Fault injection attacks are a potent threat against embedded implementations
of neural network models. Several attack vectors have been proposed, such as
misclassification, model extraction, and trojan/backdoor planting. Most of
these attacks work by flipping bits in the memory where quantized model
parameters are stored.
In this paper, we introduce an encoding-based protection method against
bit-flip attacks on neural networks, titled DeepNcode. We experimentally
evaluate our proposal with several publicly available models and datasets, by
using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results
show an increase in protection margin of up to $7.6\times$ for $4-$bit and
$12.4\times$ for $8-$bit quantized networks. Memory overheads start at $50\%$
of the original network size, while the time overheads are negligible.
Moreover, DeepNcode does not require retraining and does not change the
original accuracy of the model.

我们引入一种基于编码的保护方法 ——DeepNcode，用于防范神经网络的位翻转攻击，实验结果表明，在 4 位和 8 位量化网络中，保护幅度分别提高了 7.6 倍和 12.4 倍，内存开销从原始网络大小的 50% 开始，而时间开销可忽略不计。此外，DeepNcode 不需要重新训练，也不改变模型的准确性。

DeepNcode: 基于编码的神经网络比特翻转攻击防护

DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural  Networks

Deep Neural Network (DNN) models when implemented on executing devices as the
inference engines are susceptible to Fault Injection Attacks (FIAs) that
manipulate model parameters to disrupt inference execution with disastrous
performance. This work introduces Contrastive Learning (CL) of visual
representations i.e., a self-supervised learning approach into the deep
learning training and inference pipeline to implement DNN inference engines
with self-resilience under FIAs. Our proposed CL based FIA Detection and
Recovery (CFDR) framework features (i) real-time detection with only a single
batch of testing data and (ii) fast recovery effective even with only a small
amount of unlabeled testing data. Evaluated with the CIFAR-10 dataset on
multiple types of FIAs, our CFDR shows promising detection and recovery
effectiveness.

本文介绍了一种基于对比学习的 FIA 检测和恢复框架，该框架将对比学习应用于深度学习训练和推断过程中，以实现在 FIAs 下具有自我恢复能力的 DNN 推断引擎。经过 CIFAR-10 数据集上多种类型 FIAs 的评估，我们的 CFDR 框架显示出有希望的检测和恢复效果。