{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2609.26824",
  "title": "FINN-Tro: Exploiting Verification Gaps in Dataflow Inference Accelerators",
  "summary": "The technique does not replace any production method; it is an attack demonstrating that standard pre- and post-compilation equivalence checks in the FINN FPGA toolchain fail to detect a counter-triggered Trojan inserted into the last MVAU layer, with six trigger/payload configurations. On the attack side it costs little: throughput and runtime remain near baseline and overhead is at most 6.71% LUTs and 7.49% FFs, while accuracy drops range from 0.90% to 82.84%, with persistent bias addition collapsing MNIST from 92.96% to 10.12% and CIFAR-10 from 84.19% to 10.00%. For a defender, the failure mode is adopting FINN-synthesized accelerators without bitstream-level or runtime differential verification, leaving temporally delayed manipulations undetectable by existing flows.",
  "rationale": "The reader deploys on a single GPU or third-party APIs rather than FPGA dataflow accelerators via FINN, so the threat is relevant context for supply-chain awareness but demands no immediate production change.",
  "technique": "FINN compilation-pipeline hardware Trojan attack",
  "family": "seguranca_e_guardrails",
  "recommendation": "observar",
  "published": "2026-09-20",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2609.26824",
  "independent_implementations": 0,
  "total_implementations": 0,
  "stars": 0,
  "citations": 0,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "The technique does not replace any production method; it is an attack demonstrating that standard pre- and post-compilation equivalence checks in the FINN FPGA toolchain fail to detect a counter-triggered Trojan inserted into the last MVAU layer, with six trigger/payload configurations. On the attack side it costs little: throughput and runtime remain near baseline and overhead is at most 6.71% LUTs and 7.49% FFs, while accuracy drops range from 0.90% to 82.84%, with persistent bias addition collapsing MNIST from 92.96% to 10.12% and CIFAR-10 from 84.19% to 10.00%. For a defender, the failure mode is adopting FINN-synthesized accelerators without bitstream-level or runtime differential verification, leaving temporally delayed manipulations undetectable by existing flows.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2609.26824",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}