Abstract:Bit-flip attacks (BFAs) can manipulate deep neural networks (DNNs). For high-level DNN models running on deep learning (DL) frameworks like PyTorch, extensive BFAs have been used to flip bits in model weights and shown effective. Defenses have also been proposed to guard model weights. However, DNNs are increasingly compiled into DNN executables by DL compilers to leverage hardware primitives. These executables manifest distinct computation paradigms; existing research fails to accurately capture and expose the BFA surfaces on DNN executables. To this end, we launch the first systematic study of BFAs on DNN executables. Prior BFAs are limited to attacking model weights and assume a strong whitebox attacker with full knowledge of victim model weights, which is unrealistic as weights are often confidential. In contrast, we find that BFAs on DNN executables can achieve high effectiveness by exploiting the model structure (usually stored in the executable code), which only requires knowing the (often public) model structure. Importantly, such structure-based BFAs are pervasive, transferable, and more severe in DNN executables. They also slip past existing defenses. To demonstrate the new attack surfaces, we assume a weak and more realistic attacker with no knowledge of victim model weights. We design an automated tool to identify vulnerable bits in victim executables with high confidence (70% vs. baseline 2%). We show on DDR4 DRAM that only 1.4 flips on average are needed to fully downgrade the accuracy of victim models, including quantized ones which could require 23x more flips previously, to random guesses. We comprehensively evaluate 16 DNN executables, covering large-scale models trained on commonly-used datasets compiled by the two most popular DL compilers. Our finding calls for incorporating security mechanisms in future DNN compilation toolchains.

DNN-Defender: An in-DRAM Deep Neural Network Defense Mechanism for Adversarial Weight Attack

DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips

Compromising the Intelligence of Modern DNNs: On the Effectiveness of Targeted RowPress

Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks

Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA

Stealthy Attack on Algorithmic-Protected DNNs via Smart Bit Flipping

Security Analysis and Enhancement of Model Compressed Deep Learning Systems under Adversarial Attacks

Practical Attacks on Deep Neural Networks by Memory Trojaning.

Hardware Accelerator for Adversarial Attacks on Deep Learning Neural Networks

TDPP: 2-D Permutation-Based Protection of Memristive Deep Neural Networks

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

A Deep Investigation on Stealthy DVFS Fault Injection Attacks at DNN Hardware Accelerators

Targeted Attack Against Deep Neural Networks Via Flipping Limited Weight Bits

Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables

A Hybrid Sparse-dense Defensive DNN Accelerator Architecture against Adversarial Example Attacks

Deep Defense: Training DNNs with Improved Adversarial Robustness

One-bit Flip is All You Need: when Bit-flip Attack Meets Model Training

Defensive Dropout for Hardening Deep Neural Networks under Adversarial Attacks

DeepDefense: Training Deep Neural Networks with Improved Robustness.