Gem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization Framework

Deep Learning (DL) accelerators are widely adopted for their efficiency and cost-effectiveness, and increasingly embedded in robots and autonomous vehicles. Their heterogeneous architectures, however, introduce security threats across the chip lifecycle, and existing exploration tools cover them only partially, especially before deployment. We propose Gem5-Shark , a framework built on Gem5-Aladdin’s Smaug for cycle-level heterogeneous SoC simulation. It integrates eight configurable threat vectors, comprising seven active attacks and one passive Reverse-Engineering (RE) analysis, spanning the dataset integrity , model compilation , System-on-Chip (SoC) communication , and accelerator execution stages. The two compilation-stage attacks, Operator Attack (OPAtt) and Tiling Attack (TAtt), are new to this work and model toolchain compromise, while the remaining vectors adapt prior threat models, unified for the first time in one heterogeneous simulator. Across Minerva, LeNet-5, and VGG-16, Data Poisoning Attacks reduce inference accuracy by up to 97.7%, Tiling Attacks increase accelerator cycles and energy by up to 44% and 56%, respectively, and Operator Attacks drive accuracy to near-random on full test sets with an attack success rate up to 0.93. At the system level, Denial-of-Service and Flit Loss Attacks raise communication latency by up to 30× and memory delays by up to 84×, Data Swapping Attacks flip the prediction once weight tiles are swapped, and False Flag Scheduling Attacks add over 7× latency overhead. The RE analysis recovers convolutional and fully connected structure from finish-flag timing with 0.978 accuracy when the attacker can calibrate against the target, but not per-layer hyperparameters. On pretrained LLMs of up to 8B parameters, as few as 20 poisoned fine-tuning samples implant a backdoor, the finish-flag attack slows a decoder layer by 4.3 ×, and timing reveals the context length. Two defenses, a compiler-stage tiling range check and a host-side finish-flag watchdog, each remove over 99% of the injected overhead on CNNs and LLMs.