{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/bit-flip-attack-crushing-neural-network","title":"Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search","arxiv_id":"1903.12269","date":"2019-03-28","proceeding":"ICCV 2019 10","authors":["Adnan Siraj Rakin","Zhezhi He","Deliang Fan"],"abstract":"Several important security issues of Deep Neural Network (DNN) have been\nraised recently associated with different applications and components. The most\nwidely investigated security concern of DNN is from its malicious input, a.k.a\nadversarial example. Nevertheless, the security challenge of DNN's parameters\nis not well explored yet. In this work, we are the first to propose a novel DNN\nweight attack methodology called Bit-Flip Attack (BFA) which can crush a neural\nnetwork through maliciously flipping extremely small amount of bits within its\nweight storage memory system (i.e., DRAM). The bit-flip operations could be\nconducted through well-known Row-Hammer attack, while our main contribution is\nto develop an algorithm to identify the most vulnerable bits of DNN weight\nparameters (stored in memory as binary bits), that could maximize the accuracy\ndegradation with a minimum number of bit-flips. Our proposed BFA utilizes a\nProgressive Bit Search (PBS) method which combines gradient ranking and\nprogressive search to identify the most vulnerable bit to be flipped. With the\naid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e.,\ntop-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93\nmillion bits, while randomly flipping 100 bits merely degrades the accuracy by\nless than 1%.","url_abs":"http://arxiv.org/abs/1903.12269v2","url_pdf":"http://arxiv.org/pdf/1903.12269v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"bit-flip-attack-crushing-neural-network","repo_url":"https://github.com/elliothe/Neural_Network_Weight_Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1903.12269","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}