Bit-Flip Attack: Crushing Neural Network With Progressive Bit Search

By Adnan Siraj Rakin, Zhezhi He, Deliang Fan. IEEE International Conference on Computer Vision, 2019

330 citations recorded by the source corpus.

Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN’s parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%. Code is released at: https://github.com/elliothe/Neural_Network_Weight_Attack

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/18f1029ed3291268932cd2d268f2d8b1ded0abcf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Bernt Schiele
2. Matthias Hein
3. Ajmal Saeed Mian
4. Mubarak Shah
5. David Stutz
6. Naveed Akhtar
7. Navid Kardan
8. Luc Van Gool

In Electrical and Electronic Engineering

1. David Stutz
2. Bernt Schiele
3. Matthias Hein
4. Mubarak Shah
5. Francesco Croce

In Hardware and Architecture

1. Matthias Hein
2. Bernt Schiele
3. David Stutz
4. Mubarak Shah
5. Navid Kardan
6. Ajmal Saeed Mian
7. Naveed Akhtar
8. Michel A. Kinsy

Citations in the corpus

• Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “[52] [53] [59] [60] [61, 62, 63] [65] [71, 72]”
• Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “He et al. [430] specifically proposed a binarization aware training method to defend against the Bit Flip Attack [175].”
• Relating Adversarially Robust Generalization to Flat Minima (2021, background): “[102, 47], in contrast, adversarially flip bits in (quantized) weights to reduce performance.”