Security of modern Deep Neural Networks (DNNs) is under severe scrutiny as
the deployment of these models become widespread in many intelligence-based
applications. Most recently, DNNs are attacked through Trojan which can
effectively infect the model during the training phase and get activated only
through specific input patterns (i.e, trigger) during inference. In this work,
for the first time, we propose a novel Targeted Bit Trojan(TBT) method, which
can insert a targeted neural Trojan into a DNN through the bit-flip attack. Our
algorithm efficiently generates a trigger specifically designed to locate
certain vulnerable bits of DNN weights stored in main memory (i.e., DRAM). The
objective is that once the attacker flips these vulnerable bits, the network
still operates with normal inference accuracy with benign input. However, when
the attacker activates the trigger by embedding it with any input, the network
is forced to classify all inputs to a certain target class. We demonstrate that
flipping only several vulnerable bits identified by our method, using available
bit-flip techniques (i.e, row-hammer), can transform a fully functional DNN
model into a Trojan-infected model. We perform extensive experiments of
CIFAR-10, SVHN and ImageNet datasets on both VGG-16 and Resnet-18
architectures. Our proposed TBT could classify 92 % of test images to a target
class with as little as 84 bit-flips out of 88 million weight bits on Resnet-18
for CIFAR10 dataset.

本研究提出了一种新的目标二进制特洛伊（TBT）方法，为实现模型的恶意攻击，通过比特翻转攻击将特定的神经特洛伊插入到深度神经网络中。研究表明，只需利用可用的比特翻转技术（即行锤），翻转几个易受攻击的比特就可以将功能完好的 DNN 模型转化为特洛伊感染的模型，并实现将测试图像的 92％分类到目标类的目的。

TBT: 基于位木马的有针对性神经网络攻击

TBT: Targeted Neural Network Attack with Bit Trojan

Several important security issues of Deep Neural Network (DNN) have been
raised recently associated with different applications and components. The most
widely investigated security concern of DNN is from its malicious input, a.k.a
adversarial example. Nevertheless, the security challenge of DNN's parameters
is not well explored yet. In this work, we are the first to propose a novel DNN
weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural
network through maliciously flipping extremely small amount of bits within its
weight storage memory system (i.e., DRAM). The bit-flip operations could be
conducted through well-known Row-Hammer attack, while our main contribution is
to develop an algorithm to identify the most vulnerable bits of DNN weight
parameters (stored in memory as binary bits), that could maximize the accuracy
degradation with a minimum number of bit-flips. Our proposed BFA utilizes a
Progressive Bit Search (PBS) method which combines gradient ranking and
progressive search to identify the most vulnerable bit to be flipped. With the
aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e.,
top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93
million bits, while randomly flipping 100 bits merely degrades the accuracy by
less than 1%.

本文提出了一种名为 Bit-Flip Attack 的攻击方法，通过翻转极小的二进制权重数字来破坏 Deep Neural Network，同时使用 Progressive Bit Search 方法来定位最脆弱的二进制权重数字，在仅翻转 13 个二进制数字的情况下可让 ResNet-18 的准确率从 69.8% 恶化至 0.1%。