仅翻转少数参数符号位，即可让神经网络彻底失效
Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips
- 提出无数据无优化的DNL方法，定位关键参数
- 翻转2个符号位使ResNet-50准确率下降99.8%
- 适用于图像、检测、分割和大模型，可指导防御
深度神经网络（DNN）仅需翻转少量参数比特即可被灾难性破坏。本文提出无需数据与优化的Deep Neural Lesion（DNL）方法，用于定位关键参数；并推出单次前向与反向传播的改进版1P-DNL，进一步精炼选择。该脆弱性覆盖图像分类、目标检测、实例分割及推理大语言模型等多个领域。在图像分类中，对ResNet-50在ImageNet上的两个符号位翻转导致准确率下降99.8%；在目标检测与实例分割中，主干网络中一个或两个符号位翻转即导致Mask R-CNN与YOLOv8-seg在COCO上的检测与掩码平均精度（AP）崩溃；在语言建模中，向Qwen3-30B-A3B-Thinking的不同专家中各翻转两个符号位，使其准确率从78%降至0%。此外，仅保护少量易损符号位即可实现有效防御。
原文摘要 · Abstract (English)
Deep Neural Networks (DNNs) can be catastrophically disrupted by flipping only a handful of parameter bits. We introduce Deep Neural Lesion (DNL), a data-free and optimizationfree method that locates critical parameters, and an enhanced single-pass variant, 1P-DNL, that refines this selection with one forward and backward pass on random inputs. We show that this vulnerability spans multiple domains, including image classification, object detection, instance segmentation, and reasoning large language models. In image classification, flipping just two sign bits in ResNet-50 on ImageNet reduces accuracy by 99.8%. In object detection and instance segmentation, one or two sign flips in the backbone collapse COCO detection and mask AP for Mask R-CNN and YOLOv8-seg models. In language modeling, two sign flips into different experts reduce Qwen3-30B-A3B-Thinking from 78% to 0% accuracy. We also show that selectively protecting a small fraction of vulnerable sign bits provides a practical defense against such attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。