T-BFA: Targeted Bit-Flip Adversarial Weight Attack

TL;DR

This paper introduces T-BFA, a novel targeted bit-flip adversarial attack on DNN weights, capable of misleading specific inputs to desired outputs with minimal bit modifications, demonstrated on multiple architectures and real hardware.

Contribution

It presents the first targeted weight attack method (T-BFA) that selectively flips weight bits to mislead specific inputs, advancing security analysis of DNNs against weight perturbations.

Findings

Achieves 100% attack success rate on ResNet-18 for targeted misclassification.

Flips only 27 out of 88 million weight bits to succeed.

Demonstrates attack feasibility on real hardware system.

Abstract

Traditional Deep Neural Network (DNN) security is mostly related to the well-known adversarial input example attack. Recently, another dimension of adversarial attack, namely, attack on DNN weight parameters, has been shown to be very powerful. As a representative one, the Bit-Flip-based adversarial weight Attack (BFA) injects an extremely small amount of faults into weight parameters to hijack the executing DNN function. Prior works of BFA focus on un-targeted attack that can hack all inputs into a random output class by flipping a very small number of weight bits stored in computer memory. This paper proposes the first work of targeted BFA based (T-BFA) adversarial weight attack on DNNs, which can intentionally mislead selected inputs to a target output class. The objective is achieved by identifying the weight bits that are highly associated with classification of a targeted output through a class-dependent weight bit ranking algorithm. Our proposed T-BFA performance is successfully demonstrated on multiple DNN architectures for image classification tasks. For example, by merely flipping 27 out of 88 million weight bits of ResNet-18, our T-BFA can misclassify all the images from 'Hen' class into 'Goose' class (i.e., 100 % attack success rate) in ImageNet dataset, while maintaining 59.35 % validation accuracy. Moreover, we successfully demonstrate our T-BFA attack in a real computer prototype system running DNN computation, with Ivy Bridge-based Intel i7 CPU and 8GB DDR3 memory.