Pith. sign in

REVIEW 4 major objections 6 minor 55 references

ObfusBFA: A Holistic Approach to Safeguarding DNNs from Different Types of Bit-Flip Attacks

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ObfusBFA scrambles the positions of vulnerable bits, turning targeted bit-flip attacks into harmless random flips.

desk verdict A plausible, broad BFA defense with a real gap: the paper's own adaptive results show accuracy drops that contradict its utility-preservation claim. read the letter →

arxiv 2506.10744 v1 pith:NEKKQCWC submitted 2025-06-12 cs.CR

Xiaobei Yan , Han Qiu , Tianwei Zhang This is my paper · ORCID
classification cs.CR
keywords bit-flipattacksDNNrobustnessobfuscationmemorylayoutrandomizationRowhammerdummyoperationsTVMcompilerOpenBLAS
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Bit-flip attacks ruin a DNN by toggling a handful of carefully chosen bits in the model weights or in the compiled code that runs the model. ObfusBFA claims to stop this entire family of attacks with one mechanism: insert harmless dummy operations—extra identity layers and zero-weight neurons in the model, NOP instructions in the binaries—so every attack-critical bit moves to a random new memory location. The attacker's carefully aimed flips then land on ordinary bits, and the paper argues and demonstrates that random flips almost never hurt inference. Against six state-of-the-art attacks, the defense keeps accuracy essentially unchanged, pushes attack success rates to near zero, and adds no more than about five percent time overhead.

What carries the argument

Three components carry the argument. A Vulnerability Searcher ranks model weights by gradient magnitude to find the top-k critical weights, and for binaries flips each conditional jump opcode to its semantic opposite to see which flips lower inference accuracy. An Obfuscation Pattern Generator inserts random numbers of dummy operations—identity layers or zero-weight neurons for the model, NOP instructions for code—and re-runs the search until the new vulnerable-address list is disjoint from the old one. An Obfuscation Pattern Enforcer loads the rebuilt model, library, or executable at runtime, using LD_PRELOAD for shared libraries, and regenerates the pattern periodically so an adaptive attacker who reverse-engineers one binary faces a fresh layout.

What would settle it

Flip each of the 154,554 conditional jumps in the OpenBLAS library the paper tested: the authors report 148 crash or time out, so measuring whether an attacker who simply flips a large random sample of instructions can force a denial of service with affordable flips would falsify the 'random flips are harmless' premise and with it ObfusBFA's protection against crash-oriented adversaries.

Watch

Extended reading notes

Core claim

The paper's central claim is that every effective bit-flip attack depends on knowing exactly which of the model's many billions of bits are fragile, and that this knowledge can be invalidated without retraining or hardware changes. ObfusBFA identifies the fragile bits with a gradient-based search over weights and an opcode-flipping search over conditional jumps, then randomizes the memory layout around them by inserting dummy layers, dummy neurons, and NOP instructions. The generator re-runs the vulnerability search on the obfuscated version and only accepts a pattern if the old and new vulnerable addresses are disjoint, so the attacker's prior knowledge points at harmless memory. With that separation, a targeted BFA collapses into a random bit-flip attack, and the paper's experiments report no observable accuracy loss across the model-level and code-level settings, with attack success rates falling to single digits or zero.

Load-bearing premise

Randomly flipped bits in a DNN's weights or code almost never change the model's behavior, so if the defense forces the attacker to flip random-looking bit positions, the attack stops working.

Editorial extensions

If this is right

  • If the defense holds, one mechanism covers model-weight attacks and code attacks (FrameFlip and the TVM executable attack) that previously required separate defenses.
  • Deployment on pre-trained models requires no retraining, no training data, and no architecture change, so legacy DNNs can be protected as-is.
  • Attack success rates for T-BFA, TBT, and TA-LBF drop from near 100% to single digits or zero, while untargeted accuracy loss is restored to the original value.
  • The measured overhead stays under about 5% inference time, under 11% storage for TVM binaries (and under 0.4% for shared libraries), and under 3% memory, making real-time use plausible.
  • Because each regeneration costs well under a second, the approach can outpace Rowhammer-based attackers who need many seconds or minutes per flip.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The defense's guarantee is bounded by the secrecy of the generated pattern: the paper's threat model grants the attacker full knowledge of the algorithm but not the random numbers or the transformed binaries, so any practical leak of the obfuscated memory layout would weaken the guarantee.
  • The paper's own adaptive code-level experiment reports an increased percentage of crashes and timeouts even though accuracy is preserved, which suggests the defense neutralizes accuracy-degrading attacks but not denial-of-service goals; an attacker whose objective is system failure may still succeed.
  • The same dummy-layer and NOP-insertion machinery should transfer to other compiled DNN backends and other instruction sets wherever an LLVM backend exists, since the insertion happens at a stage shared across targets.
  • The premise that random flips are harmless was validated on ResNet/VGG-style classifiers; a natural stress test is whether it holds for smaller, less redundant models where a single flipped bit can be proportionally more damaging.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes ObfusBFA, a defense against bit-flip attacks (BFAs) that inserts randomized dummy operations at both the model level (dummy layers and dummy neurons) and the code level (NOP instructions inserted via an LLVM backend pass) so that a carefully targeted BFA is transformed into random bit flips. The defense pipeline consists of a Vulnerability Searcher, an Obfuscation Pattern Generator, and an Obfuscation Pattern Enforcer, and the paper includes a security analysis plus an evaluation against three targeted model-level attacks (T-BFA, TBT, TA-LBF), one untargeted model-level attack, two code-level attacks (FrameFlip on OpenBLAS and the TVM executable attack), and adaptive variants of these attacks, across CIFAR-10, GTSRB, and ImageNet with ResNet and VGG models. The central claims are that ObfusBFA preserves model accuracy, reduces attack success rates to near zero, and introduces less than about 5% time overhead with negligible storage growth.

Significance. If the claims hold, ObfusBFA would be a valuable holistic defense because it addresses both model-level and code-level BFAs without retraining or access to training data. The evaluation is broad: it covers six published attacks, adaptive adversaries, two code-level targets (dynamic libraries and TVM executables), and multiple datasets and architectures, and it compares against BitShield and several model-level defenses. The periodic re-randomization argument and the explicit Kerckhoffs-style treatment of the randomness are also useful. However, the paper's own adaptive results contain an accuracy drop that contradicts the utility-preservation claim, the identity equation behind dummy-layer insertion is only valid for idempotent activations, and the code-level adaptive evaluation reports increased crashes and timeouts that are not counted as attack success. These issues are load-bearing for the paper's main claims and require revision before the contribution can be accepted.

major comments (4)
  1. [Section 4.3.1, Eq. (3)] Equation (3) states φ(φ(X_i·W_i)·L_i)=φ(X_i·W_i), but with L_i as an identity matrix the left-hand side is φ(φ(X_i·W_i)), so the equality holds only when φ is idempotent, such as ReLU. For non-idempotent activations (e.g., sigmoid or tanh), inserting the dummy layer changes the network output. Since all evaluated models use ReLU, the empirical results are not invalidated, but the general claims of "zero impact on the model prediction accuracy" (Section 1.2) and "identical functionality" (Section 4.4.1) are too broad. Please restrict the claim, modify the insertion so that no second activation is applied, or evaluate non-idempotent activations.
  2. [Section 6.3, Table 12 vs. Table 9] In the adaptive untargeted experiment, Table 12 reports accuracies of 76.11% for ResNet20 and 75.05% for ResNet32 at x=3, while Table 9 reports base accuracies of 85.36% and 84.38%, respectively. These are 8-9 percentage-point drops, yet the text states there is "no significant drop" and the abstract claims ObfusBFA can "consistently preserve the model accuracy." Because the adaptive attacker is part of the paper's own threat model and utility preservation is a central claim, this is an internal inconsistency. Please report these drops explicitly, analyze their causes, and evaluate whether increasing the obfuscation probability recovers the accuracy, or revise the utility-preservation claim accordingly.
  3. [Section 6.2, adaptive code-level attacks paragraph] The adaptive code-level evaluation reports "an increase in the percentage of program timeouts or crashes, but no accuracy drop was detected across any experimental setting." Section 3.2's own OpenBLAS experiment found that 148 of 154,554 conditional jumps cause crashes or timeouts when flipped, so randomizing the memory layout does not neutralize denial-of-service: an attacker flipping a window around each vulnerable address can still hit such jumps. The paper's code-level success metric considers only accuracy drop, so the increased crash/timeout rate is excluded from the attack-success measure. Please report crash and timeout rates as an explicit denial-of-service metric and evaluate the defense against DoS-oriented adaptive attackers.
  4. [Section 3.1 and Section 5] The threat model states that the attacker "does not have access to the transformed DNN model or code executables." This assumption is load-bearing because the defense's effectiveness rests on the attacker's inability to observe the obfuscated layout, and the security analysis only argues that reverse engineering is impractical due to periodic re-randomization. Given that the attacker shares the physical machine, please justify why an unprivileged attacker cannot read the victim's memory or binary (e.g., via /proc/pid/mem, shared-library mappings, or side channels), or evaluate an attack variant in which the attacker obtains one obfuscated binary before the next re-randomization.
minor comments (6)
  1. [Algorithm 2, line 11] The update `v_loc←v_loc∪{v_loc}` appears to be a typo; it should add the opcode or address being tested, for example `v_loc←v_loc∪{Op}`.
  2. [Tables 6 and 7] The ΔTime column mixes absolute per-image time values (e.g., +2 ms) and percentages (e.g., -13.2%) without a consistent unit label; please separate the two quantities or state the unit in each cell.
  3. [Equation (5)] The parameters x1 and x2 are introduced but the text does not explain how they map to the reported evaluation values (x1 in {5,...,45}, x2 in {0,1,2}); please clarify the role of each parameter.
  4. [Section 6.3, Table 13] T-BFA on ResNet34 shows an ASR of 22.9% for every x, which is not "remarkably low" compared with the other entries; the discussion should address this case rather than treating all targeted adaptive results as uniformly low.
  5. [Algorithm 1] Algorithm 1 uses `getRand` without defining the random source or its distribution; please specify it.
  6. [References] The reference for Chen et al. contains a typo in the title: "signle-bit-flip" should be "single-bit-flip."

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense is constructive, the only self-citation is a non-load-bearing baseline, and the reported accuracy contradiction is a correctness issue, not circularity.

full rationale

ObfusBFA's derivation is self-contained in the relevant sense. The key mechanism (Section 4.3) pads weights with identity or zero operations, and Eqs. (3)-(4) show the forward pass is unchanged; NOP insertion (Section 4.3.2) is semantically transparent by definition of NOP. The observation that random bit flips are usually benign (Section 3.2) is an empirical premise backed by external work [12] and by the authors' OpenBLAS measurement, not a restatement of the conclusion. The 148 crash/timeout cases reveal a threat-model gap (denial-of-service effects are excluded from the accuracy metric), but they do not make the derivation circular. Algorithm 1 enforces a no-overlap condition between the original and new vulnerable-address lists; that is a construction constraint, and the non-adaptive evaluations verify that construction, while the adaptive evaluations go beyond it by expanding the flip window around original addresses. Those adaptive results (Tables 5, 7, 12, 13) are not statistically forced by the obfuscation equations; indeed Table 12 contradicts the text ('no significant drop' versus ResNet32 falling from 84.38% to 75.05% at x=3), which is an internal-correctness problem, not circularity. The only self-citation is Aegis [51], a published USENIX Security 2023 baseline; its reported ASR values are not inputs to ObfusBFA's algorithm and do not define the central claim. Overall circularity score 0.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The defense rests on several unproven premises: that random bit flips are largely harmless, that the vulnerability search covers all critical bits, that the attacker cannot observe the obfuscated artifacts, and that the dummy-layer identity holds for arbitrary activations. The insertion probability is a free parameter tuned in experiments.

free parameters (2)
  • Obfuscation insertion probability (Prob) = not stated in paper; text says 'insert probability below 0.3 is sufficient' (Section 6.3)
    Controls how often non-critical elements receive dummy operations; chosen empirically to balance overhead and defense effectiveness, not derived from first principles.
  • Top-k number of vulnerable weights in model-level search = not specified in paper
    The vulnerability searcher selects the top-k weights by gradient magnitude; k is not given, and the evaluation likely aligns it with the attack's flipped bit count. This parameter determines which bits are protected.
assumptions (5)
  • domain assumption Randomly flipping bits in DNN weights has negligible impact on predictions
    Cited from Cheng et al. [12] and used as the design foundation in Section 3.2.
  • domain assumption Randomly flipping conditional jumps in code is mostly harmless to accuracy
    The paper's own OpenBLAS experiment (Section 3.2) shows 85 of 154,554 jumps cause accuracy drops, but 148 cause crashes or timeouts, so the axiom is only partially true.
  • domain assumption The attacker has no access to the transformed DNN model or code executables
    Section 3.1 states this; the defense's security relies on the secrecy of the obfuscation pattern.
  • ad hoc to paper Vulnerability Searcher identifies the majority of vulnerable bits
    Section 5 asserts this theoretically, but no proof or measurement of coverage is provided.
  • ad hoc to paper Inserting an identity dummy layer after an activation preserves the output (Eq 3)
    Equation 3 requires the activation function to be idempotent on the layer outputs; this holds for ReLU used in the tested models but not for tanh, sigmoid, or ELU, so the general claim is unsupported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ObfusBFA: A Holistic Approach to Safeguarding DNNs from Different Types of Bit-Flip Attacks." pith.science (2026). https://pith.science/paper/NEKKQCWC

@misc{pith2026250610744,
  author       = {Pith},
  title        = {Pith review of: ObfusBFA: A Holistic Approach to Safeguarding DNNs from Different Types of Bit-Flip Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NEKKQCWC}},
  note         = {Machine review of arXiv:2506.10744}
}
read the original abstract

Bit-flip attacks (BFAs) represent a serious threat to Deep Neural Networks (DNNs), where flipping a small number of bits in the model parameters or binary code can significantly degrade the model accuracy or mislead the model prediction in a desired way. Existing defenses exclusively focus on protecting models for specific attacks and platforms, while lacking effectiveness for other scenarios. We propose ObfusBFA, an efficient and holistic methodology to mitigate BFAs targeting both the high-level model weights and low-level codebase (executables or shared libraries). The key idea of ObfusBFA is to introduce random dummy operations during the model inference, which effectively transforms the delicate attacks into random bit flips, making it much harder for attackers to pinpoint and exploit vulnerable bits. We design novel algorithms to identify critical bits and insert obfuscation operations. We evaluate ObfusBFA against different types of attacks, including the adaptive scenarios where the attacker increases the flip bit budget to attempt to circumvent our defense. The results show that ObfusBFA can consistently preserve the model accuracy across various datasets and DNN architectures while significantly reducing the attack success rates. Additionally, it introduces minimal latency and storage overhead, making it a practical solution for real-world applications.

Figures

Figures reproduced from arXiv: 2506.10744 by the authors.

Figure 1
Figure 1. BFAs against DNN applications with Rowhammer. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Pipeline of ObfusBFA. 4 Methodology 4.1 Overall Workflow [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Possible NOP insertion phases during compiling. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Time and memory Overhead. same effect post-defense) and Mitigation Rate (%) (percentage of the attack successfully mitigated). Since the source code for some of these schemes is unavailable, we rely on the data reported in their respective papers. The "-" symbol in the…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 48 canonical work pages

  1. [1]

    LeapFrog: The Rowhammer Instruction Skip Attack

    Andrew Adiletta, Caner Tol, and Berk Sunar. Leapfrog: The rowhammer instruc- tion skip attack.arXiv preprint arXiv:2404.07878, 2024

    work page Pith review arXiv 2024

  2. [2]

    Targeted attack against deep neural networks via flipping limited weight bits

    Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. arXiv preprint arXiv:2102.10496, 2021

    arXiv 2021

  3. [3]

    Practical fault attack on deep neural networks

    Jakub Breier, Xiaolu Hou, Dirmanto Jap, Lei Ma, Shivam Bhasin, and Yang Liu. Practical fault attack on deep neural networks. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 2204–2206, 2018

    work page 2018

  4. [4]

    Deepattest: An end-to-end attestation framework for deep neural networks

    Huili Chen, Cheng Fu, Bita Darvish Rouhani, Jishen Zhao, and Farinaz Koushanfar. Deepattest: An end-to-end attestation framework for deep neural networks. In Proceedings of the 46th International Symposium on Computer Architecture, pages 487–498, 2019

    work page 2019

  5. [5]

    Proflip: Targeted trojan attack with progressive bit flips

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Proflip: Targeted trojan attack with progressive bit flips. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 7718–7727, 2021

    2021

  6. [6]

    In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 578–594, 2018

    Tianqi Chen, Thierry Moreau, Ziheng Jiang, Lianmin Zheng, Eddie Yan, Haichen Shen, Meghan Cowan, Leyuan Wang, Yuwei Hu, Luis Ceze, et al.{TVM}: An automated{End-to-End} optimizing compiler for deep learning. In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 578–594, 2018

    work page 2018

  7. [7]

    Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables

    Yanzuo Chen, Zhibo Liu, Yuanyuan Yuan, Sihang Hu, Tianxiang Li, and Shuai Wang. Unveiling signle-bit-flip attacks on dnn executables.arXiv preprint arXiv:2309.06223, 2023

    work page Pith review arXiv 2023

  8. [8]

    Bitshield: Defending against bit-flip attacks on dnn executables.computing, 2:47

    Yanzuo Chen, Yuanyuan Yuan, Zhibo Liu, Sihang Hu, Tianxiang Li, and Shuai Wang. Bitshield: Defending against bit-flip attacks on dnn executables.computing, 2:47

    work page

Show all 55 references
  1. [9]

    Real time detection of cache- based side-channel attacks using hardware performance counters.Applied Soft Computing, 49:1162–1174, 2016

    Marco Chiappetta, Erkay Savas, and Cemal Yilmaz. Real time detection of cache- based side-channel attacks using hardware performance counters.Applied Soft Computing, 49:1162–1174, 2016

    2016

  2. [10]

    Exploiting correcting codes: On the effectiveness of ecc memory against rowhammer attacks

    Lucian Cojocar, Kaveh Razavi, Cristiano Giuffrida, and Herbert Bos. Exploiting correcting codes: On the effectiveness of ecc memory against rowhammer attacks. In2019 IEEE Symposium on Security and Privacy (SP), pages 55–71. IEEE, 2019

    2019

  3. [11]

    Trrespass: Exploiting the many sides of target row refresh

    Pietro Frigo, Emanuele Vannacc, Hasan Hassan, Victor Van Der Veen, Onur Mutlu, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. Trrespass: Exploiting the many sides of target row refresh. In2020 IEEE Symposium on Security and Privacy (SP), pages 747–762. IEEE, 2020

    2020

  4. [12]

    Hammerdodger: a light- weight defense framework against rowhammer attack on dnns

    Cheng Gongye, Yukui Luo, Xiaolin Xu, and Yunsi Fei. Hammerdodger: a light- weight defense framework against rowhammer attack on dnns. In2023 60th ACM/IEEE Design Automation Conference (DAC), pages 1–6. IEEE, 2023

    2023

  5. [13]

    Flush+ flush: a fast and stealthy cache attack

    Daniel Gruss, Clémentine Maurice, Klaus Wagner, and Stefan Mangard. Flush+ flush: a fast and stealthy cache attack. InDetection of Intrusions and Malware, and Vulnerability Assessment: 13th International Conference, DIMV A 2016, San Sebastián, Spain, July 7-8, 2016, Proceeding...

    2016

  6. [14]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  7. [15]

    Defending and harnessing the bit-flip based adversarial weight attack

    Zhezhi He, Adnan Siraj Rakin, Jingtao Li, Chaitali Chakrabarti, and Deliang Fan. Defending and harnessing the bit-flip based adversarial weight attack. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14095–14103, 2020

    2020

  8. [16]

    Profile-guided automated software diversity

    Andrei Homescu, Steven Neisius, Per Larsen, Stefan Brunthaler, and Michael Franz. Profile-guided automated software diversity. InProceedings of the 2013 IEEE/ACM International Symposium on Code Generation and Optimization (CGO), pages 1–11. IEEE, 2013

    2013

  9. [17]

    Safe- guarding the intelligence of neural networks with built-in light-weight integrity marks (lima)

    Fateme S Hosseini, Qi Liu, Fanruo Meng, Chengmo Yang, and Wujie Wen. Safe- guarding the intelligence of neural networks with built-in light-weight integrity marks (lima). In2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pages 1–12. IEEE, 2021

    2021

  10. [18]

    Detection of traffic signs in real-world images: The german traffic sign detection benchmark

    Sebastian Houben, Johannes Stallkamp, Jan Salmen, Marc Schlipsing, and Chris- tian Igel. Detection of traffic signs in real-world images: The german traffic sign detection benchmark. InThe 2013 international joint conference on neural networks (IJCNN), pages 1–8. Ieee, 2013

    2013

  11. [19]

    Reverse engineering convolutional neural networks through side-channel information leaks

    Weizhe Hua, Zhiru Zhang, and G Edward Suh. Reverse engineering convolutional neural networks through side-channel information leaks. InProceedings of the 55th Annual Design Automation Conference, pages 1–6, 2018

    2018

  12. [20]

    Mascat: Stopping microar- chitectural attacks before execution.Cryptology ePrint Archive, 2016

    Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar. Mascat: Stopping microar- chitectural attacks before execution.Cryptology ePrint Archive, 2016

    2016

  13. [21]

    Acchashtag: Accel- erated hashing for detecting fault-injection attacks on embedded neural networks

    Mojan Javaheripi, Jung-Woo Chang, and Farinaz Koushanfar. Acchashtag: Accel- erated hashing for detecting fault-injection attacks on embedded neural networks. ACM Journal on Emerging Technologies in Computing Systems, 19(1):1–20, 2022

    2022

  14. [22]

    Hashtag: Hash signatures for online detection of fault-injection attacks on deep neural networks

    Mojan Javaheripi and Farinaz Koushanfar. Hashtag: Hash signatures for online detection of fault-injection attacks on deep neural networks. In2021 IEEE/ACM International Conference On Computer Aided Design (ICCAD), pages 1–9. IEEE, 2021

    2021

  15. [23]

    Machine learning-based rowhammer mitigation.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 42(5):1393–1405, 2022

    Biresh Kumar Joardar, Tyler K Bletsch, and Krishnendu Chakrabarty. Machine learning-based rowhammer mitigation.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 42(5):1393–1405, 2022

    2022

  16. [24]

    Flipping bits in memory with- out accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

    Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory with- out accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

    2014

  17. [25]

    In13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 697–710, 2018

    Radhesh Krishnan Konoth, Marco Oliverio, Andrei Tatar, Dennis Andriesse, Herbert Bos, Cristiano Giuffrida, and Kaveh Razavi.{ZebRAM}: Comprehensive and compatible software protection against rowhammer attacks. In13th USENIX Symposium on Operating Systems Design and Implementat...

    2018

  18. [26]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  19. [27]

    Sok: Auto- mated software diversity

    Per Larsen, Andrei Homescu, Stefan Brunthaler, and Michael Franz. Sok: Auto- mated software diversity. In2014 IEEE Symposium on Security and Privacy, pages 276–291. IEEE, 2014

    2014

  20. [28]

    Neurobfuscator: A full-stack obfuscation tool to mitigate neural architecture stealing

    Jingtao Li, Zhezhi He, Adnan Siraj Rakin, Deliang Fan, and Chaitali Chakrabarti. Neurobfuscator: A full-stack obfuscation tool to mitigate neural architecture stealing. In2021 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pages 248–258. IEEE, 2021

    2021

  21. [29]

    Radar: Run-time adversarial weight attack detection and accuracy recovery

    Jingtao Li, Adnan Siraj Rakin, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. Radar: Run-time adversarial weight attack detection and accuracy recovery. In 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 790–795. IEEE, 2021

    2021

  22. [30]

    Defending bit-flip attack through dnn weight reconstruction

    Jingtao Li, Adnan Siraj Rakin, Yan Xiong, Liangliang Chang, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. Defending bit-flip attack through dnn weight reconstruction. In2020 57th ACM/IEEE Design Automation Conference (DAC), pages 1–6. IEEE, 2020

    2020

  23. [31]

    Yes, one-bit-flip matters! universal dnn model inference depletion with runtime code fault injection

    Shaofeng Li, Xinyu Wang, Minhui Xue, Haojin Zhu, Zhi Zhang, Yansong Gao, Wen Wu, and Xuemin Sherman Shen. Yes, one-bit-flip matters! universal dnn model inference depletion with runtime code fault injection. InProceedings of the 33th USENIX Security Symposium, 2024

    2024

  24. [32]

    Deepdyve: Dynamic verification for deep neural networks

    Yu Li, Min Li, Bo Luo, Ye Tian, and Qiang Xu. Deepdyve: Dynamic verification for deep neural networks. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 101–112, 2020

    2020

  25. [33]

    Generating robust dnn with resistance to bit-flip based adversarial weight attack.IEEE Transactions on Computers, 72(2):401–413, 2022

    Liang Liu, Yanan Guo, Yueqiang Cheng, Youtao Zhang, and Jun Yang. Generating robust dnn with resistance to bit-flip based adversarial weight attack.IEEE Transactions on Computers, 72(2):401–413, 2022

    2022

  26. [34]

    Concurrent weight encoding-based detec- tion for bit-flip attack on neural network accelerators

    Qi Liu, Wujie Wen, and Yanzhi Wang. Concurrent weight encoding-based detec- tion for bit-flip attack on neural network accelerators. InIEEE/ACM International Conference on Computer-Aided Design (ICCAD), 2020, 2020

    2020

  27. [35]

    {NeuroPots}: Realtime proactive defense against{Bit-Flip} attacks in neural networks

    Qi Liu, Jieming Yin, Wujie Wen, Chengmo Yang, and Shi Sha. {NeuroPots}: Realtime proactive defense against{Bit-Flip} attacks in neural networks. In 32nd USENIX Security Symposium (USENIX Security 23), pages 6347–6364, 2023

    2023

  28. [36]

    Fault injection attack on deep neural network

    Yannan Liu, Lingxiao Wei, Bo Luo, and Qiang Xu. Fault injection attack on deep neural network. In2017 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pages 131–138. IEEE, 2017

    2017

  29. [37]

    Siloz: Leveraging dram isolation domains to prevent inter-vm rowhammer

    Kevin Loughlin, Jonah Rosenblum, Stefan Saroiu, Alec Wolman, Dimitrios Skar- latos, and Baris Kasikci. Siloz: Leveraging dram isolation domains to prevent inter-vm rowhammer. InProceedings of the 29th Symposium on Operating Systems Principles, pages 417–433, 2023

    2023

  30. [38]

    Deepshuffle: A lightweight defense framework against adversarial fault injection attacks on deep neural networks in multi-tenant cloud-fpga

    Yukui Luo, Adnan Siraj Rakin, Deliang Fan, and Xiaolin Xu. Deepshuffle: A lightweight defense framework against adversarial fault injection attacks on deep neural networks in multi-tenant cloud-fpga. In2024 IEEE Symposium on Security and Privacy (SP), pages 3293–3310. IEEE, 2024

  31. [39]

    Rowhammer: A retrospective.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 39(8):1555–1571, 2019

    Onur Mutlu and Jeremie S Kim. Rowhammer: A retrospective.IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 39(8):1555–1571, 2019

    2019

  32. [40]

    Bit-flip attack: Crushing neural network with progressive bit search

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1211–1220, 2019. 12 ObfusBFA: A Holistic Approach to Safeguarding DNNs from Dif...

    2019

  33. [41]

    Tbt: Targeted neural network attack with bit trojan

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13198–13207, 2020

    2020

  34. [42]

    T-bfa: Targeted bit-flip adversarial weight attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(11):7928–7939, 2021

    Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. T-bfa: Targeted bit-flip adversarial weight attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(11):7928–7939, 2021

    2021

  35. [43]

    In30th USENIX Security Symposium (USENIX Security 21), pages 1919–1936, 2021

    Adnan Siraj Rakin, Yukui Luo, Xiaolin Xu, and Deliang Fan.{Deep-Dup}: An adversarial weight duplication attack framework to crush deep neural network in {Multi-Tenant}{ FPGA}. In30th USENIX Security Symposium (USENIX Security 21), pages 1919–1936, 2021

    1919

  36. [44]

    Ra-bnn: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy.arXiv preprint arXiv:2103.13813, 2021

    Adnan Siraj Rakin, Li Yang, Jingtao Li, Fan Yao, Chaitali Chakrabarti, Yu Cao, Jae-sun Seo, and Deliang Fan. Ra-bnn: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy.arXiv preprint arXiv:2103.13813, 2021

    2021 arXiv

  37. [45]

    Flip feng shui: Hammering a needle in the software stack

    Kaveh Razavi, Ben Gras, Erik Bosman, Bart Preneel, Cristiano Giuffrida, and Herbert Bos. Flip feng shui: Hammering a needle in the software stack. In25th USENIX Security Symposium (USENIX Security 16), pages 1–18, 2016

    2016

  38. [46]

    Glow: Graph lowering compiler techniques for neural networks.arXiv preprint arXiv:1805.00907, 2018

    Nadav Rotem, Jordan Fix, Saleem Abdulrasool, Garret Catron, Summer Deng, Ro- man Dzhabarov, Nick Gibson, James Hegeman, Meghan Lele, Roman Levenstein, et al. Glow: Graph lowering compiler techniques for neural networks.arXiv preprint arXiv:1805.00907, 2018

    2018 arXiv

  39. [47]

    Ima- genet large scale visual recognition challenge.International journal of computer vision, 115:211–252, 2015

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Ima- genet large scale visual recognition challenge.International journal of computer vision, 115:211–252, 2015

    2015

  40. [48]

    Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World} attack

    Takami Sato, Junjie Shen, Ningfei Wang, Yunhan Jia, Xue Lin, and Qi Alfred Chen. Dirty road can attack: Security of deep learning based automated lane centering under{Physical-World} attack. In30th USENIX security symposium (USENIX Security 21), pages 3309–3326, 2021

    2021

  41. [49]

    Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  42. [50]

    Just-in-time code reuse: On the effectiveness of fine-grained address space layout randomization

    Kevin Z Snow, Fabian Monrose, Lucas Davi, Alexandra Dmitrienko, Christopher Liebchen, and Ahmad-Reza Sadeghi. Just-in-time code reuse: On the effectiveness of fine-grained address space layout randomization. In2013 IEEE symposium on security and privacy, pages 574–588. IEEE, 2013

    2013

  43. [51]

    Aegis: Mitigating targeted bit-flip attacks against deep neural networks

    Jialai Wang, Ziyuan Zhang, Meiqi Wang, Han Qiu, Tianwei Zhang, Qi Li, Zong- peng Li, Tao Wei, and Chao Zhang. Aegis: Mitigating targeted bit-flip attacks against deep neural networks. In32nd USENIX Security Symposium (USENIX Security 23), pages 2329–2346, 2023

    2023

  44. [52]

    Scalable and secure row-swap: Efficient and safe row hammer mitigation in memory systems

    Jeonghyun Woo, Gururaj Saileshwar, and Prashant J Nair. Scalable and secure row-swap: Efficient and safe row hammer mitigation in memory systems. In 2023 IEEE International Symposium on High-Performance Computer Architecture (HPCA), pages 374–389. IEEE, 2023

    2023

  45. [53]

    In29th USENIX Security Symposium (USENIX Security 20), pages 1463–1480, 2020

    Fan Yao, Adnan Siraj Rakin, and Deliang Fan.{DeepHammer}: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In29th USENIX Security Symposium (USENIX Security 20), pages 1463–1480, 2020

    2020

  46. [54]

    Optimizing federated learning in distributed industrial iot: A multi-agent approach.IEEE Journal on Selected Areas in Communications, 39(12):3688–3703, 2021

    Weiting Zhang, Dong Yang, Wen Wu, Haixia Peng, Ning Zhang, Hongke Zhang, and Xuemin Shen. Optimizing federated learning in distributed industrial iot: A multi-agent approach.IEEE Journal on Selected Areas in Communications, 39(12):3688–3703, 2021

    2021

  47. [55]

    Obfunas: A neural architecture search- based dnn obfuscation approach

    Tong Zhou, Shaolei Ren, and Xiaolin Xu. Obfunas: A neural architecture search- based dnn obfuscation approach. InProceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design, pages 1–9, 2022. 13

    2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.