public places will need lightweight integrity checks that work without probing individual sensing elements.","The comparison predicts a security trade-off: deeper integration shrinks the remotely accessible attack surface but pushes attacks toward physical, customized, hard-to-detect forms."],"supporting_citations":[{"why":"Supplies the working definition of in-sensor computing and the board/chip/device integration levels that structure the attack-surface analysis.","marker":"[9]"},{"why":"Establishes that sensing units can be extended to offer computing capability, the premise behind the ISC threat model.","marker":"[7]"},{"why":"Describes the ferroelectric-tunnel-FET artificial gustatory system used in Demo 1 to show a counterfeit-material attack.","marker":"[27]"},{"why":"Datasheet for the CMOS optical sensor used in Demo 2's environmental interference attack.","marker":"[28]"},{"why":"Provides the facial-expression classification model whose output flips under interference in Demo 2.","marker":"[29]"},{"why":"Example of 3D-stacked in-sensor vision processing that motivates the chip-level interconnect fault attacks.","marker":"[14]"},{"why":"Example of reservoir computing in optical sensors used to illustrate data-processing-technique ISC and its attack surface.","marker":"[18]"},{"why":"Example of computational-materials ISC that supports the claim that material modeling is a security-critical design stage.","marker":"[12]"}],"fun_headline_variants":["In-sensor computing opens stealthier attacks on health data","Hardware tampering and light threats hit in-sensor chips","In-sensor computing's security risks shift to physical layer","New in-sensor attack routes bypass traditional defenses"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The second demo's setup is a conventional sensor plus external classifier, not a true in-sensor computing system; the paper's board-level attack claim rests on the assumption that the observed interference transfers to systems where computation happens inside the sensor.","fun_headline_variants_meta":{"raw":{"variants":["In-sensor computing opens stealthier attacks on health data","Hardware tampering and light threats hit in-sensor chips","In-sensor computing's security risks shift to physical layer","New in-sensor attack routes bypass traditional defenses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000299,"raw_usage":{"total_tokens":1686,"prompt_tokens":861,"completion_tokens":825,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":477,"completion_tokens_details":{"reasoning_tokens":759}},"tokens_in":477,"tokens_out":825,"duration_ms":9394,"temperature":1.0,"reasoning_tokens":759,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T20:25:39.681833+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Replace the external classifier in Demo 2 with an in-sensor implementation of the same emotion-recognition function, keep the same low-cost light-controlled circuit, and compare output labels under identical illumination. If the label does not flip, the demo does not establish the board-level ISC attack.","supporting_citations":[{"cited_title":"In-sensor computing: Materials, devices, and integration technologies,","cited_arxiv_id":null,"evidence_quote":"Supplies the working definition of in-sensor computing and the board/chip/device integration levels that structure the attack-surface analysis."},{"cited_title":"In-sensor visual perception and inference,","cited_arxiv_id":null,"evidence_quote":"Establishes that sensing units can be extended to offer computing capability, the premise behind the ISC threat model."},{"cited_title":"Energy efficient artificial gustatory system for in-sensor computing,","cited_arxiv_id":null,"evidence_quote":"Describes the ferroelectric-tunnel-FET artificial gustatory system used in Demo 1 to show a counterfeit-material attack."},{"cited_title":"OmniVision Technologies, OV7670/OV7171 CMOS VGA (OmniPixel) CameraChip Sensor with OmniPixel Technology","cited_arxiv_id":null,"evidence_quote":"Datasheet for the CMOS optical sensor used in Demo 2's environmental interference attack."},{"cited_title":"Py-feat: Python facial expression analysis toolbox,","cited_arxiv_id":null,"evidence_quote":"Provides the facial-expression classification model whose output flips under interference in Demo 2."},{"cited_title":"Advances in silicon-based in-sensor computing for neuromorphic vision sensors,","cited_arxiv_id":null,"evidence_quote":"Example of 3D-stacked in-sensor vision processing that motivates the chip-level interconnect fault attacks."},{"cited_title":"Wear- able in-sensor reservoir computing using optoelectronic polymers with through-space charge-transport characteristics for multi-task learning,","cited_arxiv_id":null,"evidence_quote":"Example of reservoir computing in optical sensors used to illustrate data-processing-technique ISC and its attack surface."},{"cited_title":"In- sensor neuromorphic computing using perovskites and transition metal dichalcogenides,","cited_arxiv_id":null,"evidence_quote":"Example of computational-materials ISC that supports the claim that material modeling is a security-critical design stage."}],"review_version":1}