RECORD
Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
Computer Vision and Pattern Recognition · Submitted 28 Mar 2019
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN's parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. | background 1.00 | 0.04 | 0.02 | asserted 0.99 |
| s1 | The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. | background 1.00 | 0.04 | 0.02 | asserted 1.00 |
| s2 | Nevertheless, the security challenge of DNN's parameters is not well explored yet. | gap 1.00 | 0.05 | 0.03 | asserted 0.99 |
| s3 | In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). | contribution 1.00 | 0.91 | 0.49 | asserted 1.00 |
| s4 | The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. | contribution 0.73 | 0.77 | 0.19 | hedged possibility 0.58 |
| s5 | Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. | method 0.94 | 0.90 | 0.07 | asserted 1.00 |
| s6 | With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%. | result 1.00 | 0.96 | 0.60 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v2
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN's parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.
Human review
How the literature uses it
3 arXiv papers cite this in 3 sentences
Papers citing it · 1 sentence without a confident label
Cites it as background 2 papers
-
Among all, several major security concerns are adversarial input/example attack [ref] , adversarial parameter attack [ref] and Trojan attack [ref] .
TBT: Targeted Neural Network Attack with Bit Trojan · Introduction · 0.92
-
In [ref] , several security attack methods were tested to find specific error patterns that can cause serious damage to neural networks' performance.
Functional Error Correction for Robust Neural Networks · Overview of Related Works · 0.99
What it cites · 7 sentences without a confident label
Uses the method or tool of 3 papers
-
For training the quantized DNN with non-differential stair-case function (in <ref>), we use the straight-through estimator [ref] as other works [ref] .
Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation · Quantization and Encoding · 1.00
-
For training the quantized DNN with non-differential stair-case function (in <ref>), we use the straight-through estimator [ref] as other works [ref] .
DoReFa-Net: Training Low Bitwidth Convolutional Neural Networks with Low Bitwidth Gradients · Quantization and Encoding · 1.00
-
In this work, we perform the BFA utilizing the similar mechanism as FGSM [ref] , which was used to generate adversarial example.
Explaining and Harnessing Adversarial Examples · Bit-Flip Attack · 0.97
Cites as background 5 papers
-
Adversarial example [ref] (aka., adversarial attack) is a well-known security issue of DNN, which can cause the system malfunction with the magnitude-constrained input noise that mankind cannot discern.
Explaining and Harnessing Adversarial Examples · Introduction · 0.95
-
Both attack and defense of adversarial example on the input end of DNN has been heavily investigated in the past couple of years [ref] and still be in progress [ref] .
Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attack · Introduction · 0.93
-
Neural network parameters have been attacked using different levels of hardware trojans, which require a specific pattern of input to trigger the trojan inside the network [ref] .
Hardware Trojan Attacks on Neural Networks · Related Work · 0.84
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.