PaperlayerView exact revision on arXiv

Source-linked AI summary

BARE-AI: Bit-Flip Attack Resilience in AI Hardware through Built-in Performance Monitors

Habibur Rahaman, Swastik Bhattacharya, Sanjay Das, Kanad Basu, Swarup Bhunia

arXiv:2610.08739v1cs.CR

TL;DR

A few memory-level bit flips can sharply degrade DNN accuracy, while existing defenses have overhead or runtime and targeted-attack limitations. BARE-AI monitors per-layer activation behavior to detect, localize, and mitigate attacks during inference. It reports high detection across vision and language models, near-clean recovery for CNNs and ViTs, and partial recovery for LLMs.

  • Problem

    A few bit flips in stored DNN weights can cause severe accuracy degradation or targeted misclassification in safety-critical applications.

    Source: §I · p. 1

  • Method

    BARE-AI uses per-layer activation counters and an on-chip PULSE detector to detect attacks, with ASI localization and z-score-based weight repair.

    Source: §I · p. 2, §A.1 · p. 4

  • Results

    BARE-AI detects faults with up to 98% accuracy on vision models and 74% to 95% on language models, with near-clean recovery for CNNs and ViTs and partial recovery for LLMs.

    Source: §VI · p. 14

  • Takeaways & Limitations

    BARE-AI's monitoring cost remains constant regardless of attack strength, unlike ECC overhead, which grows with resiliency requirements.

    Source: §V · p. 14

    Recovery is partial for deep language models.

    Source: §VI · p. 14

Abstract

from arXiv · show

Deep Neural Networks (DNNs) are integral to many safety critical systems, yet they remain highly vulnerable to bit-flip attacks (BFAs), where a few memory level perturbations can drastically degrade accuracy. Existing defenses incur significant hardware overhead, depend on retraining, or fail against targeted flips. We propose BARE-AI, a runtime framework that detects, localizes, and mitigates BFAs during inference. BARE-AI introduces AI Performance Counters (APCs), lightweight hardware monitors in the accelerator datapath that capture per-layer activation statistics such as sparsity, entropy, kurtosis, and spectral shift. These are analyzed by the Predictive Unit for Layer Security Evaluation (PULSE), a compact detector trained offline as an ensemble of classifiers and realized on-chip as a small neural engine. For explainability and recovery, BARE-AI introduces an Activation Shift Index (ASI) for layer level fault localization and a z-score based repair that resets anomalous weights toward clean layer statistics. Across CNNs, Vision Transformers, and Large Language Models under random, targeted, adaptive, and magnitude based BFAs, BARE-AI achieves up to 98% detection accuracy on vision models and 74% to 95% on language models, restores near clean accuracy for CNNs and ViTs, and provides partial recovery for LLMs. Synthesized at 28nm, the monitoring infrastructure incurs under 3% energy, under 4% area, and about 10% latency overhead, with a configurable operating point that reduces latency overhead to about 6%. Unlike error correcting codes, whose redundancy grows with the number of tolerated flips, BARE-AI's overhead remains constant regardless of attack strength, making it attractive for resource constrained, safety critical edge applications such as autonomous systems, energy, and healthcare.

I. INTRODUCTION

Bit-flip attacks can severely degrade safety-critical DNNs through a small number of weight-memory perturbations, while existing defenses have runtime, overhead, or attack-coverage limitations. BARE-AI combines activation monitoring, detection, layer localization, and statistical repair in a hardware-integrated runtime framework evaluated across vision and language models.

I. INTRODUCTION

  • 13 bit flips out of 93 million reduced quantized ResNet-18 top-1 accuracy from 69.8% to 0.1%, illustrating the severity of weight-memory attacks.The paper also notes that single-digit flips can collapse billion-parameter LLM performance.Source: §I · p. 1
  • Existing ECC, retraining-based, and software defenses have limitations including targeted-flip vulnerability, lack of runtime localization, overhead, or deployment constraints.ECC and redundancy incur power, latency, and area costs; retraining-based defenses may weaken against targeted or adaptive attacks.Source: §I · p. 2
  • BARE-AI unifies runtime detection, layer localization, and mitigation through activation-level monitoring without weight inspection, retraining, or DNN architectural modification.Its monitoring cost is constant with attack strength, unlike ECC redundancy, which grows with tolerated flips.Source: §I · p. 2
  • APCs capture per-layer activation statistics, which PULSE analyzes using an offline-trained ensemble realized on-chip as a compact neural engine.Tracked runtime metrics include sparsity, entropy, kurtosis, and cosine drift.Source: §I · p. 2
  • ASI localizes affected layers, while z-score-based correction resets anomalous weights toward clean layer statistics while preserving benign parameters.The framework is evaluated across CNNs, Vision Transformers, and LLMs under random, targeted, adaptive, and magnitude-based attacks; the paper reports near-clean recovery for CNNs and ViTs and partial recovery for deep language models.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

This section introduces the threat model for bit-flip attacks and reviews proposed defenses.

II. BACKGROUND AND RELATED WORK

  • The section frames bit-flip attacks and surveys defenses proposed to address them.Source: §II · p. 2

A. Threat Model and Attack Surface

The threat model considers adversaries that corrupt stored DNN weights through bit flips, using several search strategies and physical or software-mediated fault mechanisms. The resulting faults can range from isolated errors to bursts and may compromise model integrity.

A. Threat Model and Attack Surface

  • Adversaries compromise deployed DNN integrity by inducing bit flips in stored weights across FP32, FP16/BF16, or INT8 formats in DRAM, SRAM, or cache.Source: A. Threat Model and Attack Surface · p. 3
  • Attackers may use gradient-guided or heuristic searches, including Progressive Bit Search and Targeted Bit-Flip Attacks, to find sensitive weight bits.Source: A. Threat Model and Attack Surface · p. 3
  • Fault mechanisms include Rowhammer, voltage or clock glitching, electromagnetic or laser injection, and software stressors, producing isolated, clustered, or burst perturbations.Such perturbations can evade simple error-correcting codes or overwhelm hardware scrubbing and propagate across layers.Source: A. Threat Model and Attack Surface · p. 3

B. Defenses of Bit-Flip Attacks (BFAs)

Prior BFA defenses span hardware, training-time, system, and software approaches, with limitations in runtime recovery, overhead, or deployment. BARE-AI combines activation-statistic monitoring, localization, and statistical repair in a runtime pipeline intended to apply across model architectures.

B. Defenses of Bit-Flip Attacks (BFAs)

  • Existing defenses include hardware ECC, scrambling, and redundant execution; training-time robustness methods; system monitoring; and software protection or repair.Source: B. Defenses of Bit-Flip Attacks (BFAs) · p. 3
  • These approaches can incur overhead, require retraining or architecture-specific changes, lack runtime localization or recovery, or depend on hardware and static configurations.ECC is ineffective against targeted adversarial flips, while training-time defenses do not provide runtime fault detection or recovery.Source: B. Defenses of Bit-Flip Attacks (BFAs) · p. 3
  • BARE-AI uses dedicated per-layer activation-statistic counters and integrates runtime detection, layer localization, and statistical repair in one pipeline.Unlike general-purpose CPU counters, its counters observe activation behavior directly; unlike prior activation fingerprinting, the pipeline also localizes and repairs.Source: B. Defenses of Bit-Flip Attacks (BFAs) · p. 3
  • The same monitoring infrastructure is presented as applicable across CNNs, Vision Transformers, and LLMs because it tracks generic activation statistics rather than architecture-specific structures.The paper characterizes the contribution as a co-designed system and hardware realization, including ASI localization and evidence of discriminative power under quantization, adaptive attacks, and cross-domain transfer.Source: B. Defenses of Bit-Flip Attacks (BFAs) · p. 3

C. Model Quantization

The section describes quantization as a way to reduce DNN computation and memory demands, and adopts BitsAndBytes INT8 post-training quantization to evaluate BARE-AI against bit-flip attacks.

C. Model Quantization

  • BitsAndBytes-based INT8 post-training quantization is adopted to evaluate BARE-AI against bit-flip attacks on quantized models.The approach operates on pretrained models without retraining or access to training data.Source: C. Model Quantization · p. 3
  • Quantization converts floating-point weights and activations to low-bit formats such as INT8, reducing memory and bandwidth requirements.Well-designed schemes can preserve accuracy and reduce inference latency even with aggressive bit-width reductions.Source: C. Model Quantization · p. 3
  • LLM.int8() applies 8-bit computation to most weights while processing rare large-magnitude outliers at 16 bits.The passage reports that this allows over 99.9% of matrix operations to run in INT8.Source: C. Model Quantization · p. 3

III. METHODOLOGY

BARE-AI uses layer-wise behavioral signals, termed APC metrics, to detect and recover from bit-flip attacks; Table I identifies the AI accelerator metrics extracted by APC.

III. METHODOLOGY

  • Table I is identified as the inventory of AI accelerator metrics extracted by APC.The section describes these metrics as layer-wise behavioral signals.Source: §III · p. 3, Table I · p. 4
  • BARE-AI uses layer-wise behavioral signals, termed AI Performance Counter (APC) metrics, to detect and recover from bit-flip attacks.The framework does not require retraining the protected model.Source: §III · pp. 3–4
  • The framework's stated scope includes both detecting and recovering from bit-flip attacks.The passage states that it does not require retraining.Source: §III · p. 4

A. BARE-AI Framework

BARE-AI combines per-layer activation monitoring, PULSE detection, ASI-based fault localization, and z-score weight repair in a runtime defense pipeline. The section describes its profiling and deployment workflow, monitor-security assumptions, and evaluation under bit-flip attacks.

A. BARE-AI Framework

  • BARE-AI combines APC extraction, PULSE classification, ASI localization, and z-score restoration in a runtime defense pipeline.The framework describes this as four operations for identifying and mitigating bit-flip attacks.Source: A. BARE-AI Framework · p. 4, §B.5 · p. 7

A.1 AI Performance Counters (APCs):

  • APCs collect per-layer activation statistics in the accelerator, forming behavioral fingerprints that PULSE analyzes during inference.The APC includes a counter array, FSM controller, and memory block, with configurable counter selection.Source: §A.1 · p. 4

A.2 ML based Analysis Engine (PULSE):

  • PULSE trains an ensemble of Random Forest, XGBoost, and LSTM classifiers offline, then deploys its learned function as a compact three-layer neural engine.The LSTM captures temporal and inter-layer dynamics; the deployed engine uses a 16-8-4 neuron configuration.Source: §A.2 · p. 4, §B.2 · p. 7

A.3 Threat Model and Security of the Monitoring In-

  • The stated threat model permits DRAM fault injection, white-box bit selection, arbitrary inputs, and attacker knowledge of BARE-AI, but excludes physical modification of the die and trusted firmware.The monitor's APC and PULSE state resides in on-die SRAM and registers; the authors also leave formal power and electromagnetic side-channel evaluation to future work.Source: §A.3 · pp. 5–6

B.3 BFA Attack Detection via PULSE:

  • At inference, PULSE compares runtime APC deviations with profiled clean behavior, using normalized features and adaptive thresholds to detect adversarial patterns.The clean model is not executed at runtime; deviations are computed against its stored reference profile.Source: B. Bit-flip Attack Detection &… · p. 6, §B.3 · p. 7

B.1 APC Feature Extraction:

  • Offline profiling runs clean and attacked models to collect labeled per-layer APC features and store clean reference statistics for runtime use.The stored reference requires only a few scalars per layer, not a duplicate model.Source: §B.1 · p. 6, §B.3 · p. 7

B.4 Attack Layer Localization:

  • ASI measures each layer's normalized deviation from its clean reference, and a threshold on the deviation identifies layers for mitigation.The stated cutoff is ∆ℓ > µ∆ + 2σ∆.Source: §B.4 · p. 7
  • For flagged layers, z-score filtering resets anomalous weights to the clean layer mean, but restores statistical regularity rather than exact original values.Recovery is strongest when flipped weights are extreme outliers; the method stores no golden weight copy.Source: §B.5 · p. 7

A. Experimental Setup

BARE-AI was evaluated across CNNs, Vision Transformers, and language models under multiple bit-flip strategies. Detection and recovery were validated in software on a GPU, while hardware overhead was measured through 28nm synthesis.

A. Experimental Setup

  • The evaluation spans AlexNet, VGG-16, ResNet-18, ResNet-50, ViT-B, MobileNetV2, and LLaMA-3.2-1B across ImageNet-1K and MMLU.Attacks include random bit flips and Progressive Bit Search; additional language-model evaluations are reported in corresponding tables.Source: A. Experimental Setup · p. 7
  • Detection and recovery were evaluated on an NVIDIA RTX A6000 using software-emulated APC extraction, while hardware overhead came from 28nm synthesis.The hardware measurements are not derived from GPU profiling.Source: A. Experimental Setup · pp. 7–8
  • The synthesized APC and PULSE subsystem uses a Random Forest, XGBoost, and LSTM ensemble for detection, with ASI localization and z-score restoration.Experiments were repeated across multiple attack seeds, and ECC-based baselines were also evaluated.Source: A. Experimental Setup · p. 8

B. Choosing Critical BARE-AI APCs for Attack Detection

BARE-AI uses complementary activation counters because bit flips shift layer statistics unevenly. Sparsity is particularly discriminative in the reported comparisons, while feature rankings also identify loss, error, and norm statistics as important contributors.

B. Choosing Critical BARE-AI APCs for Attack Detection

  • Bit flips produce subtle but consistent shifts in mean activation values that accumulate across layers and destabilize downstream predictions.The changes may not be visually evident in weight distributions.Source: B. Choosing Critical BARE-AI APCs for… · p. 8
  • Sparsity drops under attack while entropy remains relatively stable, making sparsity a stronger discriminator for some layers.The full-depth comparison also shows consistently suppressed attacked-model sparsity.Source: Figure 6 · p. 8, B. Choosing Critical BARE-AI APCs for… · p. 8
  • Random Forest feature-importance rankings identify loss, mean square error, L1/L2 norms, sparsity, and zero ratios as dominant APC categories.The ranking aggregates importance by feature category, supporting the use of heterogeneous counters rather than one metric.Source: Figure 7 · p. 9, B. Choosing Critical BARE-AI APCs for… · p. 9

C. BARE-AI Performance Analysis

  • 93% for ViT-B, 92% for ResNet-50, and 91% for MobileNetV2 were the average detection rates across three bit-flip strategies on ImageNet-1K.The most destructive reported case, PBS on ResNet-50, reduced accuracy from 80% to 22%.Source: C. BARE-AI Performance Analysis · p. 9

C.1 Detection Performance:

BARE-AI detects attacks across bit groups, attack strategies, and model domains, while its recovery is strongest for vision models and remains partial for deep language models. The results also identify weaker detection for subtle mantissa flips and constraints on recovery under transformer depth and magnitude-based attacks.

C.1 Detection Performance:

  • 95–98% detection accuracy for exponent flips, 90–93% for sign flips, and 70–75% for mantissa flips characterize the bit-group results.False negatives are 1–2% for exponent flips, up to 7% for sign flips, and 15–20% for mantissa flips.Source: §C.1 · p. 9, Table III · p. 10
  • A 1.7% accuracy drop occurs when PULSE is trained on Progressive Bit Search and tested on Random Bit-Flip; cross-domain accuracy reaches 94.8%, with under a 3% drop across CNN-to-ViT transfer.PULSE can incrementally update with new APC traces without retraining its base model.Source: §C.1 · p. 9, Table IV · p. 10, Table V · p. 10
  • Above 91% detection accuracy for one random bit flip rises to 97.4% for eight flips, with false alarm rates below 4%.The tests injected 1, 2, 4, or 8 flips into ResNet-18 and ViT-B across 200 randomized trials per configuration.Source: §C.1 · p. 9, Table VI · p. 10

C.3 Attack Mitigation

  • Near-clean recovery is reported for vision models, while deep language-model recovery is partial; under INT8 inference, detection exceeds 95% and recovery exceeds 89% for the evaluated vision models.For LLaMA-3.2-1B with 100 flips, mitigation raises accuracy from 22% to 27%; transformer depth and mean substitution limit restoration.Source: §C.3 · pp. 10–11

C.1 Detection Performance:

  • 95.1–97.6% detection accuracy with false negatives below 4.5% holds for distributed multi-bit attacks, while adaptive attacks achieve at least 93.8% accuracy with false negatives below 5.8%.The reported decision latency is about 6 cycles; LSTM temporal aggregation and cross-layer covariance checks help capture persistent deviations.Source: §C.1 · p. 10, Table VII · p. 11
  • ASI localizes the strongest anomaly to ResNet-18’s first convolution layer and BERT-Large’s encoder.6.output.dense layer, alongside severe accuracy drops.The reported drops are 66.12% for ResNet-18 and from 91% to 1.25% for BERT-Large.Source: §C.2 · p. 10, Table VIII · p. 11

C.4 Impact of Magnitude-Based (DNL) Bit-Flip At-

  • Above 95% detection across vision models under DNL attacks accompanies recovery from 29.3% to 46.9% for ResNet-18 and from 24.9% to 41.8% for ViT-B under 100 flips.For LLaMA-3.2-1B and Qwen3-0.6B, 100 sign-bit flips reduce accuracy to 21.5% and 14.8%, respectively; recovery reaches up to 13% absolute accuracy.Source: §C.4 · p. 11

C.3 Attack Mitigation

  • More than 92% detection and 88% recovery accuracy with below 4% false alarms are reported for large-scale scenarios of up to 100 targeted or 1000 random flips.The compared range-restricted and boundary-aware methods have 10–15% higher false negatives and degrade beyond 200 flips.Source: §C.3 · pp. 10–11, Table X · p. 11

D. Hardware Overhead for BARE-AI

The BARE-AI monitoring subsystem is independently synthesized at 28nm, with reported overhead measured relative to scaled Eyeriss accelerator estimates. Selecting a smaller APC budget trades counter coverage for lower timing overhead while retaining high detection accuracy.

D. Hardware Overhead for BARE-AI

  • The APC area grows from 0.037mm2 in AlexNet to 0.217mm2 in VGG-16, while the PULSE core remains 0.043mm2 across models.The APC + PULSE subsystem is synthesized at 28nm; the Eyeriss accelerator area baseline is scaled from prior silicon measurements rather than measured silicon for each model.Source: D. Hardware Overhead for BARE-AI · p. 12
  • Across all models, the paper reports that integrating BARE-AI increases average inference time by 10.21% and energy consumption by roughly 3%; the estimates assume the stated 28nm ported Eyeriss architecture.Source: D. Hardware Overhead for BARE-AI · p. 12

E. APC Budget vs. Detection Accuracy and Overhead

V. DISCUSSIONS

BARE-AI’s discussion contrasts its constant-cost monitoring with ECC overhead that grows with attack strength, while its conclusion reports detection and recovery results across vision and language models. The authors also identify weaker detection for low-magnitude mantissa flips and partial recovery for deep language models.

V. DISCUSSIONS

  • APC/PULSE monitoring operates at inference time, avoids retraining and prior fault identification for weight reconstruction with ECC, and is independent of model and precision.The framework requires no storage-format changes and can operate alongside ECC.Source: §V · pp. 12–13
  • Detection weakens for low-magnitude mantissa flips, and recovery remains partial for deep language models.The discussion states that BARE-AI’s guarantees rest on the monitor security analysis in Section III-A3.Source: §V · p. 13, §VI · p. 14
  • ECC overhead grows as O(t), while BARE-AI overhead remains O(1) regardless of attack strength.The discussion links ECC’s increasing redundancy to clustered multi-bit flips and notes that the small monitoring base is cheap to protect.Source: §V · p. 14

VI. CONCLUSION

  • Up to 98% detection accuracy on vision models and between 74% and 95% on language models accompanies near-clean recovery for CNNs and ViTs, but only partial recovery for LLMs.The conclusion attributes LLM recovery limits to errors accumulating across the transformer stack.Source: §VI · p. 14
  • Below 3% energy, below 4% area, and approximately 10% latency overhead—reducible to about 6%—are reported for BARE-AI.Source: §VI · p. 14
  • BARE-AI captures runtime deviations from random, targeted, adaptive, and magnitude-based bit flips across CNNs, Vision Transformers, and LLMs.Source: §VI · p. 14

Related papers

Loading 2610.08739v1…