HAMLOCK: Split Hardware/Software Neural-Network Backdoor Evading ML Trojan Defenses (arXiv:2510.19145, USENIX Security 2026) — Threadlinqs Intelligence
As of 2026-06-15, HAMLOCK: Split Hardware/Software Neural-Network Backdoor Evading ML Trojan Defenses (arXiv:2510.19145, USENIX Security 2026) is a high-severity research threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0798 · Severity: HIGH · Status: RESEARCH · Category: RESEARCH
HAMLOCK (HArdware-Model LOgically Combined attacK) is an academically disclosed backdoor that distributes a neural-network trojan across the hardware/software boundary: software tunes the weights of
HAMLOCK is a cross-layer (hardware + software) backdoor against deep neural networks deployed on third-party hardware accelerators (FPGAs/ASICs) for edge AI. It was disclosed by researchers from the University of Tennessee and the University of Florida (Sanskar Amgain, Daniel Lobo, Atri Chatterjee, Swarup Bhunia, Fnu Suya) in arXiv:2510.19145 (submitted 22 Oct 2025, latest revision 16 Mar 2026) and accepted to USENIX Security 2026. As of disclosure there is no CVE, no CVSS, no observed in-the-wild exploitation, and no network infrastructure — this is a published academic proof-of-concept with public code, tracked as a supply-chain risk to ML hardware.
Novelty / threat model: Conventional model-level backdoors embed the entire misclassification logic inside the model weights, leaving a traceable layer-by-layer activation path that defenders can recover (e.g., Neural Cleanse reverse-engineers the trigger; MNTD trains a meta-classifier to spot trojaned models). HAMLOCK breaks this assumption by splitting the attack: the SOFTWARE half is functionally benign and contains NO misclassification logic — it only tunes a few neurons so that, when an attacker's trigger (e.g., a small square pixel patch) is present, those neurons produce uniquely high activation magnitudes. Without the malicious hardware present the attack success rate is near zero (<=0.6%), so the model passes every software-side audit.
Hardware payload: The accelerator hosts two cooperating hardware Trojans (HTs). The Trigger HT continuously watches the chosen neurons' activations and fires when it sees the tell-tale magnitude — implemented cheaply by monitoring just the most significant bit (the sign bit) or the 8-bit exponent field of the floating-point activation, rather than full-precision comparison. When the Trigger HT fires, it signals the Payload HT, which injects a large bias (reported as ~1.1 x z_max, the max logit) into the target class's output logit/exponent field, deterministically forcing the attacker-chosen misclassification.
Variants: A single-neuron variant zeroes weights where a mask is zero on one (often first-layer) neuron and achieves ~100% attack success across all four datasets when the hardware is present. A multi-neuron variant spreads the trigger across several 'safe' neurons in random layers for added stealth, achieving mid-90s success while keeping clean-image accuracy drop negligible.
Evaluation: Tested on four datasets (MNIST, CIFAR-10, GTSRB, ImageNet) and three architectures (LeNet, VGG-16, ResNet-18). With the trojaned hardware present the attack reaches ~100% misclassification on triggered inputs; clean-input accuracy is essentially unchanged. Against defenses HAMLOCK circumvents state-of-the-art model-level detection without any adaptive optimization: Neural Cleanse and MNTD show 0% detection, runtime/sample detectors STRIP, IBD-PSC, TED and BBCAL produce AUCs near 0.5 (random guessing), and fine-tuning / fine-pruning leave 100% ASR intact. Crucially, the identical square trigger planted with an ordinary software-only backdoor is caught by these same tools almost every time — the stealth comes entirely from moving the decision logic into silicon.
Hardware cost: Synthesized hardware overhead is tiny — area capped at ~0.1% (a 'tenth of a percent at most'), with power overhead reported as 3.4% for VGG-16 down to 0.05% for LeNet; on a modern (e.g., 45nm-class) process the added area disappears into normal manufacturing variation, defeating side-channel / area-based HT detection.
Defensive implication: Software-only model vetting is insufficient when the inference accelerator is untrusted. Co-author Swarup Bhunia recommends runtime monitoring for anomalies by tracking internal model behavior; the authors call broadly for new cross-layer defenses spanning the model and the silicon. Practical mitigations center on hardware supply-chain assurance for ML accelerators, runtime activation-distribution monitoring (flag neurons whose activati
Weaknesses (CWE)
CWE-1191, CWE-1263, CWE-506, CWE-1357
Target sectors: technology, manufacturing, automotive, defense, critical-infrastructure, iot-edge-ai, semiconductor
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RESEARCH, HIGH, threat intelligence, cybersecurity, T1587, T1588, T1195, T1195, T1542, T1562, T1553, T1129, T1565, AML.T0010