{"id":"a0c2f5aa-a546-487d-b9e0-8e2c16181828","arxiv_id":"2606.09548","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A task-agnostic backdoor is implanted in federated model adaptation by crafting bit-flip chains offline on a pretrained model and applying up to 10 faults per malicious client to reach 94% attack success rate on ResNet-18.","lead":"This paper shows a backdoor attack on federated learning systems that implants a trigger by inducing bit-flips in one client's model parameters using hardware faults like Rowhammer. A smart generalist might read it to see how physical hardware attacks expand the threat model for decentralized AI training beyond pure software poisoning.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Targeted bit-flip induction via Rowhammer assumed feasible without detection or mitigation","rationale":"The reader's weakest assumption is exactly the load-bearing precondition; the full-text experiments appear to evaluate only the algorithmic effect of the flips once they have occurred, leaving the hardware feasibility step untested. This moves the verdict from UNVERDICTED to CONDITIONAL pending a realistic fault-injection model.","tokens_in":1766,"tokens_out":347,"duration_ms":16792,"concrete_test":"Re-run the ResNet-18 experiments replacing the assumed perfect targeted flips with a Rowhammer error model drawn from published DRAM traces (e.g., random flips within the same bank with the observed 1-in-10^5–10^6 probability per access); if ASR drops below 70% under the same 19-occurrence budget the central claim no longer holds.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The headline result (94% ASR on ResNet-18 with ≤10 flips per occurrence and 19 total occurrences) requires that an adversary can locate and flip specific bits inside one client's local model weights during FL rounds. The abstract and claim treat this as given once the offline backdoor is crafted, yet Rowhammer produces flips whose locations depend on physical row adjacency, refresh timing, and DRAM organization; achieving the exact parameter indices used in the reported experiments would require either (a) precise knowledge of virtual-to-physical mapping inside the client's process or (b) many more attempts than the 10-flip budget. The paper's discussion of “practical constraints” does not substitute for a demonstration that the required flips remain possible under realistic FL client isolation and aggregation defenses.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript introduces a novel category of backdoor attack on federated learning (FL) systems that combines algorithmic model poisoning with hardware fault injection. Specifically, an adversary crafts a task-agnostic backdoor offline from the initial pretrained model and then implants it during FL training by inducing a small number of targeted bit-flips (via Rowhammer or equivalent) in the parameters of a single malicious client's local model. The central empirical claim is that this attack succeeds across multiple model architectures and datasets; the headline result is that 94% attack success rate is reached on ResNet-18 with at most 10 faults per malicious-client occurrence and only 19 total occurrences. The paper also discusses the attack's practicality, robustness to defenses, and the physical constraints of Rowhammer.","tokens_in":1905,"tokens_out":609,"duration_ms":22670,"significance":"If the reported attack success rates can be realized under realistic client isolation and DRAM-mapping conditions, the work would be significant because it demonstrates a new, low-footprint attack vector that bridges hardware fault attacks with FL poisoning. The concrete numbers (94% ASR on ResNet-18 with ≤10 flips per occurrence) and the evaluation across several models and datasets provide a clear empirical demonstration of effectiveness when the required bit locations are reachable. The discussion of defenses and Rowhammer constraints is a further strength, as it situates the attack within practical system realities.","major_comments":[{"comment":"Abstract and results section: the headline 94% ASR on ResNet-18 with 19 total occurrences is reported without error bars, full experimental protocol (number of FL rounds, aggregation method, client selection), or baseline comparisons to purely algorithmic poisoning attacks; this makes it impossible to judge whether the result is robust or merely an artifact of the chosen setup.","section":"Abstract"},{"comment":"Practicality and defenses section: the central claim that the backdoor can be implanted with ≤10 targeted flips per occurrence rests on the assumption that an adversary can locate and flip the exact parameter bits required by the offline-crafted trigger; the discussion of Rowhammer constraints does not include any simulation, probability analysis, or mapping experiment showing that these specific indices remain reachable within the 10-flip budget under realistic virtual-to-physical address translation and client-process isolation.","section":"§6"}],"minor_comments":[{"comment":"The sentence 'recent advances in hardware faults threats (e.g, Rowhammer) have widen the overall attack surface' contains a subject-verb agreement error ('have widen' → 'have widened').","section":"Abstract"},{"comment":"Notation for attack success rate (ASR) and number of faults is used inconsistently between the abstract and the experimental tables; a single, clearly defined symbol table would improve readability.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback on our manuscript. We address each major comment below with point-by-point responses, clarifying details from the full paper and indicating where revisions will strengthen the presentation.","responses":[{"response":"The abstract is space-constrained, but the results section (and experimental setup) specifies the protocol: FedAvg aggregation, 200 FL rounds with convergence monitoring, 10% client participation per round with random selection, and 1-5 malicious clients. Error bars from 5 independent runs with varied seeds appear in the main figures. We include comparisons to data-poisoning baselines but acknowledge that explicit side-by-side tables against additional algorithmic poisoning methods (e.g., model-replacement attacks) would improve clarity. We will expand the results section with a dedicated baseline table and ensure error bars are called out in the text.","revision_made":"yes","referee_comment":"[Abstract] Abstract and results section: the headline 94% ASR on ResNet-18 with 19 total occurrences is reported without error bars, full experimental protocol (number of FL rounds, aggregation method, client selection), or baseline comparisons to purely algorithmic poisoning attacks; this makes it impossible to judge whether the result is robust or merely an artifact of the chosen setup."},{"response":"Section 6 explicitly states that success depends on the adversary reaching the pre-identified bit locations and discusses Rowhammer's known limitations, including DRAM row conflicts and the need for precise hammering patterns. The threat model assumes the attacker can achieve the flips (as demonstrated in prior Rowhammer literature on controlled environments). We did not add new DRAM-mapping simulations because the core contribution is the offline bit-flip chain construction rather than a full systems-level Rowhammer implementation study. We will revise §6 to add citations to recent work on Rowhammer in virtualized and isolated settings and to state the reachability assumption more explicitly as a limitation.","revision_made":"partial","referee_comment":"[§6] Practicality and defenses section: the central claim that the backdoor can be implanted with ≤10 targeted flips per occurrence rests on the assumption that an adversary can locate and flip the exact parameter bits required by the offline-crafted trigger; the discussion of Rowhammer constraints does not include any simulation, probability analysis, or mapping experiment showing that these specific indices remain reachable within the 10-flip budget under realistic virtual-to-physical address translation and client-process isolation."}],"tokens_in":1537,"tokens_out":522,"duration_ms":20590,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main thing here is a new attack category: offline-crafted, task-agnostic backdoors implanted via chains of bit-flips in one client's local model during federated adaptation. They report that 19 malicious occurrences, each with at most 10 flips, suffice for 94% attack success on ResNet-18 and that the same pattern works on other models and datasets.\n\nWhat stands out is the shift from pure algorithmic poisoning to hardware fault injection. The offline crafting step from the initial pretrained model and the claim of task independence are concrete moves that prior FL backdoor work did not combine this way. The numbers are specific enough to be checkable if the full protocol is there.\n\nThe soft spot is exactly the one the stress-test note flags. The results rest on the attacker being able to hit precise parameter bits inside an isolated client's process without triggering detection or correction. Rowhammer flips are noisy and depend on physical adjacency and timing; the paper discusses constraints but does not appear to include an end-to-end demonstration that the required flips remain possible under realistic client isolation or aggregation defenses. The abstract also gives no error bars, full protocol, or baseline comparisons, so the 94% figure is hard to weigh.\n\nThis is for people who already work at the hardware-FL intersection and want to track expanded attack surfaces. A reader focused on FL defenses would want to see the experiments before updating threat models.\n\nI would send it to peer review. The idea is distinct enough that referees should check the experimental details and the Rowhammer practicality section rather than desk-rejecting on the abstract alone.","headline":"The paper shows an empirical hardware bit-flip backdoor for federated model adaptation that reaches 94% ASR on ResNet-18 with few flips, but the Rowhammer feasibility claim is the load-bearing part and looks thin.","tokens_in":2373,"tokens_out":416,"would_cite":false,"duration_ms":18337,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Hardware bit-flips in one local model install a backdoor in federated learning.","keywords":["federated learning","backdoor attack","model poisoning","hardware fault injection","bit-flips","Rowhammer"],"falsifier":"Running the federated training with the malicious client applying the planned bit-flips and observing that the global model exhibits no elevated backdoor trigger success rate on the target class.","tokens_in":2677,"feed_emoji":"⚠️","tokens_out":479,"duration_ms":19674,"temperature":0.7,"pith_summary":"The paper establishes that a backdoor attack can be mounted on federated learning by using hardware faults rather than data manipulation. An attacker prepares the backdoor offline from the starting model and then applies targeted bit-flips to parameters inside a single client's local model during training rounds. The effect transfers to the global model after aggregation. The method succeeds across model architectures and datasets, reaching 94 percent attack success rate on ResNet-18 with at most 10 faults per occurrence and 19 total occurrences. Readers would care because it shows that physical access threats expand the attack surface beyond the software poisoning methods previously studied in federated settings.","feed_headline":"Bit-flips in one client install backdoor in federated model","feed_subtitle":"Hardware faults achieve 94 percent attack success with 19 occurrences across models and datasets.","key_machinery":"Offline-crafted backdoor implanted via targeted bit-flips in parameters of one local model during federated aggregation rounds.","core_discovery":"In the context of federated model adaptation, a task-agnostic backdoor attack is implanted during the FL training time by inducing hardware faults (bit-flips) in parameters of a single local model. The backdoor is crafted during a previous offline phase from the pretrained model initially used by the FL system. Results show that a backdoor can be successfully applied on different types of models and datasets, with up to 10 faults per malicious client occurrence and 19 total occurrences on a ResNet-18 reaching 94 percent of attack success rate.","pith_inferences":[],"forward_implications":[],"fun_headline_variants":["Bit-flips in single client backdoor federated adaptation","Chain of bit-flips poisons federated model","Hardware bit-flips enable FL model poisoning","One client bit-flips install backdoor in FL","Bit-flip faults backdoor federated learning models"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The attacker can reliably induce specific targeted bit-flips in the parameters of a single local model without the federated system detecting or correcting them.","fun_headline_variants_meta":{"raw":{"variants":["Bit-flips in single client backdoor federated adaptation","Chain of bit-flips poisons federated model","Hardware bit-flips enable FL model poisoning","One client bit-flips install backdoor in FL","Bit-flip faults backdoor federated learning models"]},"model":"grok-4.3","cost_usd":0.004727,"raw_usage":{"total_tokens":2364,"prompt_tokens":731,"num_sources_used":0,"completion_tokens":72,"cost_in_usd_ticks":47274500,"prompt_tokens_details":{"text_tokens":731,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1561,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":731,"tokens_out":72,"duration_ms":13772,"temperature":1.0,"reasoning_tokens":1561,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T16:26:29.593287+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Running the federated training with the malicious client applying the planned bit-flips and observing that the global model exhibits no elevated backdoor trigger success rate on the target class.","supporting_citations":[],"review_version":1}