Researchers Can Secretly Sabotage AI Chips — And Standard Checks Miss It

A team of computer hardware researchers has published a paper showing how to plant a hidden flaw inside the chips that run artificial intelligence. The technique, which they call FINN-Tro, doesn't touch the AI model itself. Instead, it sneaks the sabotage in during the step where a trained AI is translated into a physical chip design. The result is a chip that looks and runs normally — until it doesn't.

The tool at the center of this is FINN, a widely used open-source framework that converts AI models into designs for FPGAs (chips whose internal wiring can be reprogrammed after manufacturing). FINN assumes the software version of an AI and the chip version behave identically. The researchers showed they don't. They placed a small piece of malicious logic in the network's final layer, where it stays dormant until a hidden counter hits a set number — like a time bomb that only the attacker knows the timer for.

The damage can be severe. Across six configurations tested on a small board called PYNQ-Z1, accuracy dropped anywhere from under 1% to nearly 83%. The worst version cut a digit-recognition model from 93% correct to about 10% — roughly the accuracy of random guessing — and a photo-classification model from 84% to 10%. Critically, the sabotaged chips ran at nearly the same speed and size as normal ones, adding less than 8% extra circuitry.

There are real limits here. This is a lab demonstration on small, older AI models, and it targets one specific toolchain that the attacker must have access to. But the paper's point is bigger: the checks companies use before and after compiling chip designs simply aren't built to catch tricks that only activate later. As AI moves into cars, medical scanners, and factory robots, that blind spot becomes everyone's problem.