Engineers often speed things up using hardware that reduces the need to move so much data back and forth. While these machine-learning accelerators can streamline computation, they are susceptible to attackers who can steal secret information.

To reduce this vulnerability, researchers from MIT and the MIT-IBM Watson AI Lab created a machine-learning accelerator that is resistant to the two most common types of attacks. Their chip can keep a user’s health records, financial information, or other sensitive data private while still enabling huge AI models to run efficiently on devices.

The team developed several optimizations that enable strong security while only slightly slowing the device. Moreover, the added security does not impact the accuracy of computations. This machine-learning accelerator could be particularly beneficial for demanding AI applications like augmented and virtual reality or autonomous driving.

While implementing the chip would make a device slightly more expensive and less energy-efficient, that is sometimes a worthwhile price to pay for security, says lead author Maitreyi Ashok, an electrical engineering and computer science (EECS) graduate student at MIT.

“It is important to design with security in mind from the ground up. If you are trying to add even a minimal amount of security after a system has been designed, it is prohibitively expensive. We were able to effectively balance a lot of these tradeoffs during the design phase,” says Ashok.

Her co-authors include Saurav Maji, an EECS graduate student; Xin Zhang and John Cohn of the MIT-IBM Watson AI Lab; and senior author Anantha Chandrakasan, MIT’s chief innovation and strategy officer, dean of the School of Engineering, and the Vannevar Bush Professor of EECS. The research will be presented at the IEEE Custom Integrated Circuits Conference.

Side-channel susceptibility

The researchers targeted a type of machine-learning accelerator called digital in-memory compute. A digital IMC chip performs computations inside a device’s memory, where pieces of a machine-learning model are stored after being moved over from a central server.

The entire model is too big to store on the device, but by breaking it into pieces and reusing those pieces as much as possible, IMC chips reduce the amount of data that must be moved back and forth.

But IMC chips can be susceptible to hackers. In a side-channel attack, a hacker monitors the chip’s power consumption and uses statistical techniques to reverse-engineer data as the chip computes. In a bus-probing attack, the hacker can steal bits of the model and dataset by probing the communication between the accelerator and the off-chip memory.

Digital IMC speeds computation by performing millions of operations at once, but this complexity makes it tough to prevent attacks using traditional security measures, Ashok says.

She and her collaborators took a three-pronged approach to blocking side-channel and bus-probing attacks.

First, they employed a security measure where data in the IMC are split into random pieces. For instance, a bit zero might be split into three bits that still equal zero after a logical operation. The IMC never computes with all pieces in the same operation, so a side-channel attack could never reconstruct the real information.

But for this technique to work, random bits must be added to split the data. Because digital IMC performs millions of operations at once, generating so many random bits would involve too much computing. For their chip, the researchers found a way to simplify computations, making it easier to effectively split data while eliminating the need for random bits.

Second, they prevented bus-probing attacks using a lightweight cipher that encrypts the model stored in off-chip memory. This lightweight cipher only requires simple computations. In addition, they only decrypted the pieces of the model stored on the chip when necessary.

Third, to improve security, they generated the key that decrypts the cipher directly on the chip, rather than moving it back and forth with the model. They generated this unique key from random variations in the chip that are introduced during manufacturing, using what is known as a physically unclonable function.

“Maybe one wire is going to be a little bit thicker than another. We can use these variations to get zeros and ones out of a circuit. For every chip, we can get a random key that should be consistent because these random properties shouldn’t change significantly over time,” Ashok explains.

They reused the memory cells on the chip, leveraging the imperfections in these cells to generate the key. This requires less computation than generating a key from scratch.

“As security has become a critical issue in the design of edge devices, there is a need to develop a complete system stack focusing on secure operation. This work focuses on security for machine-learning workloads and describes a digital processor that uses cross-cutting optimization. It incorporates encrypted data access between memory and processor, approaches to preventing side-channel attacks using randomization, and exploiting variability to generate unique codes. Such designs are going to be critical in future mobile devices,” says Chandrakasan.

Safety testing

To test their chip, the researchers took on the role of hackers and tried to steal secret information using side-channel and bus-probing attacks.

Even after making millions of attempts, they couldn’t reconstruct any real information or extract pieces of the model or dataset. The cipher also remained unbreakable. By contrast, it took only about 5,000 samples to steal information from an unprotected chip.

The addition of security did reduce the energy efficiency of the accelerator, and it also required a larger chip area, which would make it more expensive to fabricate.

The team is planning to explore methods that could reduce the energy consumption and size of their chip in the future, which would make it easier to implement at scale.

“As it becomes too expensive, it becomes harder to convince someone that security is critical. Future work could explore these tradeoffs. Maybe we could make it a little less secure but easier to implement and less expensive,” Ashok says.

The research is funded, in part, by the MIT-IBM Watson AI Lab, the National Science Foundation, and a Mathworks Engineering Fellowship.

The research, published April 16 as a Reviewed Preprint in eLife, is described by editors as an important study with convincing findings of potential interest to the fields of veterinary medicine, public health and epidemiology.

Loss of livestock through abortion is a major concern for the worldwide livestock industry, resulting in significant economic loss and posing a direct threat to public health through transmission of infection. The impact of livestock abortion on the world’s poorest livestock keepers is likely to be substantial — from the direct loss of high-quality food sources and reduced income from sales of milk or meat.

“Effective livestock health surveillance provides critical data for evidence-based approaches to disease control and management, but requires reliable, high-quality and timely data drawn from multiple sources,” says lead author Felix Lankester, Clinical Associate Professor at the Paul G. Allen School for Global Health, Washington State University, Washington, US, and the Global Animal Health Tanzania, Arusha, Tanzania. “Event-based surveillance can detect early events that signal emerging human health risks, and surveillance of livestock abortion events has clear potential for identifying and preventing outbreaks of emerging diseases. However, there is limited information on the current practices, effectiveness and challenges of livestock abortion surveillance, particularly in low and middle-income countries.”

To address this gap, researchers set up a pilot livestock surveillance system in northern Tanzania in 15 wards across five districts, with a mix of pastoral, agropastoral and smallholder livestock keepers. Livestock field officers (LFOs; government employees equivalent to para-veterinarians) received training on the safe investigation of livestock abortion and were requested to report any incidents of abortions, stillbirths and perinatal death. If the cases could be followed up within 72 hours of the abortion event, further investigation including blood, milk and vaginal swabs were collected from the aborting dam, alongside tissue and swab samples from the foetus and placenta. These were tested for a wide range of infectious agents and antibodies.

Between 2017 and 2019, 215 abortion cases were reported from 150 households in 13 of the 15 wards. Of these 215 cases, 70% were reported by three (20%) of the LFOs. Most abortions were investigated within two days, and none were investigated more than four days later. Placental and foetal tissues were only collected in 24% and 34% of cases, respectively, often because these tissues were not found, but vaginal and milk samples were collected in 99% and 78% of cases.

Although data was only available for a limited number of abortions, the results revealed important insights into likely patterns and causes. For example, abortions occurred more often in the dry season, and in non-indigenous cross-bred or exotic animals than in indigenous breeds. More than a fifth of dams that aborted were reported to have experienced a previous abortion, with several experiencing multiple abortion losses, which may suggest that animals suffering recurrent abortion events may have a chronic infection that would warrant their removal from breeding stock or prevent their use as a food source.

The study emphasises the potential risks of exposure to zoonotic pathogens — infectious agents that could potentially jump from livestock to humans. In cases where an infectious agent was detected, 79% were zoonotic, and in nearly a quarter of these cases, someone had assisted with the aborted delivery, likely without any personal protective equipment. Of these, 20% were female and of reproductive age, and therefore of heightened risk from certain pathogens.

“Our study has demonstrated that livestock abortion surveillance, even at a relatively small scale, can capture valuable information about livestock pathogens, including those that are zoonotic,” says senior author Sarah Cleaveland, Professor of Comparative Epidemiology at the School of Biodiversity, One Health & Veterinary Medicine, University of Glasgow, UK. “Moreover, our pilot demonstrates the utility and feasibility of livestock abortion surveillance in rural areas and highlights that engaging field officers, establishing practical and robust field sample collections and ensuring prompt reporting of cases and feedback of results are key elements of effectiveness.”

Plants that contain these alkaloids have made it very clear they don’t want to be consumed, but that hasn’t deterred bella moths (Utetheisa ornatrix). These day-flying moths exclusively eat the alkaloid-laden leaves and seeds of rattlebox plants. They then use the toxin to guard their eggs and deter predators in later life stages. They even use it to make pheromones that attract mates.

Exactly how bella moths and related species evolved the ability to safely consume pyrrolizidine alkaloids remains unknown.

In a new study published in the journal PNAS, researchers sequence the bella moth genome, which they used to pinpoint specific genes that may confer immunity to these toxins. They also sequenced genomes from 150 museum specimens — some more than a century old — to determine where bella moths and their close relatives originated. Finally, they combed through genetic data looking for clues that could help explain how the intricate wing patterns of bella moths evolved over time — the first study on moths or butterflies that has done so using dry museum collection specimens.

“We’ve managed to show that you can use museum specimens to answer genetic questions that normally require complicated laboratory techniques,” said study co-author Andrei Sourakov, collections coordinator at the Florida Museum of Natural History’s McGuire Center for Lepidoptera and Biodiversity. “This opens a window for future research of this kind.”

Sourakov has been studying bella moths for 15 years and said sequencing the genome for this species was the natural next step in the research he’s conducted so far. Many of the insights he gained during that time came from his work with undergraduate and high school students, whom he helped conduct short experiments, analyze data for science fairs and interpret the results in peer-reviewed papers.

In one such project, a student set out to determine the average lifespan of bella moth adults and inadvertently stumbled across the Methuselah of the moth world. “To our great surprise, they can live for up to 50 days, which is four to five times longer than the average moth,” Sourakov said.

Longevity is not a critically important trait in most moth species. Many breed once, then die shortly after, either from senescence or predation. But bella moths aren’t limited by the latter, making it more likely that genes conferring increased longevity will be beneficial and passed down to the next generation.

“It makes sense for something that’s chemically defended to live longer, because even if they’re caught, the predator most often lets go, and the moth can continue flying around.”

Bella moths live throughout much of eastern North America, Central America and the Caribbean and are often active during the day. Rather than using darkness as a shroud to avoid predators, bella moths make a point of being seen. Their wings are garbed with radiant pink, pearl, onyx and sulfur yellow scales, which birds and carnivorous insects can easily spot from a distance. Any predator unlucky enough to catch a bella moth quickly corrects its mistake.

“Banana spiders will cut them out of their webs,” Sourakov said, adding that wolf spiders and birds will go out of their way to avoid them. “When caught, they produce foaming liquid that tastes bad made almost entirely out of alkaloids.”

When ready to mate, females release a plume of aerosolized alkaloids derived from the plants they ate as caterpillars. Males are attracted to this scent, which they follow to its source. There, they perform a short but elaborate ritual in which they gently touch the female’s head with two fluffy and retractable structures that bear a strong resemblance to dandelions. Each filament in these structures is laced with pyrrolizidine alkaloids.

If the female decides the male has a sufficient quantity and quality of alkaloids stored up, the pair will mate. When finished, the male leaves behind a parting gift called a spermataphore, which contains sperm and, yes, more alkaloids. The female will use this and alkaloids from her own reserve to infuse the resulting eggs with toxins. This sort of biparental egg protection in insects is rare. In fact, when it was first observed in 1989 among bella moth adults, it was the only known example of a male moth or butterfly that invested any chemical resources in its progeny.

Bella moths are able to avoid the ill effects of pyrrolizidine alkaloids by using a special enzyme that oxidizes the molecule, rendering it harmless. If a predator eats a moth, however, the process is reversed, and the alkaloid regains its potency.

Pyrrolizidine alkaloids likely first evolved as a defense mechanism in plants, which then became a commodity for moths. Sourakov and his colleagues wanted to know how bella moths acquired this detoxifying enzyme and how they maintained it through an arms race millions of years long between plant and moth.

The authors discovered bella moths have not one but two copies of the gene that codes for their unique detoxifying enzyme. They may have acquired the second through a process of gene duplication, whereby other species, including many plants, have evolved new traits.

They also found two copies of a gene partially involved in antioxidant production and defense. Sourakov suspects these genes may be related both to the ability of bella moths to detoxify alkaloids and to their remarkable longevity.

“Certain types of stress on biological systems result in a longer lifespan. It could be that the interaction bella moths have with alkaloids is not only the reason why it makes sense for them to live long lives, but also one of the mechanisms behind it.”

AI models learn how to carry out such tasks by using a set of data that are annotated by humans, but the process of distinguishing cells from their background, called “single-cell segmentation,” is both time-consuming and laborious. As a result, there are limited amount of annotated data to use in AI training sets. UC Santa Cruz researchers have developed a method to solve this by building a microscopy image generation AI model to create realistic images of single cells, which are then used as “synthetic data” to train an AI model to better carry out single cell-segmentation.

The new software is described in a new paper published in the journal iScience. The project was led by Assistant Professor of Biomolecular Engineering Ali Shariati and his graduate student Abolfazl Zargari. The model, called cGAN-Seg, is freely available on GitHub.

“The images that come out of our model are ready to be used to train segmentation models,” Shariati said. “In a sense we are doing microscopy without a microscope, in that we are able to generate images that are very close to real images of cells in terms of the morphological details of the single cell. The beauty of it is that when they come out of the model, they are already annotated and labeled. The images show a ton of similarities to real images, which then allows us to generate new scenarios that have not been seen by our model during the training.”

Images of individual cells seen through a microscope can help scientists learn about cell behavior and dynamics over time, improve disease detection, and find new medicines. Subcellular details such as texture can help researchers answer important questions, like if a cell is cancerous or not.

Manually finding and labeling the boundaries of cells from their background is extremely difficult, however, especially in tissue samples where there are many cells in an image. It could take researchers several days to manually perform cell segmentation on just 100 microscopy images.

Deep learning can speed up this process, but an initial data set of annotated images is needed to train the models — at least thousands of images are needed as a baseline to train an accurate deep learning model. Even if the researchers can find and annotate 1,000 images, those images may not contain the variation of features that appear across different experimental conditions.

“You want to show your deep learning model works across different samples with different cell types and different image qualities,” Zargari said. “For example if you train your model with high quality images, it’s not going to be able to segment the low quality cell images. We can rarely find such a good data set in the microscopy field.”

To address this issue, the researchers created an image-to-image generative AI model that takes a limited set of annotated, labeled cell images and generates more, introducing more intricate and varied subcellular features and structures to create a diverse set of “synthetic” images. Notably, they can generate annotated images with a high density of cells, which are especially difficult to annotate by hand and are especially relevant for studying tissues. This technique works to process and generate images of different cell types as well as different imaging modalities, such as those taken using fluorescence or histological staining.

Zargari, who led the development of the generative model, employed a commonly used AI algorithm called a “cycle generative adversarial network” for creating realistic images. The generative model is enhanced with so-called “augmentation functions” and a “style injecting network,” which helps the generator to create a wide variety of high quality synthetic images that show different possibilities for what the cells could look like. To the researchers’ knowledge, this is the first time style injecting techniques have been used in this context.

Then, this diverse set of synthetic images created by the generator are used to train a model to accurately carry out cell segmentation on new, real images taken during experiments.

“Using a limited data set, we can train a good generative model. Using that generative model, we are able to generate a more diverse and larger set of annotated, synthetic images. Using the generated synthetic images we can train a good segmentation model — that is the main idea,” Zagari said.

The researchers compared the results of their model using synthetic training data to more traditional methods of training AI to carry out cell segmentation across different types of cells. They found that their model produces significantly improved segmentation compared to models trained with conventional, limited training data. This confirms to the researchers that providing a more diverse dataset during training of the segmentation model improves performance.

Through these enhanced segmentation capabilities, the researchers will be able to better detect cells and study variability between individual cells, especially among stem cells. In the future, the researchers hope to use the technology they have developed to move beyond still images to generate videos, which can help them pinpoint which factors influence the fate of a cell early in its life and predict their future.

“We are generating synthetic images that can also be turned into a time lapse movie, where we can generate the unseen future of cells,” Shariati said. “With that, we want to see if we are able to predict the future states of a cell, like if the cell is going to grow, migrate, differentiate or divide.”