用强化学习高效发现大模型硬件漏洞，仅改几比特就能让模型崩溃。
FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning
- 将位翻转攻击建模为序列决策问题，结合敏感度剪枝与Q-learning快速定位关键比特。
- 在5-7个比特下使LLaMA 3.1和LLaVA模型准确率从近70%暴跌至接近0%。
- 可指导硬件防护设计，验证纠错码在识别位上能完全消除攻击影响。
生成式人工智能模型（如大语言模型和大视觉模型）虽性能卓越，但仍面临硬件级位翻转攻击（BFAs）威胁。现有方法缺乏泛化能力且难以扩展，难以在合理时间内分析现代基础模型庞大的参数空间与复杂依赖关系。本文提出FlipLLM，一种基于强化学习的架构无关框架，将BFA发现建模为序列决策问题。该框架结合敏感度引导的层剪枝与Q-learning，高效识别出最小但高破坏性的位翻转集合。我们在多种模型（GPT-2 Large、LLaMA 3.1 8B、DeepSeek-V2 7B、LLaVA 1.6）和数据集（MMLU、MMLU-Pro、VQAv2、TextVQA）上验证了其有效性与泛化性。结果表明，FlipLLM比当前最优方法快2.5倍，仅需翻转5个比特即可使LLaMA 3.1 8B准确率从69.9%降至约0.2%，翻转7个比特即可使LLaVA VQA得分从78%降至几乎为0。进一步分析显示，对这些关键位应用标准硬件保护机制（如ECC SECDED）可完全消除攻击影响，证明该框架在指导硬件安全防御方面的实用价值。FlipLLM首次提供了可扩展、自适应的多模态基础模型位翻转漏洞探索方法，为全面硬件安全评估铺平道路。
原文摘要 · Abstract (English)
Generative Artificial Intelligence models, such as Large Language Models (LLMs) and Large Vision Models (VLMs), exhibit state-of-the-art performance but remain vulnerable to hardware-based threats, specifically bit-flip attacks (BFAs). Existing BFA discovery methods lack generalizability and struggle to scale, often failing to analyze the vast parameter space and complex interdependencies of modern foundation models in a reasonable time. This paper proposes FlipLLM, a reinforcement learning (RL) architecture-agnostic framework that formulates BFA discovery as a sequential decision-making problem. FlipLLM combines sensitivity-guided layer pruning with Q-learning to efficiently identify minimal, high-impact bit sets that can induce catastrophic failure. We demonstrate the effectiveness and generalizability of FlipLLM by applying it to a diverse set of models, including prominent text-only LLMs (GPT-2 Large, LLaMA 3.1 8B, and DeepSeek-V2 7B), VLMs such as LLaVA 1.6, and datasets, such as MMLU, MMLU-Pro, VQAv2, and TextVQA. Our results show that FlipLLM can identify critical bits that are vulnerable to BFAs up to 2.5x faster than SOTA methods. We demonstrate that flipping the FlipLLM-identified bits plummets the accuracy of LLaMA 3.1 8B from 69.9% to ~0.2%, and for LLaVA's VQA score from 78% to almost 0%, by flipping as few as 5 and 7 bits, respectively. Further analysis reveals that applying standard hardware protection mechanisms, such as ECC SECDED, to the FlipLLM-identified bit locations completely mitigates the BFA impact, demonstrating the practical value of our framework in guiding hardware-level defenses. FlipLLM offers the first scalable and adaptive methodology for exploring the BFA vulnerability of both language and multimodal foundation models, paving the way for comprehensive hardware-security evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。