Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search

2019/03/28 by Adnan Siraj Rakin, Rakin, Adnan Siraj, Zhezhi He +3 · 12 citations
Computer Science · Engineering · #Advanced Memory and Neural Computing #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Integrated Circuits and Semiconductor Failure Analysis

paper · pdf · doi:10.48550/arxiv.1903.12269

openalex publication_date 2019/03/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN's parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.

Citations

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ImageNet classification with deep convolutional neural networks
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
• DoReFa-Net: Training Low Bitwidth Convolutional Neural Networks with Low Bitwidth Gradients
• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Using deep learning and Google Street View to estimate the demographic makeup of neighborhoods across the United States

Cited by

• BitFlipScope: Scalable Fault Localization and Recovery for Bit-Flip Corruptions in LLMs
• COBRA: Catastrophic Bit-flip Reliability Analysis of State-Space Models
• FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning
• How a Bit Becomes a Story: Semantic Steering via Differentiable Fault Injection
• AFarePart: Accuracy-aware Fault-resilient Partitioner for DNN Edge Accelerators
• Invisible Hands: Gray-Box Bit Flip Attack for Steering LLMs Without Knowledge of Gradients, Data, and Weights
• LM-Fix: Lightweight Bit-Flip Detection and Rapid Recovery Framework for Language Models
• Has the Two-Decade-Old Prophecy Come True? Artificial Bad Intelligence Triggered by Merely a Single-Bit Flip in Large Language Models
• SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models
• Reliability Analysis of Fully Homomorphic Encryption Systems Under Memory Faults
• SilentStriker:Toward Stealthy Bit-Flip Attacks on Large Language Models
• LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

Related

• One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training
• Impactful Bit-Flip Search on Full-precision Models
• TBT: Targeted Neural Network Attack with Bit Trojan
• DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips
• Versatile Weight Attack via Flipping Limited Bits