PaperlayerView exact revision on arXiv

Source-linked AI summary

ROBBIN: Rowhammer-Based Backdoor Injection during Inference

Saion K. Roy, Yufei Wang, A. Adam Ding, Yunsi Fei

arXiv:2608.23774v1cs.CR

TL;DR

Existing inference-time Rowhammer backdoors do not account for the device-specific and collateral bit-flips produced by DRAM hardware, undermining reliable efficacy across devices. ROBBIN profiles those hardware vulnerabilities and integrates them into iterative weight-page selection, achieving close to 90% ASR with TA above 83% across evaluated devices. The study also identifies runtime monitoring and defense evaluation as remaining boundaries.

  • Problem

    Existing attacks separate algorithmic backdoor construction from hardware realization, ignoring device-specific and collateral Rowhammer bit-flips that can degrade ASR and TA.

  • Method

    ROBBIN profiles target-DRAM bit-flip patterns, scores parameter sensitivity, and iteratively selects DRAM page mappings using cumulative ASR and TA effects.

  • Results

    Across three DDR4 devices, two architectures, and FP32 and INT8 models, ROBBIN achieves ASR close to 90% while maintaining TA above 83%.

  • Takeaways & Limitations

    Hardware-aware construction makes Rowhammer backdoors robust across tested DRAM devices, while the same profiling information can guide safe model placement.

  • Takeaways & Limitations

    Detectability under live continuous monitoring, including classwise activation-based defenses, remains an important open investigation.

Abstract

from arXiv · show

Existing Rowhammer-based inference-time backdoor attacks design their bit-flip strategies purely at the algorithmic level, without accounting for the bit-flips that the underlying DRAM hardware will actually produce. This disconnection between the algorithmic backdoor construction and its hardware realization leads to unreliable attack performance, as collateral bit-flips at unintended locations degrade both the attack success rate (ASR) on triggered inputs and the test accuracy (TA) for normal inputs. Consequently, the performance of such attacks varies significantly across different DRAM devices, as each device presents a unique set of exploitable bit-flip locations. This work presents ROBBIN, a hardware-aware Rowhammer-based backdoor injection attack that integrates the device-specific vulnerability into the backdoor construction process. ROBBIN first characterizes the bit-flip patterns of a target DRAM and uses this information to iteratively select DRAM \textit{page} mappings for the model weights that would maximize ASR while preserving TA under Rowhammering. By treating every hammering-induced bit-flip as an integral part of the attack design rather than first constructing a hardware-agnostic backdoor and dismissing collateral flips as side effects, ROBBIN produces backdoors that remain robust across devices. Evaluated on ResNet-20 and VGG-16 with CIFAR-10 across three commodity DDR4 chips, ROBBIN consistently achieves close to 90\% ASR while maintaining TA above 83\%, demonstrating reliable backdoor efficacy across diverse DRAM devices.

1 Introduction

Existing inference-time Rowhammer backdoors disconnect algorithmic bit-flip selection from device-specific hardware behavior, making efficacy unreliable across DRAM devices. ROBBIN integrates vulnerability profiles into construction and page selection, achieving robust attack performance across models, quantization formats, and chips.

  • Motivation: Rowhammer enables software-based, non-invasive bit-flips, but vulnerable cells vary significantly across DRAM chips.This device-to-device variability complicates reliable targeting of the required flips.
  • Hardware-software disconnection: Existing attacks assume desired bits can be flipped, despite sparse and device-specific vulnerable cells.Only 0.05% of cells exhibit vulnerability, making perfect algorithmic-to-physical matches difficult.
  • Hardware-software disconnection: Collateral flips at unintended locations unpredictably degrade both ASR on triggered inputs and TA on normal inputs.In FP32, exponent or sign-bit flips can alter weights by orders of magnitude and catastrophically disrupt model behavior.
  • Prior limitations: Prior methods separate backdoor construction from hardware realization, causing unreliable performance across DRAM chips and limited support for quantization schemes.Their designs generally target either INT8 or FP32 representations.
  • ROBBIN: ROBBIN profiles target-device bit-flip patterns and iteratively selects DRAM page mappings that maximize ASR while preserving TA.The method accounts for hammering-induced flips, including collateral ones, during backdoor construction.
  • Evaluation: Across FP32 and INT8 ResNet-20 and VGG-16 models on three DDR4 chips, ROBBIN achieves ASR close to 90% while maintaining TA above 83%.The reported evaluation contrasts with prior works whose performance varies significantly across devices.

2 Background and Related Works

This background introduces DNN backdoors, inference-time memory manipulation, neural-network weight representations, and Rowhammer fault injection. It emphasizes that Rowhammer faults become reproducible yet remain strongly device-specific, challenging hardware-agnostic backdoor designs.

  • DNN backdoor attacks: DNN backdoors preserve correct outputs for benign inputs while producing attacker-controlled predictions for trigger-embedded inputs.The behavior is expressed as f(x_i,w)=y_i for clean inputs and f(x_i+δ,w)=t* for triggered inputs.
  • DNN backdoor attacks: Inference-time attacks manipulate model parameters in memory after deployment, unlike training-time attacks that alter models during development.Such attacks can bypass traditional security checks and leave no forensic traces.
  • Weight representations: FP32 weights have non-uniform bit sensitivity: mantissa flips cause minor perturbations, whereas exponent changes and sign flips can drastically alter parameters.INT8 quantization instead represents weights as signed integers reconstructed using a scaling factor.
  • Rowhammer: Rowhammer repeatedly activates aggressor rows, accelerating charge leakage in neighboring victim-row capacitors and inducing bit-flips.DRAM refresh is typically performed every 64ms for DDR3/DDR4, though timing varies by generation and operating conditions.
  • Rowhammer: Bit-flips accumulate across successive refresh intervals, while n-sided hammering can amplify disturbances by activating aggressors on both sides of a victim row.Modern modules use Target Row Refresh, but the background passage notes that TRR can be bypassed.
  • Rowhammer: DRAM fault patterns are device-specific because manufacturing variations produce unique cell charge-retention and transistor-geometry characteristics.Sustained hammering over 200–500 refresh cycles can stabilize faults into reproducible patterns, yet same-manufacturer chips may still differ vastly.

3 Attack Methodology: ROBBIN

ROBBIN integrates device-specific Rowhammer vulnerability profiles into backdoor construction, then selects DNN-to-DRAM page mappings that improve ASR while preserving TA. Its scoring-and-matching pipeline combines bit-level backdoor sensitivity with hardware realizability and evaluates candidate mappings using actual model inference.

  • DRAM Vulnerability Profiling: ROBBIN profiles target-DRAM bit-flip capabilities and uses them as inputs to hardware-aware backdoor construction.The fault map records bidirectional flips across vulnerable 4KB pages, providing the hardware basis for page selection.
  • Matching: The matching stage greedily assigns each high-scoring DNN page to an unused DRAM page that increases ASR while keeping TA above a threshold.Candidates are selected from the top-K ranked DRAM pages, and pages without an improving valid candidate are skipped.
  • Scoring: The scoring stage ranks DNN data pages by backdoor potential and candidate DRAM pages by realizable bit-flip impact.Bit importance is computed for FP32 and INT8 weights, separated by flip direction, and combined with vulnerability matrices.
  • Search Efficiency: Top-K pruning reduces inference evaluations to at most M×K instead of testing all N vulnerable DRAM pages for every DNN page.The method typically uses K=20 and transforms the otherwise prohibitive assignment search into an efficient greedy procedure.
  • Matching: Candidate mappings are evaluated after applying all profiled bit-flips, capturing nonlinear interactions that static scores cannot represent.This validation tests the realized hardware-induced flips rather than only individually targeted bit changes.
  • Search Efficiency: 90% ASR is reached with only 33–46 DRAM pages out of 265, reflecting diminishing returns as additional assignments are added.The largest ASR gains occur among the first assignments, while later assignments contribute progressively less.

4 Experimental Results

ROBBIN is evaluated across three DDR4 devices, two DNNs, two precision formats, and multiple attack baselines. It combines device profiling with page selection to maintain high ASR and TA while reducing attack complexity.

  • Experimental setup: Across three 8GB DDR4 DIMMs, ROBBIN evaluates ResNet-20 and VGG-16 on CIFAR-10 in FP32 and INT8 formats.The devices are identified as A (SK Hynix), B (Micron), and C (Samsung).
  • DRAM Vulnerability Profiling: Device vulnerability varies widely: Device A has 18,637 vulnerable pages, Device B 96,293, and Device C 159,719.These correspond to 7.1%, 36.7%, and 60.9% of total pages, respectively.
  • DRAM Vulnerability Profiling: 500 refresh cycles produce stable, reproducible bit-flip patterns under 4-row hammering, which ROBBIN uses for predictable fault injection.The method adopts 4-row hammering because it provides sufficient flips while minimizing collateral damage.
  • Attack Parameters: TA remains above 85% up to K=20, while ASR saturates at smaller candidate-pool sizes across ResNet-20 and VGG-16 in both precision formats.Larger K expands coverage but can introduce lower-ranked pages that damage clean accuracy.
  • Attack Parameters: Against internal baselines, ROBBIN achieves high ASR and TA, whereas sensitivity-only, target-only, and random assignments cannot exceed 50% ASR without sacrificing TA.The comparison supports ranking candidates by hardware-aware value and accounting for collateral flips during matching.
  • INT8 Performance: Comparison with Don’t Knock: For INT8 ResNet-20, ROBBIN achieves approximately 90% ASR and 85.4% average TA, compared with 83.1%–87.0% ASR and 80.4% TA for Don’t Knock.For VGG-16, ROBBIN exceeds 90% ASR while Don’t Knock reaches only 62.8%–63.1% ASR, with comparable TA.
  • INT8 Performance: Comparison with Don’t Knock: ROBBIN requires 64%–73% fewer DRAM pages and 25%–30% fewer bit-flips than Don’t Knock for ResNet-20.For VGG-16, reductions reach approximately 79% fewer pages and 87%–89% fewer bit-flips on Devices B and C.

5 Practical Security Implications

ROBBIN’s practical implications include scalability, transient persistence, detectability limits, and a software-mediated countermeasure based on vulnerability-aware page allocation. The countermeasure can restore clean accuracy and reduce attack success, but its memory cost depends on device vulnerability density.

  • 5.1 Scalability to Larger Datasets and Models: 84.4% ASR on CIFAR-10 and 97.7% ASR on ImageNet demonstrate scalability to INT8 ResNet-50 across deeper models and larger label spaces.Clean accuracy decreases from 90.9% to 87.3% on CIFAR-10 and from 88.8% to 84.9% on ImageNet.
  • 5.2 Detectability: ROBBIN’s backdoor disappears when the model is reloaded from disk because its bit-flips remain only in the DRAM-resident copy.The weights revert to their clean state and evidence of the backdoor disappears after reloading.
  • 5.2 Detectability: Reload-based audits can miss ROBBIN, while detectability under continuous runtime monitoring remains an open investigation.Neural Cleanse, STRIP, and PSBD operate on loaded model instances; Activation Clustering under live monitoring is not evaluated.
  • 5.3 Proposed Countermeasure: Vulnerability-aware page allocation can exclude profiled vulnerable pages from model-weight placement, leaving ROBBIN without exploitable placements.The defense is software mediated but requires allocator support to control physical placement during model loading.
  • 5.3 Proposed Countermeasure: On Device B, blacklisting restores INT8 clean accuracy from 86% to 91% while reducing ASR from 95% to 62%.For FP32, clean accuracy rises from 85% to 91% while ASR falls from 90% to 49%.

6 Conclusion

ROBBIN integrates device-specific DRAM vulnerability profiles into backdoor construction, addressing unreliable performance caused by separating bit-flip injection from backdoor design.

  • ROBBIN is a hardware-aware Rowhammer-based inference-time backdoor attack that incorporates target-device DRAM vulnerability profiles into backdoor construction.
  • Separating bit-flip injection from backdoor design makes attack performance unreliable across DRAM chips.
  • By accounting for target-device physical characteristics, ROBBIN uses commodity DRAM irregularities as a reliable attack primitive.
  • ROBBIN achieves ASR close to 90%.
Loading 2608.23774v1…