提出高效定位全精度模型中关键比特并实现隐蔽攻击的方法。
Impactful Bit-Flip Search on Full-precision Models
- 设计IBS方法，快速识别影响模型性能的关键比特
- 仅翻转少量比特即可导致模型性能显著下降
- 通过参数微调规避检测，适合研究模型安全漏洞
神经网络在各类任务中表现优异，但对输入或参数的微小变化仍敏感。其中，比特翻转攻击（BFA）尤为严重：仅需翻转模型参数中的少数关键比特，即可大幅降低模型性能。常见诱导比特翻转的方式是通过行锤击（Row-Hammer）攻击，利用频繁未缓存内存访问来改变数据。现有方法多依赖穷举搜索或逐层分析，尤其适用于量化网络。本文提出一种新方法——影响性比特翻转搜索（IBS），可高效定位全精度模型中的关键比特并实施翻转。此外，我们还提出权重隐形（Weight-Stealth）技术，通过在原分布内调整参数，使浮点值看似合法，从而绕过常见的范围检查型篡改检测机制。
原文摘要 · Abstract (English)
Neural networks have shown remarkable performance in various tasks, yet they remain susceptible to subtle changes in their input or model parameters. One particularly impactful vulnerability arises through the Bit-Flip Attack (BFA), where flipping a small number of critical bits in a model's parameters can severely degrade its performance. A common technique for inducing bit flips in DRAM is the Row-Hammer attack, which exploits frequent uncached memory accesses to alter data. Identifying susceptible bits can be achieved through exhaustive search or progressive layer-by-layer analysis, especially in quantized networks. In this work, we introduce Impactful Bit-Flip Search (IBS), a novel method for efficiently pinpointing and flipping critical bits in full-precision networks. Additionally, we propose a Weight-Stealth technique that strategically modifies the model's parameters in a way that maintains the float values within the original distribution, thereby bypassing simple range checks often used in tamper detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。