REVIEW 4 major objections 6 minor 33 references
SafeLight: Enhancing Security in Optical Convolutional Neural Network Accelerators
T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash
Pith's one-line read Hardware trojans that corrupt 10% of microring resonators can drop CNN accuracy by up to 80.46%, and training-time defenses recover much of the loss.
desk verdict First quantitative map of MR trojan effects on a non-coherent ONN accelerator, but the numbers rest on an unreleased and under-specified simulator. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central objects are microring resonators (MRs), tunable ring waveguides that resonate at a wavelength $\lambda_{\mathrm{MR}}$ set by the ring radius, resonance order, and effective index; each MR imprints one weight or activation onto its wavelength channel. The two attack mechanisms are actuation attacks, where hardware trojans in the signal-modulation circuits force an MR off resonance, and thermal hotspot attacks, where trojans in the thermo-optic tuning circuits raise local temperature and shift resonances by $\Delta\lambda_{\mathrm{MR}} = \Gamma_{\mathrm{Si}}(\delta n_{\mathrm{Si}}/\delta T)(\lambda_{\mathrm{MR}}/n_g)\Delta T$. The mitigation machinery is software-only: L2 regularization adds a squared-weight penalty to the loss, and noise-aware training injects Gaussian noise into model layers during training, making trained weights less sensitive to the corruption these attacks introduce.
What would settle it
Make a physical non-coherent optical MAC bank, force 10% of its microring resonators off resonance and create localized heating on another 10%, then compare the observed classification accuracy drops on MNIST, CIFAR-10, and Imagenette models with the predicted 7.49%, 26.4%, and 80.46% numbers; a substantial mismatch would show the simulator's corruption model is wrong.
Extended reading notes
Core claim
On the paper's own terms: a hardware trojan in an optical CNN accelerator can corrupt individual microring resonators either by forcing them off resonance through the actuation circuitry or by shifting their resonance wavelength through localized heating. Because those resonators physically imprint weights and activations during matrix-vector multiplications, corrupting 10% of them reduces classification accuracy by 7.49%, 26.4%, and 80.46% for the MNIST model, ResNet18, and the VGG16 variant in the worst hotspot cases. The paper further claims that training the models with L2 regularization combined with Gaussian noise-aware training recovers up to 5.4%, 21.2%, and 30.7% of those drops, with each model needing a different noise level. The contribution is a susceptibility and mitigation analysis for this attack class, not a hardware demonstration.
Load-bearing premise
All of the drop and recovery figures come from a software simulator that models the accelerator from reference [7]'s device characteristics, not from measurements on fabricated chips, so the reported numbers stand or fall on whether the simulator's weight-to-resonator mapping and corruption physics match real hardware.
Editorial extensions
If this is right
- An attacker needs to compromise only 10% of MRs to cause severe accuracy loss, so optical accelerators should treat MR actuation and tuning circuits as critical trust boundaries.
- Larger models that map multiple layers onto shared VDP blocks suffer more, meaning model size and layer-sharing amplify hardware-attack impact.
- Thermal hotspot attacks are more dangerous than actuation attacks at equal MR counts because they corrupt clusters of parameters at once.
- L2 regularization plus Gaussian noise-aware training can recover most lost accuracy for 1% and 5% attacks, and can even raise accuracy above the original baseline through improved generalization.
- At the extreme 10% attack level on a very large model, software-only recovery is incomplete, so residual risk remains.
Reading between the lines
- The same two attack classes likely transfer to any non-coherent photonic accelerator that uses MR banks for MAC operations, so the paper's susceptibility pattern is probably broader than the one architecture analyzed.
- The paper assumes random MR compromise, but an adversary who targets high-salience weights mapped to specific resonators could potentially exceed the reported accuracy drops.
- The training-time defense suggests a practical deployment recipe, choosing the per-model Gaussian noise level after characterizing expected attack intensity, but the paper leaves open how to pick that level online without knowing the attack.
- If validated on hardware, the results imply that photonic accelerators need lightweight thermal and resonance monitoring alongside training-time defenses, because 10% hotspot attacks on large models are only partially recoverable in software.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper investigates hardware trojan (HT) attacks on microring resonators (MRs) in a non-coherent optical CNN accelerator based on the CrossLight architecture. Two attack vectors are considered: MR actuation attacks (off-resonance) and thermal hotspot attacks, targeting 1%, 5%, and 10% of MRs in the CONV block, FC block, and the entire accelerator. The authors report accuracy drops up to 7.49% to 80.46% for 10% MR attacks across three CNN models (MNIST CNN, ResNet18, VGG16 variant). They then propose software-based mitigations—L2 regularization and Gaussian noise-aware training—and report that the best variants recover up to 5.4%, 21.2%, and 30.7% of the accuracy drops for the three models, respectively.
Significance. If the quantitative results are reliable, this is the first systematic study of HT attacks on non-coherent ONN accelerators and the first to propose software-based defenses for such attacks. The threat model is plausible, the use of the HotSpot tool for thermal analysis is a reasonable choice, and the mitigation direction (regularization and noise-aware training) is well-motivated by prior work in other hardware accelerators. However, the central quantitative claims rest entirely on a Python simulator that is not released, not validated against fabricated hardware or a published benchmark, and not specified in enough detail to reproduce. The susceptibility direction is credible, but the specific accuracy drops and recovery percentages should be treated as illustrative unless the simulator is made available and validated.
major comments (4)
- [Section IV] The simulator is under-specified and unvalidated. The paper states that "we developed a comprehensive Python simulator that modeled the accelerator based on device, circuit, and component level characteristics defined in [7]" and that attacks were realized "by modifying the models' parameters based on their mapping to the ONN accelerator," but it never provides the weight-to-MR mapping algorithm (e.g., how convolution kernels are tiled onto the 20×20 CONV VDP units or how FC weights are mapped to the 150×150 banks), nor the exact corruption equations for the two attack vectors. For actuation attacks, it is unclear whether an off-resonance MR sets the affected weight to zero, multiplies it by a residual coupling factor, or replaces it with a random value. For thermal hotspot attacks, the relation between the HotSpot temperature map, the resonance shift in Eq. (2), and the resulting weight corruption is not quantified. Because these modeling choices directly determine the attacked weight tensors, the headline drops (7.49%–80.46%) and recovery percentages are functions of an unvalidated and underspecified simulator. Please provide the mapping and corruption models in detail, release the simulator code, and validate it against at least a 0%-attack control (e.g., reproducing the baseline accuracy of the models on the chosen datasets) or a published ONN hardware result.
- [Section VI] The mitigation hyperparameters are selected on the test attack scenarios, making the reported recovery percentages optimistic. In Section VI, the authors state that "different models achieve optimal robustness with different noise standard deviations" and identify l2+n3, l2+n5, and l2+n2 as the most robust configurations for MNIST, ResNet18, and VGG16, respectively. This selection is based on Fig. 8, which summarizes accuracy results across the same attack scenarios used later for the final evaluation in Fig. 9. This is a form of test-set overfitting: the chosen noise standard deviation is tuned to the exact attack cases whose recovery is then reported. Please select hyperparameters using a held-out validation set (e.g., a separate set of random MR corruption patterns) or report the expected recovery across the full grid of noise standard deviations, so that the mitigation effectiveness is not circular.
- [Section IV] The attack intensity metric is inconsistent between the two attack vectors. The text says that "1%, 5%, and 10% of the MRs" are targeted for both actuation and hotspot attacks, but then states that "we simulate 10 different uniformly distributed combinations of individual random MRs (for actuation attacks) and banks of MRs (for hotspot attacks) being targeted by HTs for the 1%, 5%, and 10% cases." Targeting banks is not the same as targeting individual MRs; the paper does not explain how a bank-level selection is converted into an MR-level percentage or whether the same percentage refers to the fraction of banks. This ambiguity affects the comparability of the two attack types and the precise meaning of the central claim "by just targeting 10% of MRs." Please specify the exact selection procedure for hotspot attacks, including the number of banks, the number of MRs per bank, and how the 1%, 5%, and 10% figures are computed.
- [Sections IV and VI] The baseline accuracies of the CNN models are never reported numerically. The figures show horizontal lines labeled as baseline accuracy, but the text does not give the clean-data top-1 accuracies for MNIST, CIFAR-10, or Imagenette. Without these numbers, the reported accuracy drops (e.g., 7.49% for MNIST) cannot be interpreted in context—a drop from 99% to 91.5% is far less severe than a drop from 10% to 2.5%. Please report the baseline accuracy for each original model and for each robust model variant, along with the standard deviation across the 10 simulation runs.
minor comments (6)
- [Abstract and Section VI] The phrase "up to 7.49% to 80.46%" is awkward; consider replacing it with "ranging from 7.49% to 80.46%" or "up to 80.46%."
- [Section IV] There is a typo in the sentence "This is due to the massive size of VGG16 model which requires mutliple mappings for each layer" — "mutliple" should be "multiple."
- [Section VI] The statement that robust models "recover up to 5.4%, 21.2%, and 30.7% of the accuracy drops" is ambiguous: it is unclear whether these percentages are absolute percentage points or the percentage of the drop that is recovered relative to the original drop. Please clarify the basis of these recovery figures.
- [Section II] Equation (1) appears garbled in the manuscript (e.g., the symbols for effective index and resonance order are not rendered). Please ensure the equation is typeset correctly.
- [Section V] The text refers to Fig. 8 as a "box and whiskers plot," but the figure appears to show scattered points across the 10 runs rather than box plots. Either update the description or replace the figure with a proper box plot.
- [Section V] It is not clear whether the Gaussian noise in "noise-aware training" is added to the weights, activations, or both. Please specify the exact training procedure, including when and where the noise is injected.
Circularity Check
No significant circularity: the attack and mitigation results are outputs of an independent forward simulator, not encoded in the inputs; self-citations point to published, checkable architecture and physics.
full rationale
The paper's central susceptibility claim is derived by modifying CNN model parameters according to a mapping to MR banks in the CrossLight architecture and then running inference; the reported accuracy drops (7.49%–80.46%) are outputs of that forward computation, not inputs. The thermal hotspot model relies on Eq. (2), a standard thermo-optic resonance-shift relation cited from [20], and on HotSpot-generated temperature maps; neither is equivalent to the accuracy numbers being reported. The mitigation study trains models with L2 regularization and Gaussian noise-aware training and evaluates them on the same simulator; the robust models are not constructed from the attacked accuracy values. The per-model choice of the best noise standard deviation after evaluating all variants on the attack scenarios is a hyperparameter-selection and potential overfitting concern, better classified as soundness/selection bias rather than circularity, because the reported recovery percentages are not forced by construction. The self-citations to [7] and [20] are load-bearing for the architecture and physics, but they refer to published, externally checkable results rather than to this paper's own fitted values, so they do not constitute self-citation circularity.
Assumptions & free parameters
free parameters (2)
- Gaussian noise standard deviation for noise-aware training =
0.3 (MNIST), 0.5 (ResNet18), 0.2 (VGG16)
- L2 regularization coefficient (lambda) =
not reported
assumptions (4)
- domain assumption The CrossLight-based simulator faithfully models the behavior of the microring-resonator ONN accelerator at device, circuit, and component level.
- domain assumption An HT in an actuation circuit forces an MR into off-resonance, which corrupts only the corresponding product term in the dot product.
- domain assumption Thermal hotspot attacks shift MR resonances according to Eq. (2), causing neighboring wavelength corruption as described in Section III.B.2.
- domain assumption Random uniform selection of attacked MRs, with 10 draws per scenario, is representative of attacker placement.
Cite this review
Pith. "Pith review of SafeLight: Enhancing Security in Optical Convolutional Neural Network Accelerators." pith.science (2026). https://pith.science/paper/YQV6NBKD
@misc{pith2026241116712,
author = {Pith},
title = {Pith review of: SafeLight: Enhancing Security in Optical Convolutional Neural Network Accelerators},
year = {2026},
howpublished = {\url{https://pith.science/paper/YQV6NBKD}},
note = {Machine review of arXiv:2411.16712}
}
read the original abstract
The rapid proliferation of deep learning has revolutionized computing hardware, driving innovations to improve computationally expensive multiply-and-accumulate operations in deep neural networks. Among these innovations are integrated silicon-photonic systems that have emerged as energy-efficient platforms capable of achieving light speed computation and communication, positioning optical neural network (ONN) platforms as a transformative technology for accelerating deep learning models such as convolutional neural networks (CNNs). However, the increasing complexity of optical hardware introduces new vulnerabilities, notably the risk of hardware trojan (HT) attacks. Despite the growing interest in ONN platforms, little attention has been given to how HT-induced threats can compromise performance and security. This paper presents an in-depth analysis of the impact of such attacks on the performance of CNN models accelerated by ONN accelerators. Specifically, we show how HTs can compromise microring resonators (MRs) in a state-of-the-art non-coherent ONN accelerator and reduce classification accuracy across CNN models by up to 7.49% to 80.46% by just targeting 10% of MRs. We then propose techniques to enhance ONN accelerator robustness against these attacks and show how the best techniques can effectively recover the accuracy drops.
Reference graph
Works this paper leans on
-
[7]
CrossLight: A cross- layer optimized silicon photonic neural network accelerator ,
F. Sunny, A. Mirza, M. Nikdast, and S. Pasricha, “CrossLight: A cross- layer optimized silicon photonic neural network accelerator ,” ACM/IEEE DAC,2021
work page 2021
-
[1]
N. Jouppi, et al., "Tpu v4: An optically reconfigurable supercomputer for machine learning with hardware support for embeddings ,” ISCA, 2023
work page 2023
-
[2]
Shedding Light on LLMs: Harnessing Photonic Neural Networks for Accelerating LLMs,
S. Afifi, F. Sunny, S. Pasricha, and M. Nikdast , “Shedding Light on LLMs: Harnessing Photonic Neural Networks for Accelerating LLMs,” IEEE ICCAD, 2024
work page 2024
-
[3]
There’s plenty of room at the Top: What will drive computer performance after Moore’s law?
C. E. Leiserson , et al., "There’s plenty of room at the Top: What will drive computer performance after Moore’s law?" Science 368.6495, 2020
work page 2020
-
[4]
Cross-Layer Design for AI Acceleration with Non -Coherent Optical Computing ,
F. Sunny, Mahdi Nikdast, and Sudeep Pasricha, “Cross-Layer Design for AI Acceleration with Non -Coherent Optical Computing ,”, ACM GLSVLSI, 2023
work page 2023
-
[5]
Accelerating Neural Networks for Large Language Models and Graph Processing with Silicon Photonics,
S. Afifi, F. Sunny, M. Nikdast, and S. Pasricha , “Accelerating Neural Networks for Large Language Models and Graph Processing with Silicon Photonics,” IEEE/ACM DATE, 2024
work page 2024
-
[6]
F. Sunny, E. Taheri, M. Nikdast, and S. Pasricha , “Silicon Photonic 2.5D Interposer Networks for Overcoming Communication Bottlenecks in Scale -out Machine Learning Hardware Accelerators ,” IEEE VTS, 2024
work page 2024
-
[8]
Deep defense: Training dnns with improved adversarial robustness ,
Y. Ziang, Y. Guo, and C. Zhang , "Deep defense: Training dnns with improved adversarial robustness ," NeurIPS, 2018
work page 2018
Show all 33 references
-
[9]
Memory trojan attack on neural network accelerators,
Y. Zhao, et al. , "Memory trojan attack on neural network accelerators," IEEE/ACM DATE, 2019
2019
-
[10]
Fault Injection Attack on Deep Neural Network,
Y. Liu, L. Wei, B. Luo, and Q. Xu , “Fault Injection Attack on Deep Neural Network,” ICCAD, 2017
2017
-
[11]
Hu-Fu: Hardware and software collaborative attack framework against neural networks ,
W. Li, et al. , “Hu-Fu: Hardware and software collaborative attack framework against neural networks ,” arXiv preprint arXiv:1805.05098, 2018
2018 arXiv
-
[12]
Hardware Trojan attacks on neural networks,
J. Clements, and Y. Lao, “Hardware Trojan attacks on neural networks,” arXiv preprint arXiv:1806.05768, 2018
2018 arXiv
-
[13]
Tron: Transformer neural network acceleration with non -coherent silicon photonics ,
S. Afifi , F. Sunny, M. Nikdast, and S. Pasricha , "Tron: Transformer neural network acceleration with non -coherent silicon photonics ," GLSVLSI, 2023
2023
-
[14]
RecLight: A Recurrent Neural Network Accelerator with Integrated Silicon Photonics,
F. Sunny, M. Nikdast, and S. Pasricha, "RecLight: A Recurrent Neural Network Accelerator with Integrated Silicon Photonics," IEEE ISVLSI, 2022
2022
-
[15]
SONIC: A Sparse Neural Network Inference Accelerator with Silicon Photonics for Energy - Efficient Deep Learning ,
F. Sunny, M. Nikdast, and S. Pasricha, “SONIC: A Sparse Neural Network Inference Accelerator with Silicon Photonics for Energy - Efficient Deep Learning ,” IEEE/ACM ASPDAC, 2022
2022
-
[16]
A Silicon Photonic Accelerator for Convolutional Neural Networks with Heterogeneous Quantization,
F. Sunny, M. Nikdast, and S. Pasricha, “A Silicon Photonic Accelerator for Convolutional Neural Networks with Heterogeneous Quantization,” ACM GLSVLSI, 2022
2022
-
[17]
ROBIN: A Robust Optical Binary Neural Network Accelerator ,
F. Sunny, A. Mirza, M. Nikdast, and S. Pasricha , “ROBIN: A Robust Optical Binary Neural Network Accelerator ,” CM TECS, 2021
2021
-
[18]
PWM‐Driven thermally tunable silicon microring resonators: design, fabrication, and characterization,
P. Pintus, et al. , “PWM‐Driven thermally tunable silicon microring resonators: design, fabrication, and characterization,” Laser & Photonics Reviews, 2019
2019
-
[19]
Assessing performance of silicon photonic modulators for pulse amplitude modulation,
H. Sepehrian, A. Yekani, W. Shi, and L. Rusch , "Assessing performance of silicon photonic modulators for pulse amplitude modulation," IEEE Journal of Selected Topics in Quantum Electronics, 2018
2018
-
[20]
GHOST: A Graph Neural Network Accelerator using Silicon Photonics ,
S. Afifi, F. Sunny, A. Shafiee, M. Nikdast, and S. Pasricha, “GHOST: A Graph Neural Network Accelerator using Silicon Photonics ,” IEEE/ACM CASES (ESWEEK), 2023
2023
-
[21]
Wavelength tuning and stabilization of microring-based filters using silicon in -resonator photoconductive heaters,
H. Jayatilleka, et al. , "Wavelength tuning and stabilization of microring-based filters using silicon in -resonator photoconductive heaters," Opt. Express 23, 2015
2015
-
[22]
Digital-to-analog hardware Trojan attacks ,
M. Elshamy, et al., "Digital-to-analog hardware Trojan attacks ," IEEE Transactions on Circuits and Systems I, 2021
2021
-
[23]
Security interrogation and defense for SAR analog to digital converter ,
S. Taheri, J. Lin, and J. Yuan, "Security interrogation and defense for SAR analog to digital converter ," Electronics 6.2, 2017
2017
-
[24]
LIBRA: Thermal and Process Variation Aware Reliability Management in Photonic Networks-on-Chip,
S. V. R. Chittamuru, I. Thakkar , and S. Pasricha, “LIBRA: Thermal and Process Variation Aware Reliability Management in Photonic Networks-on-Chip,” IEEE TMSCS, 2018
2018
-
[25]
SOTERIA: Exploiting Process Variations to Enhance Hardware Security with Photonic NoC Architectures,
S. V. R. Chittamuru, I. Thakkar, V. Bhat, and S. Pasricha, “SOTERIA: Exploiting Process Variations to Enhance Hardware Security with Photonic NoC Architectures,” IEEE/ACM DAC, 2018
2018
-
[26]
SerIOS: Enhancing Hardware Security in Integrated Optoelectronic Systems ,
F. Magalhaes, M. Nikdast, and G. Nicolescu , "SerIOS: Enhancing Hardware Security in Integrated Optoelectronic Systems ," Proceedings of the 34th International Workshop on Rapid System Prototyping. 2023
2023
-
[27]
Available: https://github.com/uvahotspot/HotSpot
Hotspot 7.0 [Online]. Available: https://github.com/uvahotspot/HotSpot
-
[28]
Regularization in CNN: A Mathematical Study for L1, L2 and Dropout Regularizers,
C.A Mehdi, J. Nour -Eddine, and E. Mohamed , “Regularization in CNN: A Mathematical Study for L1, L2 and Dropout Regularizers,” AI2SD 2022
2022
-
[29]
More than moore technologies for next generation computer design
Topaloglu, Rasit O., ed. More than moore technologies for next generation computer design. Springer, 2015
2015
-
[30]
Analyzing fusion of regularization techniques in the deep learning ‐based intrusion detection system,
A. Thakkar, and R. Lohiya, "Analyzing fusion of regularization techniques in the deep learning ‐based intrusion detection system," International Journal of Intelligent Systems , 2021
2021
-
[31]
Noise-resilient and high -speed deep learning with coherent silicon photonics ,
G. Mourgias-Alexandris, et al., “Noise-resilient and high -speed deep learning with coherent silicon photonics ,” Nature communications, 2022
2022
-
[32]
Noise-Resilient DNN: Tolerating Noise in PCM - Based AI Accelerators via Noise -Aware Training ,
S. Kariyappa, et al., "Noise-Resilient DNN: Tolerating Noise in PCM - Based AI Accelerators via Noise -Aware Training ," in IEEE Transactions on Electron Devices , 2021
2021
-
[33]
Survey of Recent Developments for Hardware Trojan Detection ,
A. Jain, Z. Zhou, and U. Guin, "Survey of Recent Developments for Hardware Trojan Detection ," 2021 ISCAS, 2021
2021
Reviewed August 12, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.