Backdoor Attack on Deep Neural Networks Triggered by Fault Injection Attack on Image Sensor Interface.

A backdoor attack is a type of attack method that induces deep neural network (DNN) misclassification. The adversary who aims to trigger the backdoor attack inputs the image with a specific pattern (the adversarial mark) into the DNN model (backdoor model). In general, the adversary mark is created on the physical object input to an image by capturing a photo. With this conventional method, the success of the backdoor attack is not stable because the size and position change depending on the shooting environment. So far, we have proposed a method of creating an adversarial mark for triggering backdoor attacks by means of a fault injection attack on the mobile industry processor interface (MIPI), which is the image sensor interface. We propose the image tampering model, with which the adversarial mark can be generated in the actual fault injection to create the adversarial mark pattern. Then, the backdoor model was trained with poison data images, which the proposed simulation model created. We conducted a backdoor attack experiment using a backdoor model trained on a dataset containing 5% poison data. The clean data accuracy in normal operation was 91%; nevertheless, the attack success rate with fault injection was 83%.

An Area-Efficient up/down Double-Sampling Circuit for a LOFIC CMOS Image Sensor.

A lateral overflow integration capacitor (LOFIC) complementary metal oxide semiconductor (CMOS) image sensor can realize high-dynamic-range (HDR) imaging with combination of a low-conversion-gain (LCG) signal for large maximum signal electrons and a high-conversion-gain (HCG) signal for electron-referred noise floor. However, LOFIC-CMOS image sensor requires a two-channel read-out chain for LCG and HCG signals whose polarities are inverted. In order to provide an area-efficient LOFIC-CMOS image sensor, a one-channel read-out chain that can process both HCG and LCG signals is presented in this paper. An up/down double-sampling circuit composed of an inverting amplifier for HCG signals and a non-inverting attenuator for LCG signals can reduce the area of the read-out chain by half compared to the conventional two-channel read-out chain. A test chip is fabricated in a 0.18 µm CMOS process with a metal-insulator-metal (MIM) capacitor, achieving a readout noise of 130 µVrms for the HCG signal and 1.19 V for the LCG input window. The performance is equivalent to 103 dB of the dynamic range with our previous LOFIC pixel in which HCG and LCG conversion gains are, respectively, 160 µV/e- and 10 µV/e-.

Area-Efficient Post-Processing Circuits for Physically Unclonable Function with 2-Mpixel CMOS Image Sensor.

In order to realize image information security starting from the data source, challenge-response (CR) device authentication, based on a Physically Unclonable Function (PUF) with a 2 Mpixel CMOS image sensor (CIS), is studied, in which variation of the transistor in the pixel array is utilized. As each CR pair can be used only once to make the CIS PUF resistant to the modeling attack, CR authentication with CIS can be carried out 4050 times, with basic post-processing to generate the PUF ID. If a larger number of authentications is required, advanced post-processing using Lehmer encoding can be utilized to carry out authentication 14,858 times. According to the PUF performance evaluation, the authentication error rate is less than 0.001 ppm. Furthermore, the area overhead of the CIS chip for the basic and advanced post-processing is only 1% and 2%, respectively, based on a Verilog HDL model circuit design.

A 120-ke- Full-Well Capacity 160-µV/e- Conversion Gain 2.8-µm Backside-Illuminated Pixel with a Lateral Overflow Integration Capacitor.

In this paper, a prototype complementary metal-oxide-semiconductor (CMOS) image sensor with a 2.8-µm backside-illuminated (BSI) pixel with a lateral overflow integration capacitor (LOFIC) architecture is presented. The pixel was capable of a high conversion gain readout with 160 µV/e- for low light signals while a large full-well capacity of 120 ke- was obtained for high light signals. The combination of LOFIC and the BSI technology allowed for high optical performance without degradation caused by extra devices for the LOFIC structure. The sensor realized a 70% peak quantum efficiency with a normal (no anti-reflection coating) cover glass and a 91% angular response at ±20° incident light. This 2.8-µm pixel is potentially capable of higher than 100 dB dynamic range imaging in a pure single exposure operation.

An Over 90 dB Intra-Scene Single-Exposure Dynamic Range CMOS Image Sensor Using a 3.0 µm Triple-Gain Pixel Fabricated in a Standard BSI Process.

To respond to the high demand for high dynamic range imaging suitable for moving objects with few artifacts, we have developed a single-exposure dynamic range image sensor by introducing a triple-gain pixel and a low noise dual-gain readout circuit. The developed 3 µm pixel is capable of having three conversion gains. Introducing a new split-pinned photodiode structure, linear full well reaches 40 ke-. Readout noise under the highest pixel gain condition is 1 e- with a low noise readout circuit. Merging two signals, one with high pixel gain and high analog gain, and the other with low pixel gain and low analog gain, a single exposure dynamic rage (SEHDR) signal is obtained. Using this technology, a 1/2.7", 2M-pixel CMOS image sensor has been developed and characterized. The image sensor also employs an on-chip linearization function, yielding a 16-bit linear signal at 60 fps, and an intra-scene dynamic range of higher than 90 dB was successfully demonstrated. This SEHDR approach inherently mitigates the artifacts from moving objects or time-varying light sources that can appear in the multiple exposure high dynamic range (MEHDR) approach.