Source-linked AI summary
TBT: Targeted Neural Network Attack with Bit Trojan
Adnan Siraj Rakin, Zhezhi He, Deliang Fan
TL;DR
Existing Trojan attacks often assume access to training data and can compromise clean-data stealthiness. TBT instead inserts a targeted Trojan online through a small number of weight-bit flips, achieving 92% attack success with about 84 bit-flips.
Problem
Prior neural Trojan attacks may require training-data access and suffer from poor clean-data stealthiness, limiting their practicality in some scenarios.
Method
TBT inserts a targeted neural Trojan after deployment by generating triggers that identify vulnerable DNN weight bits for online bit-flip attacks.
Results
About 84 bit-flips achieved 92% attack success rate, with 82% test accuracy in the aggressive attack setting.
Takeaways & Limitations
TBT demonstrates that runtime bit flips can insert neural Trojans after deployment, emphasizing runtime vulnerability analysis for secure DNN deployment.
Takeaways & Limitations
The attack’s clean test accuracy can drop substantially on architectures such as NIN, potentially making the Trojan easier for defenses to detect.
Abstract
from arXiv · showhide
Security of modern Deep Neural Networks (DNNs) is under severe scrutiny as the deployment of these models become widespread in many intelligence-based applications. Most recently, DNNs are attacked through Trojan which can effectively infect the model during the training phase and get activated only through specific input patterns (i.e, trigger) during inference. In this work, for the first time, we propose a novel Targeted Bit Trojan(TBT) method, which can insert a targeted neural Trojan into a DNN through the bit-flip attack. Our algorithm efficiently generates a trigger specifically designed to locate certain vulnerable bits of DNN weights stored in main memory (i.e., DRAM). The objective is that once the attacker flips these vulnerable bits, the network still operates with normal inference accuracy with benign input. However, when the attacker activates the trigger by embedding it with any input, the network is forced to classify all inputs to a certain target class. We demonstrate that flipping only several vulnerable bits identified by our method, using available bit-flip techniques (i.e, row-hammer), can transform a fully functional DNN model into a Trojan-infected model. We perform extensive experiments of CIFAR-10, SVHN and ImageNet datasets on both VGG-16 and Resnet-18 architectures. Our proposed TBT could classify 92 % of test images to a target class with as little as 84 bit-flips out of 88 million weight bits on Resnet-18 for CIFAR10 dataset.
1 Related Work and Background
Prior neural Trojan methods rely on added circuitry or training-data access, while TBT instead flips a small number of vulnerable weight bits after deployment without requiring original training data. The attack assumes white-box knowledge and uses 8-bit quantized, two’s-complement encoded weights, with Row Hammer Attack enabling physical DRAM bit flips.
- Previous Trojan attacks and their limitations: Earlier Trojan attacks used added circuitry activated by specific input patterns or poisoned training data, but training-data access is impractical and poisoning has poor stealthiness.The cited limitations include strong access assumptions and poor test accuracy.
- Previous Trojan attacks and their limitations: Recent methods generate triggers without original training data, yet they primarily target the model’s training phase before deployment.These approaches evolved toward trigger generation to improve stealthiness, while remaining focused on misleading training before inference deployment.
- Row Hammer Attack to flip memory bits in main memory: TBT identifies and flips a very small number of vulnerable bits in weight parameters stored in main memory to inject a neural Trojan.The physical DRAM bit flips are implemented using the recently discovered Row Hammer Attack, which repeatedly accesses a specific data pattern.
- Threat Model definition: The threat model assumes a white-box attacker who knows network parameters but does not require original training data, which may be obtained through side channels or the supply chain.The setup covers weights, biases, and related network information, while excluding access to the original training process or dataset.
- Weight Quantization and Encoding: Experiments use 8-bit quantized networks with quantization-aware training and two’s-complement weight encoding, following methods common in quantized DNN research.The quantization scheme is uniform and identical to Tensor-RT, while training uses a straight-through estimator for the non-differentiable staircase function.
2 Proposed Method
The proposed Targeted Bit Trojan (TBT) generates a targeted trigger and identifies vulnerable last-layer weights whose bit flips implant a Trojan while preserving normal model operation. Its pipeline combines Neural Gradient Ranking, trigger optimization, weight updating, and practical DRAM bit flipping, and is evaluated across multiple datasets and architectures.
- Trigger and Vulnerable-Weight Identification: TBT uses Neural Gradient Ranking to identify last-layer input neurons with the greatest influence on a chosen target output class.NGR selects the input-neuron indexes connected to the target output neuron using the largest absolute gradients.
- Trigger and Vulnerable-Weight Identification: The trigger is optimized by back-propagation to make the selected neurons fire at a large artificial target value, with β set to 10.The generated pattern is zero-padded to the model’s input shape and the model parameters excluding the last layer remain fixed.
- Weight Optimization and Bit Injection: Stochastic gradient descent updates the selected weights so triggered samples classify to a target vector, producing a perturbed weight matrix that differs from the clean matrix by several bits.For 8-bit quantized networks, the required bit count is computed from the Hamming distance between clean and perturbed binary weight tensors.
- Weight Optimization and Bit Injection: The attacker performs NGR and weight optimization offline, then flips the identified bits in DRAM, including through row-hammer, and activates the implanted Trojan with the generated trigger.The method is designed to insert the Trojan into a clean model through only a few bit flips.
- Experimental Setup: TBT is evaluated on CIFAR-10, SVHN, and ImageNet using ResNet-18 and VGG-16 architectures.The experiments focus mainly on ResNet-18 and use CIFAR-10’s 50K training and 10K testing split.
4 Experimental Results
Experiments show that TBT achieves high attack success while preserving usable clean accuracy across CIFAR-10, SVHN, and ImageNet. Trigger area, modified-weight count, and target class substantially affect attack strength, accuracy, and bit-flip requirements.
- CIFAR-10 target-class analysis: 91.68% was the highest CIFAR-10 test accuracy when class 9 was selected as the target class.All targeted classes experienced some test-accuracy drop relative to the typical 91.9% accuracy of an 8-bit quantized ResNet-18.
- CIFAR-10 target-class analysis: Classes 1 and 0 showed higher ASR and were easier to attack, while classes 3, 4, and 6 were the most difficult.The results found no obvious relation between test accuracy and attack success rate, and trigger location may affect difficult classes.
- ImageNet results: 99.98% attack success rate was achieved on ImageNet while maintaining clean data accuracy.TBT reportedly modified approximately 3000× fewer parameters than BadNet, which requires training the whole network.
- Ablation studies: 11.82% trigger area reduced the vulnerable-bit requirement compared with 6.25%, while increasing wb improved ASR but eventually offered little accuracy benefit and required many bit-flips.These parameters let attackers trade off test accuracy, ASR, and bit-flip count under practical constraints.
- Ablation studies: 93.23% ASR and 89.09% test accuracy were obtained near the optimum wb value of around 97.With only 24 modified weights and 84 bits, TBT achieved close to 91.93% ASR, although test accuracy was 82.28%.
- Baseline comparison: 93.15% of CIFAR-10 test data was classified to the target class with 86.34% post-attack test accuracy on VGG-16.TBT outperformed both baseline methods on CIFAR-10; on SVHN it achieved 73.87% test accuracy and an ASR almost similar to Trojan NN, while BadNet performed best overall.
5 Discussion
The discussion examines how attack strength depends on bit-flip budget, trigger placement, and trigger noise, while noting limitations of existing defenses and an NIN adaptation. TBT achieves 92% attack success with around 84 bit-flips in an aggressive setting, and 99% success on NIN with reduced clean accuracy.
- Bit-flip budget: 84 bit-flips achieve 92% attack success in an aggressive setting unconcerned with test-accuracy degradation or stealthiness.This attack minimizes the number of bit-flips under relaxed constraints.
- Trojan Location and Target Class analysis: Optimum trigger location varies by target class, so selecting its placement is a key attack decision.Top-left works best for classes 3, 6, and 7, whereas center works best for class 4.
- Trigger Noise level: Trigger noise level is strongly correlated with attack success rate, motivating experiments at 6%, 0.2%, and .02% noise.The trigger may need to be hidden depending on the attack scenario.
- Potential Defense Methods: Existing defenses detect Trojans inserted during training or supply-chain deployment but do not effectively defend against runtime insertion during inference.The discussion identifies this gap as a major limitation of Trojan detection and defense schemes.
- NIN adaptation: 99% attack success is achieved on NIN after removing its last convolution and average-pooling layers, while clean CIFAR-10 accuracy drops to 77%.The authors conjecture that average pooling may weaken attack stealthiness, and poor clean accuracy may aid detection.
6 Conclusion
TBT introduces a targeted neural Trojan into a deployed DNN by modifying only a small number of weight parameters through several main-memory bit flips. This runtime, online attack highlights the need for stronger DNN vulnerability analysis.
- 6 Conclusion: TBT is the first method to insert a neural Trojan into a deployed DNN by modifying a small amount of weight parameters during inference.The attack operates after deployment rather than during training.
- 6 Conclusion: TBT enables Trojan insertion through only several bit flips in computer main memory using a row-hammer attack.The method modifies DNN weights through an online memory-based attack.
- 6 Conclusion: TBT’s runtime and online neural Trojan attack places DNN security under severe scrutiny and emphasizes the need for vulnerability analysis.The conclusion calls for increased analysis of DNN vulnerabilities during runtime.