Hardware monitor detects errors in edge ai behavior quickly
TERMon: Detecting Persistent Behavioral Threats in Edge AI via Hardware-Native Ternary Runtime Monitor
Cryptography and SecurityArtificial Intelligence
Summary
Edge AI devices control important things like alarms or locks, but problems can happen without anyone noticing because the AI still seems confident. The authors made a tiny hardware tool called TERMon that watches how the AI behaves instead of checking the AI itself step-by-step. It looks for unusual patterns caused by errors or tampering in the AI’s brain (its weights) using a special simple code. They tested this tool on a small FPGA board and it makes decisions very fast without needing complex parts. However, it works best for finding weight corruption and less well for spotting strange or tricky inputs.
What this means in practice
- •For edge ai hardware designers: Add a lightweight hardware monitor that quickly detects harmful changes inside AI models running on edge devices without heavy computational costs.
- •For embedded systems engineers: Use a fast hardware-based tool to detect when AI model behaviors deviate due to corruption in safety-critical edge applications like alarms or access control.
Authors
Arish Sateesan, Edlira Dushku
Abstract
Edge AI accelerators are increasingly deployed in safety-critical environments, where model outputs may control physical actuators, make access-control decisions, or trigger alarms. In these settings, runtime failures often remain undetected because model corruption, distribution shift, and adversarial inputs can still produce well-formed, confident predictions. This paper presents TERMon, a lightweight hardware runtime monitor that detects such anomalies by observing inference behavior rather than re-executing or formally verifying the model. TERMon represents class-conditional trusted behavior as hardware-efficient ternary patterns that are matched in parallel against a thermometer-encoded fingerprint. The ternary encoding reproduces the corresponding unquantized range decision exactly. TERMon detects harmful weight corruptions in proportion to their behavioral impact, while out-of-distribution and adversarial inputs are largely not separable using the monitored features at a strict false-positive operating point. We implemented TERMon on a PYNQ-Z2 FPGA, and the pipelined design requires no on-chip block RAM or DSPs and has a two-cycle decision latency.