How the Signal Crosses the Hardware–Software Boundary
HAMLOCK's central mechanism is a handoff: a neural-network model creates a trigger-dependent internal signal, and accelerator hardware interprets that signal and changes the final decision. This chapter follows that handoff in order, from the model alteration to the output payload. The goal is not to reproduce an attack recipe, but to make clear which component owns each step, why the signal can remain quiet during software-only testing, and where the paper's implementation-specific evidence stops.
The mechanism has two design problems to solve at once. The model must separate triggered inputs from clean inputs strongly enough for simple hardware to recognize the difference. At the same time, the alteration must not noticeably damage ordinary predictions or create a complete software backdoor that existing defenses can find. The hardware must then detect the separation cheaply and apply a reliable output change without taking on the much harder task of recognizing the trigger itself.
First, make a few activations distinctive
A neural network transforms an input through many layers. Each neuron computes a weighted combination of values from an earlier stage and passes the result through an activation function. Most individual activations are not meaningful to a defender by themselves: they vary with the image, the layer, the model architecture, and the surrounding computation. That variability is a problem if hardware is expected to use one of them as an on/off indicator.
HAMLOCK's model component is designed to create a more useful separation. In the single-neuron variant, the authors target a neuron in the first layer. Early-layer weights interact directly with the region where a patch trigger is placed, so the attacker can tune that neuron's response to the trigger while reducing its dependence on the rest of the image. The aim is not for the neuron to recognize the entire image or choose the target class. It is to make the activation high for a triggered input and keep it below a chosen threshold for clean inputs.
The bias and scale of the altered neuron help set that separation. If clean activations remain on one side of the threshold and triggered activations land on the other, hardware does not need to understand the full numerical distribution. It only needs to test whether the relevant condition is true. The model has converted a complicated input-recognition problem into a narrow signal that a comparator can read.
The generalized variant spreads the idea across a few neurons in randomly selected layers. The authors first look for neurons that can be changed without materially hurting clean accuracy. They use neuron ablation as a practical test: if setting a candidate neuron's activation to zero barely reduces accuracy on a calibration set, the later layers are relatively insensitive to that neuron's ordinary contribution. Such a neuron is a safer place to introduce a signaling change. The candidates are then ranked by how much their activations differ between clean and triggered samples, and a small group is selected.
This distributed design changes the error profile. One neuron may occasionally cross a threshold for a clean input. Requiring several neurons in different layers to cross their thresholds together makes accidental activation less likely. The trade-off is that the attacker has less direct access to the original trigger region in deeper layers and must use indirect activation separation. The paper reports that its default multi-neuron setting uses a small calibration set, but the exact success of that choice depends on the selected model and dataset.
The calibration set is important because the attacker is not merely choosing a visual patch. They are trying to shape an internal distribution. In the reported VGG-16/CIFAR-10 ablation, five calibration samples produce 63.7% attack success, while 500 produce 96.7%; the table reaches 70.8% at 10 samples and rises through the intermediate settings. Those figures describe one reported configuration, not a universal data requirement. They show why even a small amount of clean information can help an attacker tune the relationship between the model's internal values and the hardware threshold.
Then, reduce the signal to a hardware-readable condition
The model's activations are represented as numbers, and the hardware can inspect parts of that representation. The paper's baseline models use IEEE-754 single-precision floating point. In that representation, a value has a sign bit, exponent bits that encode scale, and a mantissa that carries precision. HAMLOCK does not ask hardware to recompute the network or compare a full activation vector. Depending on the attack variant, it monitors a sign bit or compares exponent fields against thresholds.
This is the critical compression step. The model has done the input-dependent work. Hardware receives a small observation such as “this activation has crossed the relevant boundary.” For a single-neuron setting with a zero threshold, the detector can use a one-bit condition. For a nonzero threshold or a multi-neuron setting, it can compare exponent fields and combine the results. The hardware is not learning whether an image contains a red square or whether a traffic sign has a particular meaning. It is checking whether the model's internal computation has entered a state the attacker prepared.
The multi-neuron condition is naturally expressed as a conjunction. Each monitored activation must exceed its corresponding threshold, and the detector asserts the backdoor condition only when all comparisons succeed. This gives the design a useful balance. A single comparison is cheap but may be noisy. Several comparisons increase the amount of logic, yet make an accidental clean activation less likely. The authors report a default configuration with one trigger neuron in each of three selected layers, but the general principle is a coordinated condition, not a fixed universal count.
The condition also reveals the hidden coupling between model and hardware. The thresholds mean nothing in isolation. They are meaningful only because the altered weights were chosen to produce the expected activation pattern. A hardware inspector who sees a few comparators may not know that the corresponding neurons have been tuned to cross them. A model inspector who sees a small weight change may not know that a physical datapath is watching the resulting bits. The information needed to interpret the signal is split.
Detection and payload are separate jobs
Once the detector asserts the trigger condition, a second hardware component supplies the malicious effect. The paper calls this the payload Trojan. Its job is to bias the output logits—the numerical scores the model assigns to possible classes—so that the attacker's target class wins the final comparison.
Keeping detection and payload separate is more than a naming choice. Detection answers a conditional question: did the internal state match the prepared trigger condition? Payload execution changes the result only after that question is answered yes. In the reported design, the payload injects a bias into the exponent field of a target logit. Amplifying that logit makes it larger than the competing outputs, so the final argmax selects the wrong class.
This arrangement allows the model to carry the complex relationship between input and internal activation while hardware performs only local control and arithmetic modification. It also allows different output policies. The paper evaluates class-agnostic behavior, in which triggered inputs go to one fixed target class. It describes class-specific behavior as a straightforward extension that monitors the original prediction and maps it to a chosen wrong label. The precise implementation details vary, but the security distinction remains: the model does not need to contain the complete target-selection behavior for the hardware to impose one.
The attack can therefore be narrated as a sequence:
For the same triggered input, the sequence stops earlier when the model is run without the compromised detector and payload. The model can still produce ordinary logits and the correct class. The malicious output is not a property of the model's input-output function alone; it is the result of the model's values being observed and acted on by an attached hardware path.
The footprint is small because the computation moved
HAMLOCK's hardware advantage comes from moving complexity into model preparation. A conventional hardware Trojan that recognizes a diverse trigger might need to match input patterns, track internal vectors, or perform substantial sequential computation. HAMLOCK instead tunes the model to expose a few unusually high activations and reduces the hardware task to comparisons, logic gates, and a logit modification.
The authors synthesize their circuits in a 45 nm standard-cell ASIC flow under a timing constraint. Their measurements show why “small” needs to be qualified. In the reported table, the single-neuron variant reaches at most 0.08% area overhead and as much as 1.14% power overhead across the listed architectures. The three-neuron variant reaches at most 0.10% area and 3.39% power overhead, with substantially smaller percentages for larger host designs. The abstract's statement that overhead can be as low as 0.01% describes a lower-bound case, not an upper bound for every model and circuit.
The percentage depends on the host accelerator. A fixed amount of added logic looks larger when the baseline design is aggressively folded or otherwise small. That is why the VGG-16 case has a higher relative power overhead than the larger ResNet-18 case in the table. It is also why low overhead should be treated as a stealth advantage under the paper's assumptions, not as proof that the hardware leaves no measurable trace.
The footprint has another cost: the attack is tied to a representation and a deployment context. A detector designed around sign or exponent fields assumes that those fields are available at the relevant point in the datapath and that quantization or compiler transformations do not destroy the intended signal. The paper evaluates FP32-based baseline models and describes how alignment can be established for fixed-model or reconfigurable accelerators. It does not show that the exact detector transfers unchanged to every lower-precision format, accelerator organization, or compilation pipeline.
What the trade-offs reveal
The model signal, hardware detector, and payload form an optimization with competing goals. Strong activation separation makes detection reliable but may alter clean behavior. More trigger neurons can reduce accidental activation but add hardware comparisons and may lower clean accuracy. A larger payload margin makes the target class more reliably dominant but may make output behavior easier to flag if a defender knows where to look. A hardcoded payload minimizes flexibility and hardware size, while a reconfigurable payload can be updated but adds state and control.
The paper's main design chooses a small, fixed payload and reports strong effectiveness in its selected settings. That is evidence that the division of labor works under the tested conditions. It is not evidence that stealth, reliability, portability, and adaptability are simultaneously free. A defender who changes numerical precision, rewrites the accelerator mapping, validates internal activation distributions, or compares the deployed datapath with an approved model may affect different parts of the attack. Whether those measures work in combination is an open assurance question rather than a result established by the paper.
The most portable lesson is therefore the architectural one. HAMLOCK does not require hardware to understand the full semantics of an input. It only requires hardware to recognize a signal that the model has been shaped to emit. The model supplies a high-level dependency; the hardware supplies a low-level action. Any security analysis that examines only one side risks missing the meaning created between them.
A few altered neurons can be useful to hardware precisely because they do not need to be useful as a complete software backdoor. The next task is to put this sequence back into a whole-system view: which artifact is being examined, which execution context is active, and what evidence can distinguish a dormant signal from a running payload.