{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/one-bit-flip-is-all-you-need-when-bit-flip","title":"One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training","arxiv_id":"2308.07934","date":"2023-08-12","proceeding":"ICCV 2023 1","authors":["Jianshuo Dong","Han Qiu","Yiming Li","Tianwei Zhang","Yuanjie Li","Zeqi Lai","Chao Zhang","Shu-Tao Xia"],"abstract":"Deep neural networks (DNNs) are widely deployed on real-world devices. Concerns regarding their security have gained great attention from researchers. Recently, a new weight modification attack called bit flip attack (BFA) was proposed, which exploits memory fault inject techniques such as row hammer to attack quantized models in the deployment stage. With only a few bit flips, the target model can be rendered useless as a random guesser or even be implanted with malicious functionalities. In this work, we seek to further reduce the number of bit flips. We propose a training-assisted bit flip attack, in which the adversary is involved in the training stage to build a high-risk model to release. This high-risk model, obtained coupled with a corresponding malicious model, behaves normally and can escape various detection methods. The results on benchmark datasets show that an adversary can easily convert this high-risk but normal model to a malicious one on victim's side by \\textbf{flipping only one critical bit} on average in the deployment stage. Moreover, our attack still poses a significant threat even when defenses are employed. The codes for reproducing main experiments are available at \\url{https://github.com/jianshuod/TBA}.","url_abs":"https://arxiv.org/abs/2308.07934v1","url_pdf":"https://arxiv.org/pdf/2308.07934v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"one-bit-flip-is-all-you-need-when-bit-flip","repo_url":"https://github.com/jianshuod/tba","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"all","task_name":"All"}],"methods":[{"method_slug":"flip","method_name":"FLIP"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2308.07934","atlas_url":"https://app.syntology.ai/?focus=2308.07934","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2308.07934"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/jianshuod/tba","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/jianshuod/TBA","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran":5,"unverified":14},"by_repo_kind":{"official":{"samples":19,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d4ce9659619b8ea1","entry":"resnet18","repo":"jianshuod/tba","repo_kind":"official","path":"models/resnet_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/resnet_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d4ce9659619b8ea1"}},{"code_sha256_prefix":"182a7f2d3cc58f1f","entry":"resnet20","repo":"jianshuod/tba","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"182a7f2d3cc58f1f"}},{"code_sha256_prefix":"ff957dd4b649ffa9","entry":"resnet20_mid","repo":"jianshuod/tba","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ff957dd4b649ffa9"}},{"code_sha256_prefix":"4d1d3d6506466614","entry":"resnet32","repo":"jianshuod/tba","repo_kind":"official","path":"models/vanilla_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/vanilla_resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4d1d3d6506466614"}},{"code_sha256_prefix":"310efac4b79ed4b8","entry":"resnet34","repo":"jianshuod/tba","repo_kind":"official","path":"models/resnet_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/resnet_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"310efac4b79ed4b8"}},{"code_sha256_prefix":"ba94bd83c4dc0e85","entry":"ResNet18_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ba94bd83c4dc0e85"}},{"code_sha256_prefix":"5f98bf5121225ab2","entry":"ResNet18_quan_mid","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5f98bf5121225ab2"}},{"code_sha256_prefix":"d4579dc79a9b3ea5","entry":"ResNet34_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d4579dc79a9b3ea5"}},{"code_sha256_prefix":"b64260518ba09713","entry":"conv1x1","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b64260518ba09713"}},{"code_sha256_prefix":"7fccbfe95159927d","entry":"conv3x3","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7fccbfe95159927d"}},{"code_sha256_prefix":"fe156b7419dee060","entry":"loss_func_b_hat","repo":"jianshuod/TBA","repo_kind":"official","path":"opt/lf.py","file_url":"https://github.com/jianshuod/TBA/blob/HEAD/opt/lf.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fe156b7419dee060"}},{"code_sha256_prefix":"afa7785be020b743","entry":"make_layers","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_vgg_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_vgg_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"afa7785be020b743"}},{"code_sha256_prefix":"d12f282b670852c9","entry":"resnet101","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet_imagenet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d12f282b670852c9"}},{"code_sha256_prefix":"f0237985c42087d8","entry":"resnet20_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f0237985c42087d8"}},{"code_sha256_prefix":"a198772dc6aa53e5","entry":"resnet20_quan_mid","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"a198772dc6aa53e5"}},{"code_sha256_prefix":"3c7f8e948fc4bb96","entry":"resnet32_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_resnet.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3c7f8e948fc4bb96"}},{"code_sha256_prefix":"15ecbad4de186a7e","entry":"vgg16_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_vgg_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_vgg_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"15ecbad4de186a7e"}},{"code_sha256_prefix":"2c763161356ce3ef","entry":"vgg16_quan_mid","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_vgg_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_vgg_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"2c763161356ce3ef"}},{"code_sha256_prefix":"c1939f569307c9c1","entry":"vgg19_quan","repo":"jianshuod/tba","repo_kind":"official","path":"models/quan_vgg_cifar.py","file_url":"https://github.com/jianshuod/tba/blob/HEAD/models/quan_vgg_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"c1939f569307c9c1"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}