PaperlayerView exact revision on arXiv

Source-linked AI summary

DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips

Fan Yao, Adnan Siraj Rakin, Deliang Fan

arXiv:2003.13746v1cs.CRcs.LG

TL;DR

Hardware vulnerabilities pose an underexplored threat to deployed quantized DNNs. DeepHammer deterministically searches for flippable weight bits and uses rowhammer techniques to target them, degrading inference to random-guess accuracy across broad evaluations. Its scope includes current implementation and threat-model assumptions that constrain deployment scenarios.

  • Problem

    Hardware-based internal threats to DNN models are less understood than input-based attacks, despite their ability to directly tamper with internal system state.

  • Method

    DeepHammer combines flip-aware bit search with DRAM profiling and fast, precise rowhammer techniques to induce targeted weight-bit flips.

  • Results

    Across 12 DNN architectures and 4 datasets, DeepHammer reduces targeted inference accuracy to about random guess using 2-24 bits and completes attacks within minutes.

  • Takeaways & Limitations

    Quantized DNN systems require security mechanisms against hardware-based deterministic fault injections, not only defenses against malicious inputs.

  • Takeaways & Limitations

    The current implementation uses only one bit flip per physical page, while the threat model assumes knowledge of model parameters and test data.

Abstract

from arXiv · show

Security of machine learning is increasingly becoming a major concern due to the ubiquitous deployment of deep learning in many security-sensitive domains. Many prior studies have shown external attacks such as adversarial examples that tamper with the integrity of DNNs using maliciously crafted inputs. However, the security implication of internal threats (i.e., hardware vulnerability) to DNN models has not yet been well understood. In this paper, we demonstrate the first hardware-based attack on quantized deep neural networks-DeepHammer-that deterministically induces bit flips in model weights to compromise DNN inference by exploiting the rowhammer vulnerability. DeepHammer performs aggressive bit search in the DNN model to identify the most vulnerable weight bits that are flippable under system constraints. To trigger deterministic bit flips across multiple pages within reasonable amount of time, we develop novel system-level techniques that enable fast deployment of victim pages, memory-efficient rowhammering and precise flipping of targeted bits. DeepHammer can deliberately degrade the inference accuracy of the victim DNN system to a level that is only as good as random guess, thus completely depleting the intelligence of targeted DNN systems. We systematically demonstrate our attacks on real systems against 12 DNN architectures with 4 different datasets and different application domains. Our evaluation shows that DeepHammer is able to successfully tamper DNN inference behavior at run-time within a few minutes. We further discuss several mitigation techniques from both algorithm and system levels to protect DNNs against such attacks. Our work highlights the need to incorporate security mechanisms in future deep learning system to enhance the robustness of DNN against hardware-based deterministic fault injections.

1 Introduction

DeepHammer studies hardware-based attacks against quantized DNNs, where single-bit faults are relatively ineffective and successful compromise requires carefully selected, physically flippable bit chains. It combines flip-aware bit search with fast, precise rowhammering and demonstrates end-to-end attacks across multiple architectures and datasets.

  • Motivation: Hardware-based internal adversaries can directly tamper with DNN system state, extending security concerns beyond input-based attacks.The paper motivates this concern through rowhammer-based integrity compromises in other victim processes.
  • Motivation: Quantized DNNs require multiple deterministic bit flips because single-bit corruption is more tolerable than in full-precision models.The attack targets model weights, whose corruption can substantially affect inference performance.
  • Approach: DeepHammer uses flip-aware bit search to identify the least number of influential model bits that are empirically flippable under system constraints.The search combines bit-wise gradient ranking, progressive search, and physical flip-profile constraints.
  • Approach: The attack framework develops fast memory massaging and precise rowhammering to flip targeted bit chains within a practical exploitation window.The techniques include per-CPU free-page-list exploitation and targeted column-page-stripe patterns.
  • Results: 2-24 bits out of millions of model weight parameters can completely compromise the DNN model, with targeted chains attacked in minutes.The evaluation covers 12 DNN architectures and 4 datasets spanning image classification and speed recognition.

2 Background

The background describes DNN structure and quantization, then explains how DRAM disturbance errors enable rowhammer fault injection. Quantization improves inference efficiency but changes the model's vulnerability profile compared with full-precision parameters.

  • Deep neural networks: DNNs use multilayer structures trained with forward- and backpropagation to tune parameters such as model weights and minimize prediction errors.The architecture includes input, hidden, and output layers.
  • Deep neural networks: Quantization replaces full-precision parameters with low-width or binarized values, improving inference speed and power efficiency for resource-constrained applications.The passage states this can occur without adversely sacrificing accuracy.
  • Rowhammer attacks: Rowhammer induces bit flips by repeatedly activating adjacent DRAM rows, accelerating charge leakage through inter-cell coupling before refresh.The attack can modify critical bits without access permissions to the affected memory regions.
  • Rowhammer attacks: Single-sided, double-sided, and one-location rowhammer differ in which rows or locations they repeatedly access, with double-sided attacks typically generating the most flips.Double-sided rowhammer accesses both rows adjacent to the victim row.

3 Threat Model and Assumptions

The threat model considers a co-located, unprivileged attacker targeting deployed 8-bit quantized DNN inference through deterministic DRAM weight corruption. It assumes knowledge of model parameters and a resource-sharing deployment environment.

  • Target and environment: DeepHammer targets deployed DNNs whose parameters are low-bit-width integers, triggering DRAM bit flips after deployment rather than redistributing a modified model.The assumed target is an inference service in a resource-sharing environment such as MLaaS.
  • Attack objective: The attacker seeks to induce deterministic weight errors that reduce inference accuracy close to random guess.This objective distinguishes the attack from adversarial inputs, which manipulate model behavior through crafted inputs.
  • Attacker knowledge: The threat model assumes the attacker knows the target model parameters, supported by the prevalence of public pretrained models and possible information leakage.Examples of leakage include power, electromagnetic, and microarchitecture side channels.
  • Attacker capabilities: The attacker is co-located with the victim service, can run unprivileged user-space processes, and can map weight-file pages read-only into its address space.Huge pages, side channels, or memory massaging can support virtual-to-physical address mapping.

4 DeepHammer Overview

DeepHammer combines offline DRAM profiling and flip-aware bit search with online page mapping and rowhammer exploitation. Its design targets minimal, physically realizable bit chains while reducing the cost of positioning vulnerable pages.

  • Overview: The attack has two offline stages—memory templating and flip-aware bit search—and one online stage that locates pages and triggers multiple flips.The offline stages identify vulnerable offsets and a minimal target set before exploitation.
  • Offline preparation: Memory templating scans physical memory for bit offsets susceptible to deterministic flips and reverse-engineers DRAM address-to-row mappings.This profiling supports later page placement and rowhammer targeting.
  • Offline preparation: Flip-aware bit search combines Gradient based Bit Ranking with Flip-aware Bit Search to minimize attacked bits or physical pages while achieving the desired accuracy loss.FBS checks whether ranked bits match available page offsets and flip directions in the DRAM profile.
  • Online exploitation: The online phase uses rowhammer to flip the selected bit chain, with page positioning identified as a major bottleneck.DeepHammer exploits the per-CPU pageset's LIFO allocation behavior to release and remap vulnerable pages quickly.
  • Robustness motivation: Targeted bit flipping is contrasted with random flipping for quantized ResNet-20 on CIFAR-10.The figure caption identifies the two strategies and the evaluated model-dataset pair.

5 Flip-aware Vulnerable Bit Search

The flip-aware vulnerable bit search combines gradient-based ranking with hardware-aware feasibility checks to find a small chain of model bits whose flips can substantially degrade a quantized DNN’s accuracy. It addresses quantized models’ tolerance to random bit corruption by selecting influential bits that are physically flippable on the target system.

  • Motivation: Randomly flipping even 100 weight bits reduced 8-bit quantized ResNet-20 accuracy by less than 1%, demonstrating strong tolerance to untargeted corruption.The robustness study used CIFAR10.
  • Search Framework: The search combines Gradient-based Bit Ranking with Flip-aware Bit Search to identify influential, physically flippable model bits.The method ranks bits by gradient influence, then models memory layout and DRAM flip constraints.
  • Search Objective: The resulting chain contains the least number of vulnerable bits needed to approach the desired accuracy loss while respecting target-machine memory constraints.The algorithm currently considers at most one bit flip for each physical page storing model weights.
  • Gradient-based Bit Ranking: Gradient-based Bit Ranking computes bit gradients across layers, selects the top-p absolute-gradient bits, and evaluates their individual loss and accuracy impact.The selected bit causing the maximum accuracy drop is chosen at each iteration, while tested flips are restored before evaluating the next candidate.
  • Flip-aware Bit Search: Flip-aware Bit Search greedily filters ranked candidates using DRAM profiles, retaining only bits whose offsets and flip directions match available physical locations.It accumulates the predicted accuracy degradation of the bit chain and stops when the attack objective is reached.

6 Fast and Precise Multi-bit Flips

DeepHammer combines page placement, compact aggressors, precise rowhammering, and online re-templating to induce targeted multi-bit flips efficiently. These techniques map victim pages to vulnerable DRAM locations while limiting memory use and avoiding unintended bit flips.

  • Attack Framework: DeepHammer uses multi-page memory massaging, precise hammering, and online re-templating to enable fast and precise multi-bit flips.The techniques respectively position victim pages, restrict flips to targeted locations, and correct obsolete flip profiles caused by memory scrambling.
  • Target Representation: Each targeted bit is represented as (vpi, bopi, mode), specifying the victim page, bit offset, and desired flip direction.Mode 0 denotes a 1→0 flip and mode 1 denotes a 0→1 flip.
  • Compact Aggressors: Compact aggressors use in-row pages as the atomic hammering unit, improving page utilization while allowing adjacent aggressor regions to induce flips without interference.An in-row page is the portion of a physical page mapped to one DRAM row; row layouts differ between single- and dual-channel configurations.
  • Page Mapping: The attacker maps each vulnerable victim page to a matching physical page by prioritizing targets with the fewest satisfiable locations, then remaps the model pages accordingly.The mapping relies on DRAM addressing, physical page layout, and the target bit chain.
  • Memory Massaging: Per-CPU page-frame caches support page placement by freeing designated physical pages below the recycling threshold and reloading target pages in reverse order.The testbed’s observed recycling threshold was 180 pages, and FADV_RANDOM was used to limit page prefetching.
  • Precise Rowhammering: Column-page-stripe patterns configure disturbance only at desired columns, while solid patterns elsewhere reduce inter-cell disturbance and prevent extra bit flips.Double-sided rowhammering then induces the targeted flips; multiple aggressor sets can share rows within configuration-dependent limits.

7 Experimental Setup

DeepHammer was evaluated on computer-vision and speech-recognition applications using multiple datasets, DNN architectures, and real hardware configurations. The setup included offline DRAM templating and GPU-trained models deployed on an Ivy Bridge CPU test bed.

  • Datasets and applications: The evaluation covered computer vision and speech recognition, including Fashion-MNIST, CIFAR-10, and ImageNet for object classification.Fashion-MNIST contains 70k training and 10k test images; CIFAR-10 contains 60K RGB 32×32 images, split into 50K training and 10K test examples.
  • Hardware and software: Models were trained and analyzed on a GeForce GTX 1080 Ti with 11GB dedicated memory and a 1481Mhz clock speed.The training platform used PyTorch 1.04, Python 3.6, and CUDA 9.0 for GPU acceleration.
  • Hardware and software: Inference ran on an Ivy Bridge Intel i7-3770 CPU test bed supporting up to two memory channels.The study used both single-channel single-DIMM and dual-channel single-DIMM configurations with 4GB DDR3 modules.
  • Memory templating: Offline memory templating scanned DRAM rows using the released addressing scheme across 32,768 rows per bank and 16 banks per DIMM.Bit flips were observed to be uniformly distributed across banks, and rows were sampled randomly within each bank.

8 Evaluation

DeepHammer successfully compromised quantized DNNs across architecture and dataset combinations by identifying and precisely flipping vulnerable weight bits. The attacks reached random-guess-level accuracy and completed online within minutes, while vulnerability varied with model architecture, dataset, and DRAM profile.

  • Attack effectiveness: DeepHammer compromised all 12 architecture/dataset configurations using at most 24 bit flips.The target accuracy was defined near random guess: about 10% for CIFAR-10 and 0.1% for ImageNet.
  • Bit-chain search: The flip-aware search generated one candidate bit chain in about 120 seconds and modeled physical memory layout and DRAM flip profiles.The search could generate multiple chains for one network, while Table 2 lists three candidate chains for VGG-16.
  • Architecture and dataset effects: For CIFAR-10, VGG-16 required 13 flips versus 3 for VGG-11, while ResNet models consistently required more than 20 bits.On ImageNet, MobileNet-V2 required only 2 flips, substantially fewer than SqueezeNet.
  • Attack effectiveness: VGG-16 on CIFAR-10 required as few as 13 targeted bits, with more than 70% of vulnerable flips using the 1→0 direction.The authors attribute this imbalance to the predominance of zero weights and the importance of non-zero weights for classification behavior.
  • Bit-location patterns: Targeted bits clustered in the first and last few network layers, with half of VGG-16’s 13 flips in front-end layers and all VGG-11 flips in its last three layers.The paper suggests that early perturbations can propagate toward later layers, while back-end changes can directly alter classification outcomes.
  • Online exploitation: All attack instances succeeded in less than 10 minutes, and VGG-16 runs induced their target flips in under 100 seconds.Online memory re-templating finished in a few minutes, whereas initial memory templating could take hours.
  • DRAM vulnerability: DRAM vulnerability materially affected attack success: single-sided hammering succeeded on AlexNet and VGG-11 but failed to achieve the desired accuracy drop on VGG-16 and ResNet-20.Under single-sided hammering, AlexNet and VGG-11 required 7 and 6 flips, respectively, with only about 0.3% of bits exploitable.

9 Discussion

The discussion examines targeted attacks, model redundancy, mitigations, and implementation boundaries. DeepHammer can force targeted outputs with few flips, while defenses and deployment assumptions constrain protection and applicability.

  • 9.1 Untargeted and Targeted Attacks: DeepHammer’s identified bit-flip chain forces almost all inputs into one winner-group, although the original method does not directly choose that group.The winner-group depends heavily on the batch used for gradient computation.
  • 9.1 Untargeted and Targeted Attacks: 99.63% of test inputs were classified into class-1 using 18 bit-flips in the targeted ResNet-20 attack.A class-9 attack required 19 bit-flips.
  • 9.1 Untargeted and Targeted Attacks: Wider networks require more flips under the model-redundancy ablation, supporting greater resilience as network width increases.The comparison evaluates standard ResNet-20 against a double-width ResNet-20×2.
  • 9.2 Potential Mitigation Techniques: Protecting only a small subset of vulnerable bits may be infeasible because the vulnerable-bit search space is too large.The discussion points toward combined software- and hardware-level data-integrity guarantees.
  • 9.3 Limitations and Future Work: The current implementation flips one bit per physical page, although multi-bit pages could reduce targeted pages and rowhammer iterations.Influential bits are concentrated in some layers and often share 4KB page boundaries.
  • 9.3 Limitations and Future Work: The threat model assumes access to network architecture, weight values, and one test-data batch, which may not apply in all scenarios.Future work proposes exploring a semi-black-box attack setting.

10 Related Work

Related work covers input attacks, fault injection, rowhammer attacks, and mitigation mechanisms. DeepHammer is positioned as the first practical end-to-end rowhammer attack on fixed-point quantized DNN weights.

  • 10 Related Work: Traditional DNN security research focused mainly on adversarial input attacks that maliciously perturb images to degrade model performance.Recent work also studies DNN model vulnerability more broadly.
  • 10 Related Work: Fault-injection methods have demonstrated serious DNN vulnerabilities, including attacks that alter biases or activations to cause malfunction.These approaches target internal model behavior rather than only malicious inputs.
  • 10 Related Work: DeepHammer extends practical rowhammer-based DNN attacks from comparatively easier full-precision models to fixed-point quantized weights.The paper describes it as the first end-to-end system-level practical attack in this setting.
  • 10 Related Work: Rowhammer defenses include disabling clflush for cache-bypassing access and isolating user-space DRAM rows from kernel-space rows.These mechanisms attempt to block necessary stages of the rowhammer attack process.

11 Conclusion

The conclusion presents DeepHammer as a hardware attack that deterministically flips quantized DNN weight bits through rowhammer. It combines flip-aware bit search with fast, precise flipping techniques and demonstrates runtime model compromise within minutes.

  • 11 Conclusion: DeepHammer targets quantized DNNs by inducing a chain of deterministic bit flips in model weights through rowhammer.The attack seeks to deplete the intelligence of the target model.
  • 11 Conclusion: Flip-aware bit search locates the least number of vulnerable target-model bits that can be physically flipped.The system also develops rowhammer techniques for fast and precise execution.
  • 11 Conclusion: DeepHammer compromises target DNN models on real systems within minutes.The evaluation provides an end-to-end demonstration of the attack.
  • 11 Conclusion: The models use layer-wise N-bit uniform quantization, with ImageNet architectures quantized after training from pretrained models.Other listed models use quantization during training.
  • 11 Conclusion: Quantized weights are represented as two’s-complement binary values in computing systems.The paper describes the binary representation of each signed integer weight element.

C DNN Training Configuration

The training configuration uses PyTorch on a GPU platform and specifies dataset-dependent optimization settings for MNIST, CIFAR-10, and speech commands.

  • C DNN Training Configuration: Training uses PyTorch on an NVIDIA 1080 Ti platform with dataset-specific batch sizes, learning rates, optimizers, epochs, and weight decay.The passage gives configurations for MNIST, CIFAR-10, and the speech command dataset.

D Targeted Bit-flip Chain for DNN Models

Table 4 lists DeepHammer’s targeted bit chains across DNN models. Vulnerable-bit locations differ by architecture: non-residual networks concentrate flips earlier, whereas ResNet models show flips at both network ends.

  • VGG and AlexNet, which lack residual connections, exhibit most bit flips in earlier layers.The authors associate this pattern with perturbations accumulating as they pass through later layers.
  • ResNet architectures exhibit most identified bit flips at both the front and end of the network.
  • The observed differences lead the authors to conclude that network topology may affect vulnerable-bit locations.
  • Table 4 illustrates the shortest chains of targeted bits identified for all DNN models by DeepHammer’s flip-aware bit search algorithm.
Loading 2003.13746v1…