Source-linked AI summary
Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
Adnan Siraj Rakin, Zhezhi He, Deliang Fan
TL;DR
DNN parameter security is less explored than input-based adversarial attacks, especially for quantized models. The paper proposes BFA with PBS to identify vulnerable weight bits, and shows that 13 flips can reduce ResNet-18 to 0.1% top-1 accuracy from 69.8%.
Problem
DNN parameter security is not well explored, despite established security concerns for malicious inputs and stored weights.
Method
BFA uses PBS, combining gradient ranking and progressive search to identify vulnerable bits in quantized DNN weights stored in DRAM.
Results
13 bit-flips out of 93 million reduced ResNet-18 top-1 accuracy from 69.8% to 0.1% on ImageNet.
Takeaways & Limitations
DNN parameter vulnerability to malicious bit-flips is extremely severe, warranting further investigation of both attacks and defenses.
Takeaways & Limitations
BFA assumes white-box access to DNN weights and gradients, while excluding access to the training dataset, algorithm, and hyperparameters.
Abstract
from arXiv · showhide
Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN's parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.
1 Introduction
DNNs’ expanding real-world use makes their security and robustness essential, yet parameter security is less explored than malicious-input attacks. The paper introduces BFA with PBS to target vulnerable bits in quantized weights, achieving severe degradation with few flips.
- DNNs approach or surpass human-level performance across multiple domains, increasing the need for secure and robust real-world deployment.
- Parameter security remains less explored than adversarial attacks on DNN inputs, while fault injection has raised concerns about stored parameters.
- Prior parameter attacks primarily targeted full-precision models, whereas this work focuses on quantized weights with fixed-point-constrained magnitudes.
- BFA uses PBS to combine gradient ranking, progressive search, and iterative in-layer and cross-layer searches for vulnerable weight bits.
- 13 bit-flips out of 93 million convert ResNet-18 into a random output generator with 0.1% top-1 accuracy on ImageNet.
2 Related Work
Prior work established practical memory bit-flip threats and explored parameter attacks, but mainly against full-precision models. Quantized models are more resistant to random flips, motivating an efficient vulnerable-bit search.
- Row-Hammer attacks can flip DRAM bits through frequent memory access, and DNN parameters stored in DRAM are directly exposed to this threat.
- Earlier parameter attacks included hardware trojans and fault injection, but hardware modifications or specific trigger patterns can limit practicality.
- Quantized models constrain weight magnitudes and are more robust to parameter perturbation than floating-point models.
- Flipping a most significant exponent bit in a random floating-point weight could totally malfunction ResNet-18 on ImageNet.
- 100 random bit-flips in quantized ResNet-18 caused only 0.6% ImageNet accuracy degradation, motivating a targeted bit-search algorithm.
3 Approach
The approach attacks quantized DNN weights by representing them as binary memory bits and selecting vulnerable bits that maximize inference loss under a bit-flip budget. Progressive Bit Search combines gradient-based in-layer selection with cross-layer evaluation, progressively applying selected flips without restoration.
- Problem Definition: Quantized weights are represented as signed integers in two’s-complement binary form, which provides the bit-level attack representation.The model uses a layer-wise Nq-bit uniform quantizer and stores the fixed-point weights in memory as two’s-complement bits.
- Problem Definition: The optimization seeks perturbed weight bits that maximize DNN inference loss while constraining the Hamming distance from clean weights.The Hamming-distance constraint limits the total number of changed bits across the network.
- Bit-Flip Attack: BFA flips binary weights along the loss-gradient ascending direction, using a mask and bitwise XOR to implement valid 0-to-1 or 1-to-0 changes.The gradient-based operation is adapted to binary-valued bits to avoid invalid values and overflow.
- Progressive Bit Search: PBS ranks bits within each layer by the absolute gradient ∂L/∂b, selects the top-nb candidates, and evaluates their loss increase.The selected bits are flipped for the layerwise evaluation before cross-layer comparison.
- Progressive Bit Search: Cross-layer search independently performs in-layer searches, compares the resulting layer losses, and chooses the layer producing the largest loss increase.The selected attack is then reapplied without restoring the previously selected bits, and PBS proceeds to the next iteration.
- Evaluation: Table 2 measures BFA using Nflip and the clean-to-perturbed binary-weight Hamming distance DB across CIFAR-10 ResNet variants and Nq=4/6/8.Nflip is measured over five trials as the flips needed to reduce top-1 accuracy below 11%, while CIFAR-10 random guessing is 10%.
4 Experiments
Experiments evaluate BFA across quantized architectures and datasets, showing that PBS can identify a very small number of vulnerable weight bits. Attack effectiveness depends on architecture and attack-sample size, while random bit flips are far less damaging in quantized models.
- Experimental setup: Experiments cover CIFAR-10 and ImageNet using quantized ResNet variants, AlexNet, ResNet-18, and ResNet-50.CIFAR-10 uses 4-, 6-, and 8-bit quantization; ImageNet evaluates direct 8-bit quantization without retraining.
- BFA on CIFAR-10: Below 20 bit-flips typically make CIFAR-10 ResNet models malfunction across tested quantization bit-widths.The experiments found no obvious relation between quantization bit-width and the number of required flips.
- BFA on ImageNet: 11 bit-flips out of 200 million make ImageNet ResNet-50 dysfunctional, modifying roughly 0.000003% of stored bits.PBS requires 17 median bit-flips out of 480 million bits for AlexNet and produces a much steeper accuracy decline on ResNet architectures.
- Ablation study: S(128) > S(32) > S(256) > S(64) > S(16) ranks attack performance by sample size, with 128 samples requiring the fewest flips to reach 10%.The results discourage choosing an attack sample that is too large or too small.
- Comparison to other methods: 100 random bit-flips reduce 8-bit quantized ResNet-18 ImageNet Top-1 accuracy by no more than 1%, whereas PBS needs only 13 bits to cause malfunction.This contrast motivates an efficient search for vulnerable bits rather than randomly selecting stored weight bits.
- Attack method: PBS combines gradient ranking with progressive search to flip vulnerable bits iteratively until accuracy reaches a minimum or a preset iteration limit.The method flips nb vulnerable bits per iteration, with nb = 1 by default.
5 Discussion
The discussion links severe bit-flip effects to noise propagation through DNN layers, while showing that attack behavior depends on architecture. It also reports that common defenses do not improve robustness against BFA.
- Noise propagation: Early-layer attacks are more effective because injected noise grows as it propagates through subsequent layers.Table 4 describes separate attacks on the first and last VGG16 layers on CIFAR-10.
- Noise propagation: Among 15 bit flips reducing VGG16 accuracy to 10 percent, 9 occur in the first six layers.
- Architecture dependence: ResNet architectures tend to distribute bit flips across layers because skip connections complicate the simple linearity-based explanation.
- Attack method: BFA with PBS directly uses quantized weights for inference after training and calculates gradients without the gradient obfuscation associated with straight-through estimation.
- Defense: Adversarial training does not improve robustness against BFA, whose search space contains close to 93M bits and leaves vulnerable bits available.
- Defense: The number of quantization bits does not correlate with the number of bit flips required, so quantization alone is not a reliable defense against BFA.
6 Conclusion
The paper concludes that malicious bit flips can severely compromise DNN parameters and presents BFA as the first vulnerable-bit search attack for quantized neural networks. It calls for further work on both attacks and defenses.
- BFA is presented as the first vulnerable-bit search attack for quantized neural networks.
- The experiments and analysis indicate that DNN parameters are extremely vulnerable to malicious bit flips.
- The paper encourages further investigation of both attack and defense methods to develop more resilient deep-learning networks.