CoChat
Sign Up
PreprintCited by 11Adversarial Robustness in Machine LearningSecurity and Verification in ComputingDigital Media Forensic Detection

The DOI matches its DataCite record.

Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks

Open access
Wang, Jialai, Zhang, Ziyuan, Wang, Meiqi, Qiu, Han, Zhang, Tianwei, Li, Qi, Li, Zongpeng, Wei, Tao, Zhang, Chao·2023·arXiv
DOI 10.48550/arxiv.2302.13520arXiv 2302.13520
Open this paper in CoChat — free accountOpen PDF

Abstract

Bit-flip attacks (BFAs) have attracted substantial attention recently, in which an adversary could tamper with a small number of model parameter bits to break the integrity of DNNs. To mitigate such threats, a batch of defense methods are proposed, focusing on the untargeted scenarios. Unfortunately, they either require extra trustworthy applications or make models more vulnerable to targeted BFAs. Countermeasures against targeted BFAs, stealthier and more purposeful by nature, are far from well established. In this work, we propose Aegis, a novel defense method to mitigate targeted BFAs. The core observation is that existing targeted attacks focus on flipping critical bits in certain important layers. Thus, we design a dynamic-exit mechanism to attach extra internal classifiers (ICs) to hidden layers. This mechanism enables input samples to early-exit from different layers, which effectively upsets the adversary's attack plans. Moreover, the dynamic-exit mechanism randomly selects ICs for predictions during each inference to significantly increase the attack cost for the adaptive attacks where all defense mechanisms are transparent to the adversary. We further propose a robustness training strategy to adapt ICs to the attack scenarios by simulating BFAs during the IC training phase, to increase model robustness. Extensive evaluations over four well-known datasets and two popular DNN structures reveal that Aegis could effectively mitigate different state-of-the-art targeted attacks, reducing attack success rate by 5-10$\times$, significantly outperforming existing defense methods.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2302.13520

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Still being checked.

Research works printed but not linked: 60

  1. Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX Security, 2018.
  2. Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexan- der Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. Dos and don'ts of machine learning in computer security. In USENIX Security, 2022.
  3. Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. In ICLR, 2021.
  4. Irwan Bello, William Fedus, Xianzhi Du, Ekin Do- gus Cubuk, Aravind Srinivas, Tsung-Yi Lin, Jonathon Shlens, and Barret Zoph. Revisiting resnets: Improved training and scaling strategies. In NeurIPS, 2021.
  5. Jakub Breier, Xiaolu Hou, Dirmanto Jap, Lei Ma, Shivam Bhasin, and Yang Liu. Practical fault attack on deep neural networks. In ACM CCS, 2018.
  6. Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE SP, 2017.
  7. Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Proflip: Targeted trojan attack with pro- gressive bit flips. In ICCV, 2021.
  8. Adam Coates, Andrew Y. Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised fea- ture learning. In AISTATS, 2011.
  9. Lucian Cojocar, Kaveh Razavi, Cristiano Giuffrida, and Herbert Bos. Exploiting correcting codes: On the effec- tiveness of ECC memory against rowhammer attacks. In IEEE SP, 2019.
  10. Tian Dong, Ziyuan Zhang, Han Qiu, Tianwei Zhang, Hewu Li, and Terry Wang. Mind your heart: Stealthy backdoor attack on dynamic deep neural network in edge computing. arXiv preprint arXiv:2212.11751, 2022. · arXiv
  11. Max Ghiglione and Vittorio Serra. Opportunities and challenges of ai on satellite processing units. In Pro- ceedings of the 19th ACM International Conference on Computing Frontiers, pages 221-224, 2022.
  12. Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. In ICLR, 2015.
  13. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
  14. Zecheng He, Tianwei Zhang, and Ruby B Lee. Attack- ing and protecting data privacy in edge-cloud collabora- tive inference systems. IEEE Internet of Things Journal, 2020.
  15. Zhezhi He, Adnan Siraj Rakin, Jingtao Li, Chaitali Chakrabarti, and Deliang Fan. Defending and harness- ing the bit-flip based adversarial weight attack. In CVPR, 2020.
  16. Sanghyun Hong, Pietro Frigo, Yigitcan Kaya, Cristiano Giuffrida, and Tudor Dumitras , . Terminal brain damage: Exposing the graceless degradation in deep neural net- works under hardware fault attacks. In USENIX Security, 2019.
  17. Ting-Kuei Hu, Tianlong Chen, Haotao Wang, and Zhangyang Wang. Triple wins: Boosting accuracy, robustness and efficiency together by enabling input- adaptive inference. In ICLR, 2020.
  18. Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Lau- rens van der Maaten, and Kilian Q Weinberger. Multi- scale dense networks for resource efficient image classi- fication. ICLR, 2018.
  19. Shehzeen Hussain, Paarth Neekhara, Shlomo Dubnov, Julian J. McAuley, and Farinaz Koushanfar. Waveg- uard: Understanding and mitigating audio adversarial examples. In USENIX Security, 2021.
  20. Patrick Jattke, Victor van der Veen, Pietro Frigo, Stijn Gunter, and Kaveh Razavi. Blacksmith: Scalable rowhammering in the frequency domain. In IEEE SP, 2022.
  21. Mojan Javaheripi and Farinaz Koushanfar. HASHTAG: hash signatures for online detection of fault-injection attacks on deep neural networks. In IEEE/ACM ICCAD, 2021.
  22. Yichen Jiang, Huifeng Zhu, Haoqi Shan, Xiaolong Guo, Xuan Zhang, and Yier Jin. Trrscope: Understanding target row refresh mechanism for modern ddr protection. In IEEE HOST, 2021.
  23. Yigitcan Kaya, Sanghyun Hong, and Tudor Dumitras. Shallow-deep networks: Understanding and mitigating network overthinking. In ICML, 2019.
  24. Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised contrastive learning. In NeurIPS, 2020.
  25. Yoongu Kim, Ross Daly, Jeremie S. Kim, Chris Fallin, Ji-Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory with- out accessing them: An experimental study of DRAM disturbance errors. In ACM/IEEE ISCA, 2014.
  26. Jingtao Li, Adnan Siraj Rakin, Yan Xiong, Lian- gliang Chang, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. Defending bit-flip attack through DNN weight reconstruction. In ACM/IEEE DAC, 2020.
  27. Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. Backdoor attacks on pre-trained models by layerwise weight poisoning. In EMNLP, 2021.
  28. Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR, 2021.
  29. Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. arXiv preprint arXiv:2007.08745, 2020. · arXiv
  30. Yu Li, Min Li, Bo Luo, Ye Tian, and Qiang Xu. Deep- dyve: Dynamic verification for deep neural networks. In ACM CCS, 2020.
  31. Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In ICCV, 2021.
  32. Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV, 2020.
  33. Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Mar- tin Strohmeier, and Ivan Martinovic. SLAP: improving physical adversarial examples with short-lived adversar- ial perturbations. In USENIX Security, 2021.
  34. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
  35. Seungyong Moon, Gaon An, and Hyun Oh Song. Par- simonious black-box adversarial attacks via efficient combinatorial optimization. In ICML, 2019.
  36. Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In IEEE EuroS&P, 2016.
  37. Adnan Siraj Rakin, Md Hafizul Islam Chowdhuryy, Fan Yao, and Deliang Fan. Deepsteal: Advanced model extractions leveraging efficient weight stealing in mem- ories. In IEEE SP, 2022.
  38. Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit- flip attack: Crushing neural network with progressive bit search. In ICCV, 2019.
  39. Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. TBT: targeted neural network attack with bit trojan. In CVPR, 2020.
  40. Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. T-bfa: Targeted bit-flip adversarial weight attack. TPAMI, 2021.
  41. Adnan Siraj Rakin, Yukui Luo, Xiaolin Xu, and Deliang Fan. Deep-dup: An adversarial weight duplication attack framework to crush deep neural network in multi-tenant FPGA. In USENIX Security, 2021.
  42. Adnan Siraj Rakin, Li Yang, Jingtao Li, Fan Yao, Chaitali Chakrabarti, Yu Cao, Jae-sun Seo, and Deliang Fan. Ra-bnn: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy. arXiv preprint arXiv:2103.13813, 2021. · arXiv
  43. Mohammad Rastegari, Vicente Ordonez, Joseph Red- mon, and Ali Farhadi. Xnor-net: Imagenet classification using binary convolutional neural networks. In ECCV, 2016.
  44. Takami Sato, Junjie Shen, Ningfei Wang, Yunhan Jia, Xue Lin, and Qi Alfred Chen. Dirty road can attack: Se- curity of deep learning based automated lane centering under physical-world attack. In USENIX Security, 2021.
  45. Giorgio Severi, Jim Meyer, Scott E. Coull, and Alina Oprea. Explanation-guided backdoor poisoning attacks against malware classifiers. In USENIX Security, 2021.
  46. Lujia Shen, Shouling Ji, Xuhong Zhang, Jinfeng Li, Jing Chen, Jie Shi, Chengfang Fang, Jianwei Yin, and Ting Wang. Backdoor pre-trained models can transfer to all. In ACM SIGSAC Conference on Computer and Communications Security, CCS, 2021.
  47. Benjamin Shickel, Patrick James Tighe, Azra Bihorac, and Parisa Rashidi. Deep EHR: a survey of recent ad- vances in deep learning techniques for electronic health record (EHR) analysis. IEEE JBHI, 2017.
  48. Karen Simonyan and Andrew Zisserman. Very deep con- volutional networks for large-scale image recognition. In ICLR, 2015.
  49. Fnu Suya, Jianfeng Chi, David Evans, and Yuan Tian. Hybrid batch attacks: Finding black-box adversarial ex- amples with limited queries. In USENIX Security, 2020.
  50. Kevin Swersky, Jasper Snoek, and Ryan Prescott Adams. Multi-task bayesian optimization. In NeurIPS, 2013.
  51. Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What makes for good views for contrastive learning? In NeurIPS, 2020.
  52. Jialai Wang, Han Qiu, Yi Rong, Hengkai Ye, Qi Li, Zong- peng Li, and Chao Zhang. BET: black-box efficient testing for convolutional neural networks. In ISSTA, 2022.
  53. Ren Wang, Gaoyuan Zhang, Sijia Liu, Pin-Yu Chen, Jinjun Xiong, and Meng Wang. Practical detection of trojan neural networks: Data-limited and data-free cases. In ECCV, 2020.
  54. Xin Wang, Fisher Yu, Zi-Yi Dou, Trevor Darrell, and Joseph E Gonzalez. Skipnet: Learning dynamic routing in convolutional networks. In ECCV, 2018.
  55. Baoyuan Wu and Bernard Ghanem. ℓ p -Box ADMM: A versatile framework for integer programming. TPAMI, 2019.
  56. Fan Yao, Adnan Siraj Rakin, and Deliang Fan. Deepham- mer: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In USENIX Security, 2020.
  57. Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y. Zhao. Latent backdoor attacks on deep neural net- works. In Lorenzo Cavallaro, Johannes Kinder, Xi- aoFeng Wang, and Jonathan Katz, editors, Proceedings of the ACM SIGSAC Conference on Computer and Com- munications Security, CCS, 2019.
  58. Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In ICLR, 2022.
  59. Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label back- door attacks on video recognition models. In CVPR, 2020.
  60. Wangchunshu Zhou, Canwen Xu, Tao Ge, Julian McAuley, Ke Xu, and Furu Wei. Bert loses patience: Fast and robust inference with early exit. NeurIPS, 2020.

Cited by

Sorted by citations

Related

Metadata

Authors
Wang, J., Zhang, Z., Wang, M., Qiu, H., Zhang, T., Li, Q., Li, Z., Wei, T., & Zhang, C.
Affiliations
  • Tsinghua University (CN)
  • Beijing University of Posts and Telecommunications (CN)
  • Ant Group (China) (CN)
  • Nanyang Technological University (SG)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2023
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2302.13520
arXiv
2302.13520
OpenAlex
W4322717137
Cited by
7
References
0
Citations by year
2025: 3 · 2024: 3 · 2023: 1
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University)
Funders
  • Ant Group
  • National Natural Science Foundation of China (61972224, 62106127, 62132011, 2022YFB3105202)
  • Ministry of Education, India
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
bit-flip attacks, targeted attacks, deep neural network security, model integrity, early-exit networks, adversarial robustness, attack cost

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review