# TPUTrap: Hardware-Based USB Man-in-the-Middle Attack on Coral Edge TPU

S. Niang, J. Lorandel, Christophe Moy

<figure><img src="image_1.png" /></figure>

To cite this version:

S. Niang, J. Lorandel, Christophe Moy. TPUTrap: Hardware-Based USB Man-in-the-Middle Attack on Coral Edge TPU. IEEE Embedded Systems Letters, 2026, pp.1-1. 10.1109/LES.2026.3655031. hal-05466567

HAL Id: hal-05466567

https://hal.science/hal-05466567v1

Submitted on 20 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# TPUTrap: Hardware-Based USB Man-in-the-Middle
## Attack on Coral Edge TPU

S. O. Niang, J. Lorandel and C. Moy

Univ Rennes, CNRS, IETR UMR 6164, F-35000, Rennes, France
seydina-oumar.niang@univ-rennes.fr

***Abstract***—AI-based hardware accelerators, such as the Coral USB Accelerator, enable the use of AI in embedded systems without relying on the cloud, offering advantages like low latency, reduced power consumption, and enhanced privacy. It connects to the host via USB, which lacks encryption and authentication checks, raising security concerns in critical applications. This paper demonstrates a man-in-the-middle attack on the Coral USB Accelerator’s USB interface, utilizing a Raspberry Pi 5 and a USB Proxy for real-time interception and manipulation of USB traffic. This approach successfully exfiltrated sensitive data and caused misclassification. Despite an added latency overhead, all attacks achieved 100% success, underscoring the need to address this security issue.

***Index Terms***—Man-in-the-Middle Attack, USB Proxy, Inference Tampering, Edge TPU, Edge AI, Reverse Engineering

## I. INTRODUCTION

Artificial Intelligence (AI) is now utilized in numerous applications, including critical fields such as healthcare, industry, and finance. Most of these applications rely on cloud servers to perform the heavy computations that deep neural networks (DNNs) require. Now, edge AI-based hardware accelerators (such as Google’s Coral Edge TPUs [1]) make it possible to bring the power of AI to embedded systems without relying on cloud servers. Deploying DNNs on edge devices has many advantages [2], including low latency, low power consumption, and enhanced privacy. These accelerators act as co-processors that offload computationally intensive tasks from the host CPU. The USB interface is one of the communication interfaces (alongside PCIe) that they usually use to communicate with the host. However, all have been shown to be vulnerable, whether it is the interface they expose to the host [3] or the deep neural networks they run [2]. Given these works and the fact that AI accelerators are used in critical areas, it is essential to assess their security.

This paper addresses this security gap by demonstrating a man-in-the-middle (MITM) attack targeting the USB interface of Google’s Coral USB Accelerator [1] using a low-cost, easy-to-set-up hardware platform. As illustrated in Figure 1, the attack involves intercepting and manipulating USB traffic during the inference process to extract sensitive information or compromise the integrity of the inference results. The following sections outline the target device before diving into the threat model, proposed approach, and key findings that demonstrate its effectiveness.

This study is partially funded by the ANR within the framework of the PIA EUR CyberSchool project (ANR-18-EURE-0004) and the CMA CyberSkill4All project (ANR-23-CMAS-0026).

<figure><img src="image_3.png" /><figcaption>Fig. 1. Hardware Man-in-the-Middle Attack on Coral USB Accelerator using a Raspberry Pi 5.</figcaption></figure>

## II. TARGET DEVICE

The Coral USB Accelerator belongs to the category of Coral products [1] that cannot operate as a standalone device. Compatible with any host system that has a USB port and supports its software stack, the device features the Edge Tensor Processing Unit (TPU), Google’s edge version of its cloud TPU [4]. This device incorporates a custom ASIC that employs a systolic array of processing elements in a 2D grid [5]. Each processing element (PE) functions as a simple processing unit, executing a multiply-accumulate operation in parallel with other PEs. Partial results are efficiently transferred directly between PEs, optimizing data flow and minimizing memory access. Additionally, the Edge TPU is equipped with 8MB of SRAM for caching model parameters [1].

A typical inference process involves the following steps: loading model parameters into the Edge TPU’s SRAM, sending input data to the Edge TPU, performing inference, and returning results to the host system, as illustrated in Fig. 2.

## III. LITERATURE REVIEW

To the best of our knowledge, the USB interface of the Edge TPU was not subject to attack. However, studies have demonstrated vulnerabilities by targeting other aspects of the device. In particular, a framework for extracting neural network hyperparameters from the Edge TPU using electromagnetic side-channel attacks was introduced by Kurian et al. [6]. Their method involves generating side-channel templates for all possible layer configurations at runtime and correlating them layer-wise with the victim trace to identify the hyperparameters. The second study [5] is not an attack, but rather a characterization of an error that may arise when the Edge TPU is used in space applications. The authors highlighted how space radiation can corrupt model parameters stored in the device’s SRAM, leading to persistent errors in the inference results over time. More broadly, vulnerabilities can also exist at the architectural level. Arjun et al. [7] [8] have classified the structural hardware faults in individual processing elements of AI accelerators that are based on systolic arrays (such as the Edge TPU), as either functionally critical (meaning they cause
significant degradation in a Deep Neural Network's inference accuracy) or benign.

When it comes to hardware-based MitM attacks targeting Edge AI in general, a method named "PCB" to generate Universal Adversarial Perturbations on the image transmitted from a USB camera before it reaches the host system was proposed by Wu et al. [3] to deceive an object detection system in real-time. Similarly, Liu et al. [9] explored a MitM attack targeting the MIPI interface of an image sensor. In their approach, they too injected adversarial perturbations into the image data before it reached the host system, which relies on the Intel Neural Compute Stick 2 for inference.

These studies [3] [9] are the closest to the approach presented in this paper. However, several differences can be observed. First, in both cases, the MitM attack is performed between the host and the input data source, while the approach presented here is performed between the host and the accelerator. Second, the previous attacks targeted only the input data, whereas this method enables access to input data, model parameters, and inference results. Lastly, the former studies are restricted to a specific input data type, while this approach applies to any input data compatible with the Edge TPU. This versatility provides a significant advantage, enabling a broader range of attack scenarios, including those presented in [3] and [9].

# IV. MAN-IN-THE-MIDDLE ATTACK ON USB BUS

## A. Threat Model

The targeted system is assumed to be an AI-based automated quality control (AQC) station in a factory. The two parties of interest are the AQC host computer and the Coral USB Accelerator connected to it via a physical USB cable. The host runs the application that offloads machine learning inference tasks to the Coral USB Accelerator, which, in turn, performs defect detection on image data.

Regarding trust boundaries, the host and its internal components, as well as the Coral USB Accelerator, are considered trusted and not compromised. However, the communication channel between the two parties is considered untrusted, meaning that it could be eavesdropped on by an attacker. The same applies to the physical environment where the target system is located, as it may be accessible to a malicious actor.

For the attack surface, the communication channel is the critical part that creates the entry point for the adversary. From it, the adversary gets access to the USB traffic. The vulnerabilities exploited by the adversary include the lack of physical authentication on the USB interface, the absence of encryption on the USB traffic, and the implicit trust that the host's software places in the data coming from the Coral USB Accelerator.

As for the adversary's goals, two are considered: theft of sensitive information and intellectual property, along with industrial sabotage. About their profile, they are assumed to be an actor who has legitimate (or not) temporary physical access to the location of the target system, such as a third-party maintenance technician, a member of the nightly cleaning crew, a disgruntled employee, or an outside individual with

social engineering and physical penetration skills. It is also possible for a non-technical accomplice to implant the device on his behalf.

To successfully execute the attack, the adversary must possess technical skills that include understanding USB functionality, knowing how to use the USBProxy framework [10], and having a basic knowledge of machine learning, particularly image classification. Additionally, the adversary needs to comprehend how raw bytes of the USB traffic between the two parties are structured, as well as the model's output.

Regarding the attack's deployment, it is not fully remote as the insertion phase (less than 30 seconds) requires physical access to the target system. The host is assumed, during that phase, not to invoke the Coral USB Accelerator, and for at least the duration it takes for the Raspberry Pi to boot and run the malicious program (approximately 25 seconds). However, the adversary is assumed to have the capability to execute the attack and exfiltrate data remotely once their malicious device is in place. It is also assumed that the attack can be configured to launch automatically upon the device powering on. Additionally, the latency introduced is also assumed not to violate the timing constraint of the target system, thus maintaining its regular operation.

## B. Methodology

Our approach involves the use of a Raspberry Pi 5 with USB Proxy [10], an open-source software project that supports USB proxying and includes options for performing man-in-the-middle attacks. The Coral USB Accelerator is connected to the Raspberry Pi 5 via one of its USB-A ports, while the USB-C port, which is compatible with USB On-The-Go (OTG), is connected to the host. USB OTG is an extension of the USB standard that allows devices to function as either a host or a peripheral. In this setup, the Raspberry Pi 5 acts as a typical host from the perspective of the Coral USB Accelerator, while it acts as a peripheral from the host's viewpoint. Initially, the product ID, vendor ID, and all descriptors of the Coral USB Accelerator are retrieved by the Raspberry Pi 5. It then presents itself as the Coral USB Accelerator to the host, and all traffic between the two devices is forwarded.

To ensure persistence, the core attack logic is configured to launch automatically at boot time using a systemd service. This ensures the attack is active as soon as the device is powered on. For remote operation, we pre-configured a Wi-Fi

<figure><img src="image_4.png" /><figcaption>Fig. 2. Data exfiltration scenarios where model parameters, input data, and inference results are copied before being forwarded.</figcaption></figure>
<table><caption>TABLE I
BASELINE (NO ATTACK) RESULTS</caption><thead><tr><th>Input Image</th><th>State</th><th>MobileNetV2</th><th>InceptionV1</th><th>EfficientNetS</th></tr></thead><tbody><tr><td rowspan="3">parrot.jpg</td><td>Latency</td><td>4.5 ms</td><td>5.5 ms</td><td>8.8 ms</td></tr><tr><td>Score</td><td>0.9961</td><td>0.9961</td><td>0.8711</td></tr><tr><td><strong>Class</strong></td><td><strong>macaw</strong></td><td><strong>macaw</strong></td><td><strong>macaw</strong></td></tr><tr><td rowspan="3">hot_dog.jpg</td><td>Latency</td><td>4.6ms</td><td>5.5ms</td><td>8.9ms</td></tr><tr><td>Score</td><td>0.9297</td><td>0.8711</td><td>0.9297</td></tr><tr><td><strong>Class</strong></td><td><strong>hotdog</strong></td><td><strong>hotdog</strong></td><td><strong>hotdog</strong></td></tr><tr><td rowspan="3">clock.jpg</td><td>Latency</td><td>4.6ms</td><td>5.4ms</td><td>8.8ms</td></tr><tr><td>Score</td><td>0.7812</td><td>0.8281</td><td>0.6133</td></tr><tr><td><strong>Class</strong></td><td><strong>analog clock</strong></td><td><strong>analog clock</strong></td><td><strong>analog clock</strong></td></tr></tbody></table>

connection on the Raspberry Pi that connects to the attacker's access point when in range, enabling the adversary to retrieve captured data or switch between attack modes remotely. Alternatively, a cellular dongle or a GSM module can also be used.

In the literature, hardware platforms used for MITM attacks, even beyond the USB context, are primarily based on FPGAs [9] [11]. A Raspberry Pi 5 was chosen instead, for several reasons: first, it is a low-cost and easier-to-set-up platform, requiring no additional hardware or software beyond USB Proxy. Second, a higher level of flexibility and programmability is offered. Although Wu et al. [3] also employed a Raspberry Pi-based platform, the software stack in this work is different, even if the underlying principle remains the same.

### C. Attack Scenarios

While many attacks on edge-deployed DNNs exist [2], this paper focuses on two specific scenarios: data exfiltration and misclassification. To execute these attacks, it was essential to first reverse engineer the USB traffic, as it was necessary to determine how the raw data captured is structured and, therefore, identify the packets of interest. The analysis also revealed that the host sends an 8-byte header packet to the accelerator before each transaction, specifying the type (most significant four bytes) and size (least significant four bytes) of the upcoming data. No similar header is sent for data coming from the accelerator to the host, particularly the inference results, which are always transmitted to the host through endpoint 0x81.

In the first attack scenario (Fig. 2), the data exchanged is copied before being forwarded. The challenge involves determining when to stop copying, considering the endpoint's maximum packet size is 1024 bytes, while the payload size can be larger. When the payload size exceeds the maximum size, the transfer is divided into multiple packets. Each packet matches the endpoint's maximum size, except the last one, which may be smaller. To address this, we keep track of the remaining data chunks to be copied. The total number of chunks can be pre-calculated by dividing the total data size (retrieved from the header packet) by the endpoint's maximum size and rounding up to account for any smaller final chunk. This count is then decremented with each data chunk transfer until it reaches zero, signaling the completion of the copy process.

<figure><img src="image_5.png" /><figcaption>Fig. 3. Inference tampering scenario where the output tensor is corrupted by changing the tenth byte ($i_9$) to 0xFF and zeroing the remaining (including $i_{90}$), leading to a misclassification of the image parrot.jpg as cock instead of macaw with a higher confidence score (87.11% → 99.61%).</figcaption></figure>

In the second attack scenario (Fig. 3), the objective is to tamper with the output tensor, thereby causing misclassification of the input image. While tampering with the input image itself or the model parameters could achieve this [2], the focus here is on directly corrupting the inference result, as it is more practical and precise. Regarding the corruption of the inference result, two cases are considered. The first case ensures that there is always misclassification, regardless of the input image, with a higher confidence score. The second case targets a particular object class explicitly, again with a higher confidence score. In the first case, the idea is to corrupt the first element of the intercepted output tensor below the score threshold (0.5 in general) and different from the background class (the first element in general if present) by replacing it with the desired confidence score and ensuring that the rest of the output tensor is filled with zeros or values lower than this score. In the second case, it is first necessary to determine the chunk where this class will appear if the inference result payload exceeds the maximum endpoint size. Then, the confidence score of the targeted class is corrupted by replacing it with the desired value, ensuring that the other confidence scores are lower than this value, similar to the first case.

## V. EXPERIMENT AND RESULTS

The experiments were conducted using the following setup: a Dell Latitude 5480 running Ubuntu 20.04.6 LTS served as the host machine; the Debian 12.10 operating system was installed on the Raspberry Pi 5; all models, images, and the label file used in the experiment are from the Coral's test_data github repository, except for the clock image [12]. The label file imagenet was used to map the model output to the corresponding human-readable class names. Several configurations were also considered. Specifically, a single Coral USB Accelerator was used, and each model fit within the 8MB SRAM of the Edge TPU. Furthermore, models were not co-
<table><caption>TABLE II
DATA EXFILTRATION RESULTS</caption><thead><tr><th>Input Image</th><th>State</th><th>MobileNetV2</th><th>InceptionV1</th><th>EfficientNetS</th></tr></thead><tbody><tr><td rowspan="3">parrot.jpg</td><td>Runs</td><td>250</td><td>250</td><td>250</td></tr><tr><td>Latency</td><td>50.8ms</td><td>106.0ms</td><td>48.3ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">hot_dog.jpg</td><td>Runs</td><td>325</td><td>325</td><td>325</td></tr><tr><td>Latency</td><td>50.3ms</td><td>107.3ms</td><td>47.7ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">clock.jpg</td><td>Runs</td><td>475</td><td>475</td><td>475</td></tr><tr><td>Latency</td><td>49.6ms</td><td>107.4ms</td><td>47.4ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">Overall</td><td>Runs</td><td>1050</td><td>1050</td><td>1050</td></tr><tr><td>Latency</td><td>50.23ms</td><td>106.9ms</td><td>47.8ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr></tbody></table>

compiled with any other model, and each model's operations were fully compatible with the Edge TPU.

In this study, the evaluated metrics are attack success rate and latency overhead. All latency values are averaged over the corresponding number of runs, and the mean calculation includes both the first and later runs. In the baseline scenario (Table I), the number of runs for each input image is exactly the same as the number of runs in the attack scenarios. Tables II and III summarize the experimental results for the two attack scenarios. One can note that all attacks were executed in real-time without detection or timeout errors. A 100% success rate was achieved for each attack scenario, totaling 3,150 runs each. There was 0% loss of data during the data exfiltration process, and the output tampering attack resulted in misclassification for each case with a high confidence score (0.9961) every time. Regarding the latency overhead compared to the baseline scenario, the data exfiltration attack resulted in an average latency increase of 45.66 ms for MobileNetV2, 101.43 ms for InceptionV3, and 38.97 ms for EfficientNetS. Similarly, the output tampering attack resulted in an average latency increase of 41.56 ms for MobileNetV2, 92.63 ms for InceptionV3, and 35.37 ms for EfficientNetS.

Regarding limitations, notable latency is introduced by the hardware platform used for the attack, which can, in some cases, restrict the stealthiness of the attack. An FPGA-based platform could mitigate this latency issue due to its hardware-based processing paradigm and true parallelism, operating without an intervening operating system or software layer. This architecture enables faster attack execution, thereby reducing latency. The Cynthion board [13], an FPGA-based platform utilized for USB analysis, could be employed for this purpose. Conversely, FPGA-based platforms require specialized knowledge in FPGA programming and design, which contrasts with the higher-level development environment of the Raspberry Pi. It may also be more expensive and less accessible than a Raspberry Pi. This trade-off between performance and accessibility presents a clear direction for future research.

## VI. CONCLUSION

This study introduces the first man-in-the-middle attack targeting the USB interface of the Coral USB Accelerator. The attack is demonstrated using a low-cost and accessible platform combined with open-source software. The platform is inserted between the accelerator and the host, granting

<table><caption>TABLE III
INference tampering results</caption><thead><tr><th>Input Image</th><th>State</th><th>MobileNetV2</th><th>InceptionV1</th><th>EfficientNetS</th></tr></thead><tbody><tr><td rowspan="3">parrot.jpg</td><td>Runs</td><td>250</td><td>250</td><td>250</td></tr><tr><td>Latency</td><td>45.9ms</td><td>97.3ms</td><td>44.5ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">hot_dog.jpg</td><td>Runs</td><td>325</td><td>325</td><td>325</td></tr><tr><td>Latency</td><td>46.4ms</td><td>98.2ms</td><td>44.2ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">clock.jpg</td><td>Runs</td><td>475</td><td>475</td><td>475</td></tr><tr><td>Latency</td><td>46.1ms</td><td>98.8ms</td><td>43.9ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr><tr><td rowspan="3">Overall</td><td>Runs</td><td>1050</td><td>1050</td><td>1050</td></tr><tr><td>Latency</td><td>46.13ms</td><td>98.1ms</td><td>44.2ms</td></tr><tr><td>SR(%)</td><td>100</td><td>100</td><td>100</td></tr></tbody></table>

access to input data, model parameters, and inference results, which opens the door to several attack scenarios, two of which were successfully demonstrated. Future research will focus on making the attack more stealthy and developing defenses against it, such as USB authentication or sending a known "golden" input to the accelerator and verifying that the class, score, and latency match expected values, thereby detecting anomalies indicative of an attack, like the principle of the Golden Batch Refreshing [5].

## REFERENCES

[1] Coral. Coral products. https://coral.ai/. Accessed: March 31, 2025.

[2] Mihailo Isakov, Vijay Gadepally, Karen M Gettings, and Michel A Kinsy. Survey of attacks and defenses on edge-deployed neural networks. In *2019 IEEE High Performance Extreme Computing Conference (HPEC)*, pages 1–8. IEEE, 2019.

[3] Han Wu, Sareh Rowlands, and Johan Wahlström. A human-in-the-middle attack against object detection systems. *IEEE Transactions on Artificial Intelligence*, 2024.

[4] Norman P Jouppi, Cliff Young, Nishant Patil, David Patterson, Gaurav Agrawal, Raminder Bajwa, Sarah Bates, Suresh Bhatia, Nan Boden, Al Borchers, et al. In-datacenter performance analysis of a tensor processing unit. In *Proceedings of the 44th annual international symposium on computer architecture*, pages 1–12, 2017.

[5] Tyler Garrett, Seth Roffe, and Alan George. Soft-error characterization and mitigation strategies for edge tensor processing units in space. *IEEE Transactions on Aerospace and Electronic Systems*, 2024.

[6] Ashley Kurian, Anuj Dubey, Ferhat Yaman, and Aydin Aysu. Tpuextract: An exhaustive hyperparameter extraction framework. *IACR Transactions on Cryptographic Hardware and Embedded Systems*, 2025(1):78–103, 2025.

[7] Arjun Chaudhuri, Jonti Talukdar, Fei Su, and Krishnendu Chakrabarty. Functional criticality analysis of structural faults in ai accelerators. *IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems*, 41(12):5657–5670, 2022.

[8] Arjun Chaudhuri, Jonti Talukdar, and Krishnendu Chakrabarty. Special session: fault criticality assessment in ai accelerators. In *2022 IEEE 40th VLSI Test Symposium (VTS)*, pages 1–4. IEEE, 2022.

[9] Wenye Liu, Weiyang He, Bowen Hu, and Chip-Hong Chang. A practical man-in-the-middle attack on deep learning edge device by sparse light strip injection into camera data lane. In *2022 IEEE 35th International System-on-Chip Conference (SOCC)*, pages 1–6. IEEE, 2022.

[10] Masataka Sawahara Aristo Chen, Andrey Konovalov. usb-proxy: A usb proxy based on raw-gadget and libusb. https://github.com/AristoChen/usb-proxy, 2024. Commit c6454ce, accessed Apr 18, 2025.

[11] Mohamed Amine Khelif, Jordane Lorandel, Olivier Romain, Matthieu Regnery, Denis Baheux, and Guillaume Barbu. Toward a hardware man-in-the-middle attack on pcie bus. *Microprocessors and Microsystems*, 77:103198, 2020.

[12] Scott Schwartz. clock image. https://farm6 staticflickr.com/3928/1534486198223ae9e8b2co.jpg. Accessed: April 1, 2025.

[13] Great Scott Gadgets. Cynthion. https://greatscottgadgets.com/cynthion/. Accessed: April 1, 2025.