An Optimization Perspective on Realizing Backdoor Injection Attacks on Deep Neural Networks in Hardware

State-of-the-art deep neural networks ( DNNs ) have been proven to be vulnerable to adversarial manipulation and backdoor attacks . Backdoored models deviate from expected behavior on inputs with predefined triggers while retaining performance on clean data . Recent works focus on software simulation of backdoor injection during the inference phase by modifying network weights , which we find often unrealistic in practice due to the hardware restriction such as bit allocation in memory . In contrast , in this work , we investigate the viability of backdoor injection attacks in real-life deployments of DNNs on hardware and address such practical issues in hardware implementation from a novel optimization perspective . We are motivated by the fact that the vulnerable memory locations are very rare , device-specific , and sparsely distributed . Consequently , we propose a novel network training algorithm based on constrained optimization for realistic backdoor injection attack in hardware . By modifying parameters uniformly across the convolutional and fully-connected layers as well as optimizing the trigger pattern together , we achieve the state-of-the-art attack performance with fewer bit flips . For instance , our method on a hardware-deployed ResNet-20 model trained on CIFAR-10 can achieve over 91 % test accuracy and 94 % attack success rate by flipping only 10 bits out of 2.2 million bits . 1 INTRODUCTION . DNN models are known for their powerful feature extraction , representation and classification capabilities . However , the large number of parameters and need for a large training dataset makes it hard to interpret the behavior of these models . The fact that increasing number of security critical systems rely on DNN models in real-world deployments raises numerous robustness and security questions . Indeed , DNN models have been shown to be vulnerable against imperceivable perturbations to input samples which can be misclassified by manipulating the network weights ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Nguyen et al. , 2015 ) . Emboldened by recent physical fault injection attacks , e.g. , Rowhammer , an alternative approach was proposed that directly targets the model when it is loaded into memory . The advantage of this attack approach is that it can remain completely stealthy since the model is only modified in real-time while running in memory and no modification to inputs is required . Recently , Hong et al . ( 2019 ) ; Yao et al . ( 2020 ) showed that flipping a few bits in DNN model weights in memory while succeeding in achieving misclassification , has the side-effect of significant accuracy drops which renders the model useless . Liu et al . ( 2017a ) and Bai et al . ( 2021 ) addressed this problem by tweaking only a minimum number of model weights that makes a DNN model misclassify a chosen input to a target label . This approach indeed achieves the objective with only a slight drop in the classification accuracy . Nevertheless , whether a practical attack such as injecting a backdoor to DNNs can indeed be realized in a scalable and stealthy manner using Rowhammer in hardware is still an open question . Earlier approaches assume that Rowhammer can flip any bits in the memory . This is far from what we observe in reality : only a small fraction of the memory cells are vulnerable . This motivates us to reconsider the backdoor injection process under new constraints , including the training algorithms . Contributions . In this paper we propose a novel algorithm based on constrained optimization that can identify vulnerable bits in the memory for deep learning model to create a backdoor . To this end , we introduce a new fine-tuning process that takes into account the stringent constraints on faults obtained using Rowhammer characterization experiments . To show the practicality of our approach , by fine-tuning the model we first identify the necessary bit flips to implement the backdoor . Using the Rowhammer attack we inject the backdoor in a DRAM setup to the deployed model . Once the backdoor is injected , a DNN model will misclassify any sample with the trigger pattern to the target class without degrading the overall accuracy on clean data . This result shows that indeed real-life deployments are under threat from backdoor injection attacks with potentially adverse affects to the well being of the society . More work needs to be done to secure deployed models from fault injection attacks used for every day tasks by end users . 2 BACKGROUND AND RELATED WORKS . 2.1 BACKDOOR ATTACKS . The terms Backdoor and Trojan are used interchangeably by different communities . Here we use Backdoor for consistency . In DNN models , we define a Backdoor as a hidden feature that causes a change in the behavior that is triggered only by the existence of special type of inputs . In the literature , backdooring is applied with either benevolent intents , such as watermarking the DNN models , or with malicious intents , as a Trojan to attack the models . In this work , we focus on Backdoor as a type of Trojan that is exploited by an attacker to cause targeted misclassification . 2.2 ATTACKS ON DEEP LEARNING MODELS . DNN model weights have been shown to be vulnerable to Rowhammer attacks ( Hong et al. , 2019 ) causing accuracy degradation even after the use of quantization ( Yao et al. , 2020 ) as a defense . A binary integer programming approach was proposed ( Bai et al. , 2021 ) to find the minimum number of bit changes required to manipulate the model for one specific example . Further Rakin et al . ( 2020b ) showed that samples from single or multiple classes can be misclassified to a target class using Rowhammer . However , this attack is not in the scope of backdoor attacks since it does not use a trigger . Earlier works by Liu et al . ( 2017b ) and Gu et al . ( 2017 ) demonstrated that backdoor attacks pose a threat to the DNN model supply chain which can be exploited by poisoning data sets ( Gu et al. , 2017 ) , poisoning the training code ( Bagdasaryan & Shmatikov , 2020 ) , modifying network connections or modifying hardware ( Clements & Lao , 2018 ; Venceslai et al. , 2020 ) . Pang et al . ( 2020 ) proposed mutual optimization of adversarial input and the poisoned models . Recently , Rakin et al . ( 2020a ) showed that backdoor attacks can be implemented by changing only a small number of weight parameters assuming any bit in the memory can be flipped . However , the practicality of software-based backdoor injection attacks during the inference phase is still an open question due to the practical constraints that are overlooked in previous works . 2.3 ROWHAMMER ATTACK . As memories are becoming more compact and memory cells are getting closer and closer , the boundaries between the DRAM rows do not provide sufficient isolation from electrical interference . The data is encoded in the form of voltage levels inside a capacitor which leaks charge over time . Thus they need to be refreshed after every 64ms to keep the data intact . However , if there is an attacker residing in a nearby DRAM row , although in a completely isolated process , the attacker can cause a faster leakage in the victim row by just accessing his own memory space repeatedly ( hammering ) . Rowhammer is a software induced fault attack first introduced by Kim et al . ( 2014 ) . Recently , Frigo et al . ( 2020 ) and de Ridder et al . ( 2021 ) have shown that more than 80 % of the DRAM chips in the market are vulnerable to the Rowhammer attack including DDR4 chips having Target Row Refresh ( TRR ) mitigation . The Error Correcting Codes ( ECC ) mitigation has also been bypassed in Cojocar et al . ( 2019 ) . Rowhammer is a great threat to shared cloud environments ( Cojocar et al. , 2020 ; Xiao et al. , 2016 ) as it can be launched across virtual machine ( VM ) boundaries and even remotely through JavaScript . More recently , Qazi et al . ( 2021 ) have shown a combined effect of more than two aggressor rows to induce bit flips in recent generations of DRAM chips . All existing Rowhammer defenses including TRR , ECC , detection using Hardware Performance Counters and changing the refresh rate can not fully prevent Rowhammer attack ( Gruss et al. , 2018 ; Frigo et al. , 2020 ) . The only requirement of the Rowhammer attack is that the attacker and the victim share the same DRAM chip , vulnerable to the Rowhammer attack . 3 METHODOLOGY . 3.1 THREAT MODELS . Same as in earlier works ( Gu et al. , 2017 ; Rakin et al. , 2020a ; Liu et al. , 2017b ; Hong et al. , 2019 ; Yao et al. , 2020 ) , we assume that the attacker • only knows the model architecture and model parameters ; • has a small percentage of the unseen test data set ; • does not have access to the training hyperparameters , or the training dataset ; • is involved only after the model deployment in a cloud server , and therefore does not need to modify the software supply chain ; • resides in the same physical memory as the target model ; • has no more than regular user privileges ( no root access ) . Such threat models are well motivated in shared cloud instances targeting a co-located host running the model , and in sandboxed browsers targeting a model residing in the memory of the host machine ( Cojocar et al. , 2020 ; Xiao et al. , 2016 ; de Ridder et al. , 2021 ) . To better understand our attacker , we illustrate an example in Fig . 1 . The attacker works as follows : 1 . Offline Attack Phase : By studying the model parameters and the memory , the attacker generates a trigger pattern and determines the vulnerable bits in the target model . 2 . Dynamic Trigger Injection : After the target model is loaded into the memory , using Rowhammer the attacker flips the target bits by only accessing its own data that resides in the neighboring rows of the weight matrices in the DRAM . 3 . Misclassification : After the backdoor is inserted , the model will misclassify the trigger-added input to the target class . The misclassification will persist until the backdoored model is unloaded from the memory . Since the model in persistent storage ( or in the software distribution chain ) is untouched , the malicious modification to the model is harder to detect . 3.2 OFFLINE ATTACK PHASE . In the offline phase of the attack , we optimize the trigger pattern and the bit-flip locations in the weight matrices . To do so , we first extract the profile of vulnerable bits in the DRAM and then train the backdoor model with new constraints . Note that this phase is independent on the hardware specification , and the learned model can be used freely in any DRAM . 3.2.1 ROWHAMMER PROFILING . Rowhammer profiling is a process of finding vulnerable memory addresses in the DRAM . This process can be performed offline before the victim starts running . We have used the Hammertime tool 1 by Tatar et al . ( 2018 ) to profile our DRAM with double-sided Rowhammer . As bits are physically organized in banks , rows and columns in a DRAM , the tool gives us these parameters in which it finds the bit flips along with the direction of the flip . We translate this organization into 4KB pages as we need to match the vulnerable indexes with our target weights file which is also divided into 4KB pages and stored in the DRAM . Among all the available Rowhammer tools , Hammertime gives the most number of bit flips as shown in ( Tatar et al. , 2018 ) . In practice , we observe that only 0.036 % of the total cells in the 128MB buffer have bit flips , as illustrated in Fig . 2 . Hence , assuming a specific sequence of bit flips within a page like in previous research is highly unrealistic .

Summary: The paper explores backdoor injection attacks on machine learning models, the attack develops in the following way:  1. The model and its parameters are studied offline to determine a trigger pattern and the bits that must be modified in the target model. 2. A RowHammer attack is used to modify the bits of the model after it is loaded into DRAM 3. When inputs are received which include a trigger, the model will misclassify the input. In the case of "clean" inputs, the aim is to leave the performance unchanged.  * unlike previous work vulnerable bits are sought throughout the model (not just the last layer) * care is taken to understand the limitations of the RowHammer attack, i.e. in reality only a small number of specific bits can be flipped  * a new technique is used to jointly find weight modifications and the data trigger pattern (CFT with BR)