Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
Authors: Jiawang Bai
Baoyuan Wu
Yong Zhang
Yiming Li
Zhifeng Li
Shu-Tao Xia
Venue: ICLR 2021 Poster (2021)
Keywords: targeted attack
bit-flip
weight attack

Abstract: To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack in the training stage and the adversarial attack in the inference stage. In this paper, we study a novel attack paradigm, which modifies model parameters in the deployment stage for malicious purposes. Specifically, our goal is to misclassify a specific sample into a target class without any sample modification, while not significantly reduce the prediction accuracy of other samples to ensure the stealthiness. To this end, we formulate this problem as a binary integer programming (BIP), since the parameters are stored as binary bits ($i.e.$, 0 and 1) in the memory. By utilizing the latest technique in integer programming, we equivalently reformulate this BIP problem as a continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of multipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of our method in attacking DNNs.

Published as a conference paper at ICLR 2021
TARGETED ATTACK AGAINST DEEP NEURAL NET- WORKS VIA FLIPPING LIMITED WEIGHT BITS
Jiawang Bai 1 Baoyuan Wu 3,4 Yong Zhang 5, Yiming Li Zhifeng Li Shu-Tao Xia
Tsinghua Shenzhen International Graduate School, Tsinghua University
2 PCL Research Center of Networks and Communications, Peng Cheng Laboratory
School of Data Science, The Chinese University of Hong Kong. Shenzhen
4 Secure Computing Lab of Big Data, Shenzhen Research Institute of Big Data
5 Tencent Al Lab
ABSTRACT
To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack the training stage and the adversarial attack in the inference stage. In this pa- per, we study novel attack paradigm, which modifies model parameters in the deployment stage for malicious purposes. Specifically, our goal is to misclassify a specific sample into target class without any sample modification, while not significantly reduce the prediction accuracy of other samples to ensure the stealth- iness. To this end, we formulate this problem as binary integer programming (BIP), since the parameters are stored as binary bits (f.e., and 1) in the mem- ory. By utilizing the latest technique in integer programming, we equivalently reformulate this BIP problem as continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of mul- tipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of our method in attacking DNNs. The code is available at: htttp:://githb. waw///aaaaaaaaaaaaaaaaa
INTRODUCTION
Due to the great success of deep neural networks (DNNs), its vulnerability (Szegedy et al. 2014 Gu al. 2019) has attracted great attention, especially for security- -criiit- applications (e.g.. face recognition (Dong et al. 2019) and autonomous driving (Eykholt et al.) 2018)). For example, back- door attack (Saha et al., 2020, Xie et al., 2019) manipulates the behavior of the DNN model by mainly poisoning some training data in the training stage; adversarial attack (Goodfellow et al.) 2015 Moosavi-Dezfooli et al.) 2017) aims to fool the DNN model by adding malicious perturba- tions onto the input in the inference stage.
Compared to the backdoor attack and adversarial attack, novel attack paradigm, dubbed weight attack (Breier al. 2018)), has been rarely studied. It assumes that the attacker has full access to the memory of device, such that he/she can directly change the parameters of a deployed model to achieve some malicious purposes (e.g., crushing fully functional DNN and converting to random output generator (Rakin et al.] 2019)). Since weight attack neither modifies the input nor control the training process, both the service provider and the user difficult to realize the existence of the attack. In practice, since the deployed DNN model is stored as binary bits in the memory, the attacker can modify the model parameters using some physical fault injection techniques, such as Row Hammer Attack (Agoyan et al. 2010: Selmke et al.) 2015) and Laser Beam Attack (Kim) jet al. 2014). These techniques can precisely flip any bit of the data in the memory. Some previous works (Rakin et al.) 2019 2020a b) have demonstrated that it is feasible to change the model weights via bit flipping achieve some malicious purposes. However, the critical bits are identified mostly
'This work done when Jiawang Bai was intern at Tencent AT Lab. Correspondence Baoyuan Wu (wubaoyuan wactaannncchhkcuuu and Shu-Tan Xia (xisst@sz.tsinghuu..dd

---

Published as a conference paper at ICLR 2021
DNN in the memory
A tttckke: identify and flip critical bits
Specific Sample
Oter Samples
A Specific Sample
Other Samples
Do not modify samples Classified into the target class
Behave Normally
Behave Normally
Demonstration of our proposed attack against deployed DNN in the memory. By flipping critical bits (marked in red), our method can mislead specific sample into the target class without any sample modification while not significantly reduce the prediction accuracy of other samples.
Figure 1:
using some heuristic strategies in their methods. For example, Rakin et al. (2019) combined gradient ranking and progressive search identify the critical bits for flipping.
This work also focuses on the bit-level weight attack against DNNs in the deployment stage, whereas with two different goals, including effectiveness and stealthiness. The effectiveness requires that the attacked model can misclassifyy a specific sample to a attacker-speciffed target class without any sample modification, while the stealthiness encourages that the prediction accuracy of other samples will not be significantly reduced. As shown in Fig. [ to achieve these goals, we propose to identify and flip bits that are critical the prediction of the specific sample but significantly impact the prediction of other samples. Specifically, we treat each bit in the memory as binary variable, and our task to determine state (i.e., or 1). Accordingly, it can be formulated binary integer programming (BIP) problem. To further improve the stealthiness, we also limit the number flipped bits, which can be formulated as a cardinality constraint. However, how to solve the BIP problem with cardinality constraint is challenging problem. Fortunately, inspired by an advanced optimization method, the bo- ADMM (Wu & Ghanem 2018), this problem can be reformulated continuous optimization problem, which can further be efficiently and effectively solved by the alternating direction method of multipliers (ADMM) (Glowinski & Marroco. 1975) Gabay & Mercier 1976). Consequently, the flipped bits can be determined through optimization rather than the original heuristic strategy, which makes our attack more effective. Note that we also conduct attack against the quantized DNN models, following the setting in some related works (Rakin et al., 2019; 2020a). Extensive experiments demonstrate the superiority of the proposed method over several existing weight attacks. For example, our method achieves a 100% attack success rate with 7.37 bit-flips and 0.09% accuracy degradation of the rest unspecific inputs in attacking a 8-bit quantized ResNet-18 model on ImageNet. Moreover, we also demonstrate that the proposed method is also more resistant to existing defense methods.
The main contributions of this work are three-fold. 1) We explore novel attack scenario where the attacker enforces specific sample to be predicted deployed model via bit flipping without any sample modification. 2) We formulate the attack as a BIP problem with the cardinality constraint and propose effective and efficient method to solve this problem. 3) Extensive experiments verify the superiority of the proposed method against DNNs with without defenses.
target class by modifying the weights of
2 RELATED WORKS
Neural Network Weight Attack. How to perturb the weights of a trained DNN for malicious
purposes received extensive attention (Liu et al.) 2017a| 2018b Hong et al. 2019). Liu et al. (2017a) firstly proposed two schemes to modify model parameters for misclassification without and with considering stealthiness, which is dubbed single bias attack (SBA) and gradient descent
2

---

Published as a conference paper at ICLR 2021
attack (GDA) respectively. After that, Trojan attack (Liu et al. 2018b) was proposed. which injects malicious behavior to the DNN by generating general trojan trigger and then retraining the model. This method requires to change lots of parameters. Recently, fault sneaking attack (FSA) ZZao et al. 2019) was proposed, which aims to misclassify certain samples into a target class by modify- ing the DNN parameters with two constraints, including maintaining the classification accuracy of other samples and minimizing parameter modifications. Note that all those methods are designed to misclassify multiple samples instead of specific sample, which may probably modify lots of parameters or degrade the accuracy of other samples sharply.
Bit-Flip based Attack. Recently, some physical fault injection techniques (Agoyan et al. 2010 Kim et al. [2014] Selmke et al. (015)) were proposed, which can be adopted to precisely flip any bit in the memory. Those techniques promote researchers to study how to modify model parameters at the lit-level. As branch of weight attack, the bit-flip based attack was firstly explored in (Rakin jet al. 2019). It proposed an untargeted attack that can convert the attacked DNN to random output generator with several bit-flips. Besides, Rakin et al. (020a) proposed the targeted bit Trojan (TBT) to inject the fault into DNNs by flipping some critical bits. Specifically, the attacker flips the identified bits to force the network to classify all samples embedded with trigger to certain target class, while the network operates with normal inference accuracy with benign samples. Most recently, Rakin al. (2020b) proposed the targeted bit-flip attack (T-BFA), which achieves malicious purposes without modifying samples. Specifically, T-BFA can mislead samples from single source class or all classes to target class by flipping the identified weight bits. It is worth noting that the above bit- flip based attacks leverage heuristic strategies to identify critical weight bits. How to find critical bits for the bit-flip based attack method is still an important open question.
3 TARGETED ATTACK WITH LIMITED BIT-FLIPS (TA-LBF)
3.1 PRELIMINARIES
Storage and Calculation of Quantized DNNs. Currently, it is a widely-used technique to quantize DNNs before deploying on devices for efficiency and reducing storage size. For each weight in 1-th layer of a Q-bit quantized DNN, it will be represented and then stored as the signed integer in two's 's complement representation (u [uq; it.--i...;;.) E {0, 1)9) in the memory. Attacker can modify the weights of DNNs through flipping the stored binary bits. In this work, we adopt the layer-wise uniform weight quantization scheme similar to Tensor RT (Migacz) (017). Accordingly, each binary vector v can be converted to a real number by a function h(-), as follow:
Q-1
h(w) = (-22-1 UQ
+ Σ 2 u;). 1.)))
where / indicates which layer the weight from, A > 0 known and stored constant which represents the step size of the (-th layer weight quantizer.
Notations. We denote a Q-bit quantized DNN-based classification model as f X + y, where ....
X' E Rd being the input space and y E {1. .... K} being the K-class output space. Assuming that the last layer of this DNN model is a fully- cully-comnecte layer with B E {0, 1) x being the quantized weights, where C' is the dimension of last layer's 's input. Let B., E (0, 13 be the two's complement representation of single weight and B E {0, cxcxQ denotes all the binary weights connected to the i-th output neuron. Given test sample x with the ground-trum label s, fx; O B) E [0, 1]K is the output probability vector and g( ²) E BCC is the input of the last layer, where denotes the model parameters without the last layer.
Attack Scenario. In this paper, we focus on the white-box bit-flip based attack, which was first introduced (Rakin et al. 2019). Specifically, we assume that the attacker has full knowledge of the model (including it s architecture, parameters, and parameters' location in the memory), and can precisely flip any bit in the memory. Besides, we also assume that attackers can have access to a small portion of benign samples, but they can not tamper the training process and the training data.
Attacker's Goals. Attackers have two main goals, including the effectiveness and the stealthiness. Specifically. effectiveness requires that the attacked model can misclassify specific sample to a pre- defined target class without any sample modification. and the stealthiness requires that the prediction accuracy of other samples will not be significantly reduced.
3

---

Published as a conference paper at ICLR 2021
3.2 THE PROPOSED METHOD
Loss for Ensuring Effectiveness. Recall that our first target is to force a specific image to be classified as the target class by modifying the model parameters the bit-level. To this end, the most straightforward way is maximizing the logit of the target class while minimizing that of the source class. For a sample æ, the logit of class can be directly determined by the imput of the last layer g ( ) and weights connected to the node of that class. Accordingly, we can modify weights only connected to the source and target class to fulfill our purpose, as follows:
( O, B, Bg. B,) max (m p(2: O B₂) 5,0) + max (p(x: O B,) + 8, 8,0), (2)
where p(æ; B,) (A :): (BB,, h (B, or i = t) h(-) is the function defined in Eq.
c )] g(x; +) denotes the logit of class m
EE max
p(æ; ((())
B;), and 8 E IR
indicates slack variable, which will specified in later experiments. The first term of Li aims at increasing the logit of the target class, while the second term is to decrease the logit of the source class. The loss C1 is O only when the output on target class is more than m + 8 and the output on source class is less than m 8. That is, the prediction on of the target model is the predefined target class. Note that B. B, (0, c the weights of the fully-connected layer w.r.l. class & and I, respectively, in the target DNN model. B E {0, 1) XxCXQ denotes the weights of the colnecco layer of the original DNN model, and it is a constant tensor in L1. For clarity, hereafter we simplify L (x:; O B, B.) as L1 (B., B.), since and O are also provided input and weights.
two variables we want to optimize, corresponding to
Loss for Ensuring Stealthiness. As we mentioned in Section 3.1
we assume that the attacker can get access to auxiliary sample set ((x,, ): Accordingly, the stealthiness of the attack can be formulated as follows:
N
La B,, B.) Σ (lS(;; O (1,.., B., B.),
(3)
where B11,..,KKKsss denotes {Bi, B2.... BK]IB, B.). and fz O, (M.(.))) B., B,)
indicates the posterior probability of æ, w.r.l. class j. caclulated by Softmax(p(1:;; O B, (oftmax(p(a;;; O,B,)) () is specified by the cross entropy loss. To keep clarity, 2i Q and B ((M..)))MMM omitted in CB, R,,... B,)
Besides, to better meet our goal, a straightforward additional approach is reducing the magnitude of the modification. In this paper, constrain the number of bit-flips less than k. Physical bit flipping techniques can be time-consuming as discussed in (Van Der Veen et al., 2016) ZZho et al.) 2019). Moreover, such techniques lead to abnormal behaviors in the attacked system (c.g., suspicious cache activity of processes), which may be detected by some physical detection- defenses (Gruss al. 2018). As such, minimizing the number of bit-flips is critical to make the attack more efficient and practical.
Overall Objective. In conclusion, the final objective function is as follows:
min B,
L, (B,,, B.) + AC2(B.. B.),
(4)
s.t. B. E (0, (0,1) B, E (00 de (B. B.) dn (B,, s k.
where d((-.-) denotes the Hamming distance and À 0 is a trade-off parameter.
For the sake of brevity, B, and B, are concatenated and further reshaped to the vector b E (0, 1)2Q. Similarly, B, and B, are concatenated and further reshaped to the vector b E [0,1]2cQ, Besides, for binary vector b and b, there exists a nice relationship between Hamming distance and Euclidean distance: d 6) ||b 6112. The new formulation of the objective is follows:
min L (b) + (C2(b), s.t. b e (0, 1020, ||b b112 k 0.
(5)
Problem (5) is denoted as TA-LBF (targeted attack with limited bit- flipsl.s.. Note that TA-LBF is binary integer programming (BIP) problem, whose optimization is challenging. We will introduce an effective and efficient method solve it in the following section.
4

---

Published as a conference paper at ICLR 2021
3.3 AN EFFECTIVE OPTIMIZATION METHOD FOR TA-LBB
To solve the challenging BIP problem (5) we adopt the generic solver for integer programming.
dubbed -Boox ADMM (Wu & Ghanem 2018). The solver presents its superior performance in
many tasks, e.g., model pruning (Li et al.
2019), clustering (Bibi et al.. 2019). MAP inference (Wu
al. (020aa), adversarial attack (Fan et al., 2020), etc.. It proposed replace the binary constraint
equivalently by the intersection of two continuous constraints, as follows
E [0, 1,a0Q + b E (Sp 0 Sp),
where S. = [0, 1|200 indicates the box constraint, and Sp {b 116 116- 1112 2CQ) denotes the ep-sphere constraint. Utilizing (6). Problem (5) is equivalently reformulated as
min
(b) AC2(b), s.t. b = un b u2 6 bll2 k + ug = 0,
where two extra variables u1 and ug are introduced to split the constraints w.r.t. b. Besides, the non-
negative slack variable ug RR+ is used to transform |bb-bl3 k < 0 in 5 into |bb - t
b12
0. The above constrained optimization problem can be efficiently solved by the alternating direction method of multipliers (ADMM) (Boyd al., 2011).
Following the standard procedure of ADMM, we firstly present the augmented Lagrangian function of the above problem, follows:
L(b, U1 U2 U3 21, 22, 23) (b) XC2(6) + 2, (6 un + 2 (6 u2)
+23(11 - b112 k k us) + c1 (u() + c2( + ca(
(8)
+ - 116- u111 12:
- b un 11 + -/ (1lb b15 k + u3)
2
2
2
where z1, E R2CQQ and 23 E R are dual variables, and pl, P2. P3 > 0 are penalty factors, which will be specified later. ej (u,) = [(.. (2(22) = [(,,,,,), and ca (a(u)) [( capture the constraints S,, and RR+ respectively. The indicator function [a] = if is true; otherwise, [[a)) +oc. Based on the augmented Lagrangian function, the primary and dual variables updated iteratively, with r indicating the iteration index.
Given (b', Iं. z5, 25), update (uf+), u ulg )) Given 21 (u1, u2 u3) are inde- pendent, and they can be optimized in parallel, as follows
u a+ arg min (=f) (br u1) / lb
un
11 Ps, (b' + x
r+ arg min (2t) T (6r u2) + t br u2l12 Ps, (br
u
p2
#xE8,
w/ r+ arg min 2] b11l2 1 - k + uz) + f (b br1l3 k + uz)
= Pa (- bb br113 + k
%/ ) mg
where Ps, min((1 (1, mmx a)) with a E Rd is the projection onto the box constraint S5; Ps, (a) = 2 aa + with à a - 1/4 indicates the projection onto the fz-sphere constraint Sp Wu & Ghanem 2018); PR+ (a) mmx a) with AER indicates the projection onto R+
Given (uf+1 un utt1 , ugtt 2I, 2)), update ir+1. Although there is no closed-form solution to br+1, it can be easily updated by the gradient descent method, as both (b()) and L2(b) are differentiable w.r.f. b, as follows
r b' OL(b, u
Un
23 27 23, 24)
(10)
ab
b=b-
where 7) > 0 denotes the step size. Note that we can run multiple steps of gradient descent in the above update. Both the number of steps and 7) will be specified in later experiments. Besides, due to the space limit, the detailed derivation of aT.aā will be presented in Appendix A
5

---

Published as a conference paper at ICLR 2021
Given (6*+1, ui u22 uut1, "n ") update (z)+1, :22 ,23 )) The dual variables are updated by the gradient ascent method, as follows
r++
x 2++1 = x + p1 - ui 44 )
r++ = 2 + p2 U2 )
(1I)
22
2+ 2/ + Ps( P b- br 112 k + u3 23
Remarks. 1) Note that since (u , nn5t1, Wig ) are updated in parallel, their updates belong to two-block ADMM algorithm. We provide the algorithm outline in Appendix B 2) Except for the update of b all other updates are very sim- ple and efficient. The computational cost of the whole algorithm will be analyzed in Appendix C 3) Due the inexact solution to br+1 using gradient descent, the theoretical convergence of the whole ADMM algorithm cannot be guaranteed. However, as demonstrated in many previous works "Gol'shtein & yrko'y 1979; Eckstein & Bertsekas) 1992 Boyd al. 2011), the inexact two-block ADMM often shows good practical convergence, which is also the case in our later ex- periments. Besides, the numerical convergence analysis is presented Appendix D 4) The proper adjustment of (pi, P2, P3) could accelerate the practical convergence, which will be specified later.
the same block. Thus, the above algorithm
4 EXPERIMENTS
4.1 EVALUATION SETUP
Settings. We compare our method (TA-LBF) with GDA (Liu et al. 2017a). FSA (Zhao al. 2019), T-BFA (Rakin et al. 2020b), and TBT (Rakin et al. 2020a). All those methods can be adopted to misclassify specific image into target class. We also take the fine-tuning (FT) of the last fully-connected layer as a baseline method. We conduct experiments on CIFAR-10 (Krizhevsky et al. 2009) and ImageNet (Russakovsky al. 2015). We randomly select 1,000 images from each dataset as the evaluation set for all methods. Specifically, for each of the 10 classes in CIFAR-10, we perform attacks on the 100 randomly selected validation images from the other 9 classes. For ImageNet, we randomly choose 50 target classes. For each target class, we perform attacks on 20 images randomly selected from the rest classes in the validation set. Besides, for all methods except GDA which does not employ auxiliary samples, we provide 128 and 512 auxiliary samples on CIFAR-10 and ImageNet, respectively. Following the setting (Rakin et al.] [2020a (b), we adopt the quantized ResNet (He et al. 2016) and VGG (Simonyan & Zisserman (2155) 5) as the target models. For our TA-LBE, the trade-off parameter À and the constraint parameter & affect the attack stealthiness and the attack success rate. We adopt strategy for jointly searching À and k, which is specified in Appendix E.3 More descriptions of our settings are provided in Appendix
Evaluation Metrics. We adopt three metrics to evaluate the attack performance, i.e., the post attack accuracy (PA-ACC), the attack success rate (ASR), and the number of bit-flips (Naip). PA-ACC denotes the post attack accuracy on the validation except for the specific attacked sample and the auxiliary samples. ASR is defined as the ratio of attacked samples that are successfully attacked into the target class among all 1,000 attacked samples. Neip is the number of bit-flips required for an attack. A better attack performance corresponds to a higher PA-ACC and ASR, while a lower Nuip- Besides, we also show the accuracy of the original model, denoted as ACC.
4.2 MAIN RESULTS
Results on CIFAR-10. The results of all methods on CIFAR-10 are shown in Table Our method achieves a 100% ASR with the fewest Naip for all the bit-widths and architectures. FT modifies the maximum number of bits among all methods since there is no limitation of parameter modifications. Due to the absence of the training data, the PA-ACC of FT is also poor. These results indicate that fine-tuning the trained DNN as an attack method is infeasible. Although T-BFA flips the second- fewest bits under three cases, it fails to achieve a higher ASR than GDA and FSA. In terms of PA-ACC, TA-LBF is comparable to other methods. Note that the PA-ACC of TA-LBF significantly outperforms that of GDA, which is the most competitive w.E.f. ASR and Naap among all the baseline methods. The PA-ACC of GDA is relatively poor, because it does not employ auxiliary samples. Achieving the highest ASR, the lowest Ntip and the comparable PA-ACC demonstrates that our optimization-base based method is more superior than other heuristic methods (TBT, T-BFA and GDA).

---

Published as a conference paper at ICLR 2021
Table I: Results of all attack methods across different bit-widths and architectures on CIFAR-10 and ImageNet (bold: the best; underline: the second best). The mean and standard deviation of PA-ACC and Nuip are calculated by attacking the 1,000 images. Our method is denoted as TA-LBF.
Target Model
PA-ACC
ASR
Target Model
PA-ACC
ASK
Dataset
Method
(56
(%)
Nmi
(%)
(%)
Nup
FT TET
=5.0
100.0
1507.51
84,31=3.10
98.7
1229.74-:308
ResNet
88.07
97.3
20
VGG
27.79
51.6
199,40=19.53
8-bit
8-bit
T-BFA
87. 27
98.7
9.91
89.83
96.7
14,53-+3.4
PSA
222
185.51
96.8
253.92a/12.0
CIFAR- 10
GDA
ACC:
86.73
99.8
2:253
ACC:
85.51
100.0
21.54
92.16%
93.20%
TA-LBF
28.20=22.4
100.0
5.57
86.06+3.17
100.0
7,40=272
84.37.294
100.0
28
83.3 13376
94.5
12:0052
TBT T-BFA
ResNet
87.79
96.0
118.20 15.02
VGG
83.90
62.4
266.40 18.70
4-bit
86.46.2330
97.9
2.80
88.74.482
96.2
11.23:a7.36
FSA
87.73
27
+7.58
97.5
25.03
ACC:
ACC:
GDA
91.90%
86.25
99.8
14.08
92.61%
85.08
100.0
10.31 #3,77
TA-LBF
87.82
100.0
1.2
85.91 a3.2
100.0
6.26
FT TET
ResNet
59.33
100.0
277424.29 1213333
VGG
62.00 +2.08
100.0
1729685
13753999
69.18
$77.40: 19.42
72. +
99.2
15.26+
T-BFA
8-bit
68.71
79.3
24.57 +2000
8-bit
73.09
84.5
363.78 48:
FSA
69.27
99.7
441.2 441,21 11144
73,28
100.0
1030.03:::000
ACC:
ACC:
ImuggeNNe
GDA
69.50%
69.26:0.2
100.0
18.54
73.31%
73.29
100.0
197.05
TA-LBF
69.41=oms
100,0
7.37+2.8
73.28
100.0
69,89 18.42
FT
25.65
100.0
5,5854,500211 1914
17.76
100.0
190075
7.
ResNet
VGG
THT T-BFA
66.36-007
22: 15
71.18
100.0
3231
b-b
4-bit
65 46
80.4
24. 19:
71.49
84.3
350.33
FSA
66.44g021
99.9
157 8336
71.69
100.0
441 1
ACC:
ACC:
GDA
66.77%
66.54=022
100.0
11.45
71.76%
71.73::005
100.0
107.18 28
TA-LBF
66.69_au
100.0
7.96.2290
71.73
100.0
69.72.1188 1884
Results on ImageNet. The results on ImageNet are shown in Table 1 It can be observed that GDA shows very competitive performance compared to other methods. However, our method obtains the highest PA-ACC, the fewest bit-flips (less than 8), and 100% ASR attacking ResNet. For VGG, our method also achieves a 100% ASR with the fewest NdiP for both bit-widths. The NaiP results of our method are mainly attributed to the cardinality constraint on the number of bit-flips. Moreover, for our method, the average PA-ACC degradation over four cases on ImageNet is only 0.06%, which demonstrates the stealthiness of our attack. When comparing the results of ResNet and VGG, an interesting observation is that all methods require significantly more bit- for VGG. One reason is that VGG is much wider than ResNet. Similar to the claim in (He et al. 2020). increasing the network width contributes to the robustness against the bit-flip based attack.
4.3 RESISTANCE TO DEFENSE METHODS
Resistance to Piece-wise Clustering. He et al. (2020) proposed a novel training technique, called piece-wise clustering, to enhance the network robustness against the bit-flip based attack. Such training technique introduces an additional weight penalty the inference loss, which has the effect of eliminating close-to-zero weights (He et al. 2020). We test the resistance of all attack methods to the piece-wise clustering. We conduct experiments with the 8-bit quantized ResNet on CIFAR-10 and ImageNet. Following the ideal configuration in (He et al. 2020), the clustering coefficient, which is a hyper-parameter of piece-wise clustering, is set to 0.001 in our evaluation. For our method, the initial & is set to 50 on ImageNet and the rest settings are the same as those in Section 4.1 Besides the three metrics in Section 4.1 we also present the number of increased Naip compared to the model without defense (i.e., results in Table []. denoted as AN
The results of the resistance to the piece-wiss clustering of all attack methods are shown in Table 2 It shows that the model trained with piece-wise clustering can improve the number of required bit-flips for all attack methods. However, our method still achieves 100% ASR with the least number of bit-flips on both two datasets. Although TBT achieves smaller ANtip than ours on CIFAR-10, its ASR is only 52.3%, which also verifies the defense effectiveness of the piece-wise wise clustering. Compared with other methods, TA-LBF achieves the fewest AN ImageNet and the best PA-ACC on both datasets. These results demonstrate the superiority of our method over other methods when attacking models trained with piece-wise clustering.
7

---

Published as a conference paper at ICLR 2021
Table 2: Results of all attack methods against the models with defense CIFAR-10 and ImageNet (bold: the best; underline: the second best). The mean and standard deviation of PA-ACC and Ndlp are calculated by attacking the 1,000 images. Our method denoted as TA-LBE. ANtii denotes
the increased Nap compared to the corresponding result in Table
ACC
PA-ACC
ASR
Defense
Dataset
Method
(%)
(%)
(%)
Naip
ANiip
84.061156
99.5
1893 S5 16898
386.04
CIFAR-10
TBT
87.05
52.3
254,20110222
7.50
Piece-wise Clustering
T-BFA
85.82+180
98.6
-5.51-944
35.60
91.01
FSA
86.6 86261
98.6
246. 1775.0
60.60
GDA
84.12+477
100.0
52.76=1622
25.93
TA-LBF
87.30=274
100.0
18,93
13.36
FT
43 23.44:2207
92.2
762267 56
484843.27
ImageNet
TBT
63.07
81.8
1184, 34:30
606.74
T-BEA
62.82.027
90.1
273.56.11113
248.99
63.62
FSA
63, 63.26+021
99.5
729. 94
288.73
GDA
63.14
100.0
107.59
89.05
TA-LBF
63.52+0114
100.0
51.11=435
43.74
86.462224
100.0
2753.43
1245.92
CIFAR- 10
TBT
89.72=2.
89.5
16..90
120.20
Larger Model Capacity
T-BFA
91.16#1.4
98.7
17.91
8.00
94.29
PSA
90,70,257
98.5
271.27
85.76
GDA
89.83=3m2
100.0
48 26-2112210
22.13
TA-LBF
90.96126)
100.0
8.79.1.44
3,22
63.51
100.0
507456 L..55T7.
230032.32
ImageNel
TRT
122004
99.9
1138 24
560.94
T-BFA
70.84=u330
88.9
40.23
15.66
71.35
FSA
71.30=mu4
100.0
449.70==10..
8.49
GDA
11.30.000
100.0
20.01 1600
1.47
TA-LBF
71.30
100.0
8.48
1.11
ASR
PA-ACC
Nato
102
10
100
PA-ACC ASR (%6)
PA-ACC ASR (%6)
PA-ACC ASR
Arii
Nripp
Neip
02
79
7
N
Figure 2: Results of TA-LBF with different parameters X, k, and the number auxiliary samples N on CIFAR-10. Regions in shadow indicate the standard deviation of attacking the 1,000 images.
Resistance Larger Model Capacity. Previous studies (He 2020 Rakin al. 2020b) observed that increasing the network capacity can improve the robustness against the bit-flip based attack. Accordingly, evaluate all attack methods against the models with a larger capacity using the 8-bit quantized ResNet on both datasets. Similar to the strategy in (He et al., 2020), we increase the model capacity by varying the network width (i.e., 2x width in our experiments). All settings of our method are the same as those used in Section
The results are presented Table 2 We observe that all methods require more bit-flips to attack the model with the 2x width. To some extent, it demonstrates that the wider network with the same architecture is more robust against the bit-flip based attack. However, our method still achieves 100% ASR with the fewest Ntiip and AN Moreover, when comparing the two defense methods, we find that piece-wiss wise clustering performs better than the model with a larger capacity in terms of AN However, wise clustering training also causes the accuracy decrease of the original model (e.g., from 16% to 91.01% % on CIFAR-10), We provide more results in attacking models with defense under different settings in Appendix
8

---

Published as a conference paper at ICLR 2021
Original ACC-98.0%
FSA PCC-CCBB N1,-97
GDA N
TA-LBF((urs) PA-ACC-B1 6% 7
iTanget Class)
(Source Cass)
Sample
Figure 3: Visualization of decision boundaries of the original model and the post attack models. The attacked sample from Class is misclassified into the Class by FSA, GDA, and our method.
4.4 ABLATION STUDY
We perform ablation studies on parameters À and k. and the number of auxiliary samples N. We use the 8-bit quantized ResNet on CIFAR-10 as the representative for analysis. We discuss the attack performance of TA-LBB under different values of while k: fixed 20, and under different values of & while À is fixed at 10. To analyze the effect of N, we configure N from 25 to 800 and keep other settings the same as those in Section 4.1 The results are presented in Fig. 2 We observe that our method achieves 100% ASR when À is less than 20. As expected, the PA-ACC increases while the ASR decreases along with the increase of X. The plot of parameter presents that can exactly limit the number of bit- fit-flips, while other attack methods do not involve such constraint. This advantage critical since allows the attacker to identify limited bits to perform an attack when the budget is fixed. As shown in the figure, the number of auxiliary samples less than 200 has marked positive impact on the PA-ACC. It's intuitive that more auxiliary samples can lead to a better PA-ACC. The observation also indicates that TA-LBF still works well without too many auxiliary samples.
4.5 VISUALIZATION OF DECISION BOUNDARY
To further compare FSA and GDA with our method, we visualize the decision boundaries of the original and the post attack models Fig. 3 We adopt a four-layer Multi-Layer Perceptron trained with the simulated 2-D) Blob dataset from classes. The original decision boundary indicates that the original model classifies all data points almost perfectly. The attacked sample is classified into Class 3 by all methods. Visually, GDA modifies the decision boundary drastically, especially for Class However, our method modifies the decision boundary mainly around the attacked sample. Althoug FSA is comparable to ours visually in Fig. it flips 10x bits than GDA and TA-LBF. In terms of the numerical results, TA-LBF achieves the best PA-ACC and the fewest Neip- This finding verifies that method can achieve successful attack even only tweaking the original elassifier.
CONCLUSION
In this work, we have presented novel attack paradigm that the weights of deployed DNN can be slightly changed via bit flipping in the memory, to give a target prediction for a specific sample, while the predictions binary bits in the memory, we formulate this attack as a binary integer programming (BIP) problem, which can be effectively and efficiently solved by continuous algorithm. Since the critical bits determined through optimization, the proposed method can achieve the attack goals by flipping a few bits, and shows very good performance under different experimental settings.
other samples not significantly influenced. Since the weights are stored as
ACKNOWLEDDGENNT
This work is supported in part by the National Key Research and Development Program of China under Grant 2018YFB 800204, the National Natural Science Foundation of China under Grant 61771273, the R&D Program of Shenzhen under Grant supported by the Natural Science Foundation of China under grant No. 62076213, and the university development fund of the Chinese University of Hong Kong, Shenzhen under grant No. 01001810.
Baoyuan Wu is

---

Published as a conference paper at ICLR 2021
REFERENCES
Michel Agoyan, Jean-Max Dutertre, Amir-Pasha Mirbaha, David Naccache, Anne-Lise Ribotta, and Assia Tria. How to flip a bit? In JOLT', pp. 235-239, 2010.
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks deep learning in computer vision: A survey. IEEE Access, 6:14400-14430, 2018.
Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang. Targeted attack for deep hashing based retrieval. In ECCV, 2020.
Adel Bibi, Baoyuan Wu, and Bernard Ghanem. Constrained k-means with general pairwise and cardinality constraints. arXiv preprint arXivv1907.10410, 2019.
Stephen Boyd, Neal Parikh, and Eric Chu. Distributed optimization and statistical learning via the alternating direction method of multipliers. Now Publishers Inc, 2011.
Jakub Breier, Xiaolu Hou, Dirmanto Jap. Lei Ma, Shivam Bhasin, and Yang Liu. Practical fault attack on deep neural networks. In CCS, pp. 2204-2206, 2018.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C. Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In NeurlPS, 2019.
Weilun Chen, Zhaoxiang Zhang, Xiaolin Hu, and Baoyuan Wu. Boosting decision-based black- box adversarial attacks with random sign flip. In Proceedings of the European Conference on Computer Vision, 2020.
Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision-based black-box adversarial attacks on face recognition. In CVPR, pp. 7714-7722, 2019.
Min Du, Ruoxi Jia, and Dawn Song. Robust anomaly detection and backdoor attack detection via differential privacy. ICLR, 2020.
Jonathan Eckstein and Dimitri P Bertsekas. On the douglas-rachford proximal point algorithm for maximal monotone operators. Mathematical Programming, 55(1- 3):293-318, 1992.
rachford splitting method and the
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-worid attacks on deep learning visual classification. In CVPR, pp. 1625-1634, 2018
Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang, Mingyang Li, Zhifeng Li, and Yujiu Yang- Sparse adversarial attack via perturbation factorization. In European Conference on Computer Vision, 2020.
Yan Feng, Bin Chen, Tao Dai, and Shutao Xia. Adversarial attack on deep product quantization network for image retrieval. In AAAI, 2020.
Daniel Gabay and Bertrand Mercier. A dual algorithm for the solution of nonlinear variational problems via finite element approximation. Computers & mathematics with applications, 2(1): 17-40, 1976.
Roland Glowinski and A Marroco. Sur l'approximation, par éléments finis d' d'ordre un, et la résolution, par vénalisation-dually dualité d' d'une classe de problèmes de dirichlet non linéaires. ESAIM: Mathematical Modelling and Numerical Andlysis-Moddlisatioo Mathématique el Anal- yse Numérique, 912))41176, 1975.
Gi Gol'shtein and NV Tret' yakov. Modified lagrangians in convex programming and their gener- alizations. In toint-to-Set Maps and Mathematical Programming, pp. 86-97. Springer, 1979.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
10

---

Published as a conference paper at ICLR 2021
Daniel Gruss, Moritz Lipp, Michael Schwarz, Daniel Genkin, Jonas Juffinger, Sioli O'Connell, Wolfgang Schoechl, and Yuval Yarom. Another flip in the wall of rowhammer defenses. In IEEE S&P, pp. 245-26122 2018.
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, pp. 770-778, 2016.
Zhezhi He, Adnan Siraj Rakin, Jingtao Li, Chaitali Chakrabarti, and Deliang Fan. Defending and harnessing the bit-flip based adversarial weight attack. In CVPR, pp. 10095-14103, 2020.
Sanghyun Hong, Pietro Frigo, Yigitcan Kaya, Cristiano Giuffrida, and Tudor Dumitras. Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In USENIX Security Symposium, pp. 497-514, 2019.
Benoit Jacob, Skirmantas Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew Howard, Hartwig Adam, and Dmitry Kalenichenko. Quantization and training of neural networks for efficient integer-arithmetic-onll inference. In CVPR, pp. 2704-2713, 2018.
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of dram disturbance errors. ACM SIGARCH Computer Architecture News, 42(3):361 2014.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009.
Tuanhui Li, Baoyuan Wu, Yujiu Yang. Yanbo Fan, Yong Zhang, and Wei Liu, Compressing convo- lutional neural networks via factorized convolutional filters. In CVPR, 2019.
Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. arXiv preprint arXiv:2007.08744 2020.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdoor- ing attacks on deep neural networks. In RAID, pp. 273-294, 2018a.
Yannan Liu, Lingxiao Wei, Bo Luo, and Qiang Xu. Fault injection attack on deep neural network. In ICCAD, pp. 131-138, 2017a.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In NDSS, 2018b.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. ECCV, 2020a.
Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD, pp. 45 48, 2017b.
Yuntao Liu, Ankit Mondal, Abhishek Chakraborty, Michael Zuzak, Nina Jacobsen, Daniel Xing, and Ankur Srivastava. A survey on neural trojans. In ISQED, 2020b.
Szymon Migacz. 8-bit inference with tensortt. In GPU technology conference, 2017.
Seyed-Mohsen Moosavi-Dezfooli Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal
adversarial perturbations. In CVPR, pp. 1773-1773, 2017.
Jonathan Pan. Blackbox trojanising of deep learning models: Using non-intrusive network structure and binary alterations. arXiv preprint arXiv:2008.0044 00408, 2020.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. In ICCV, pp. 1211-1220, 2019.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. In CVPR, pp. 13198-132000 2020a.
11

---

Published as a conference paper at ICLR 2021
Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. T-bfa: Targeted bit-flip adversarial weight attack. arXiv preprint vrXiv:2007.12336, 2020b.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):21122 2015.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor at- tacks. In AAAI, pp. 1197-119655, 2020.
Bodo Selmke, Stefan Brummer, Johann Heyszl, and Georg Sigl. Precise laser fault injections into 90 nm and 45 nm sram-cells. In CARDIS, pp. 193-205. Springer, 2015.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Brandon Tran, Jerry Li, and Alcksander Madry. Spectral signatures in backdoor attacks. In NeurlPS, pp. 8000-8010, 2018.
Victor Van Der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clémentine Maurice, Giovanni Vigna, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida. Drammer: Deterministic rowhammer attacks on mobile platforms. In CCS, pp. 1675-1689, 2016.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks neural networks. In IEEE S&P. pp. 707-723. 2019.
Baoyuan Wu and Bernard Ghanem. Ly box admm: A versatile framework for integer programming. IEEE transactions on pattern analysis and machine intelligence, 41(7): 170, 2018
Baoyuan Wu, Li Shen, Tong Zhang, and Bernard Ghanem. Map inference via 12-sphere linear program reformulation. International Journal of Computer Vision, pp. 1-24, 2020a.
Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, and Xingjun Ma. Skip connections matter: On the transferability of adversarial examples generated with resnets. In ICLR, 2020b.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gener-
alization. In NewrIPS, 2020c.
Chulin Xie, Keli Huang, Pin- Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against feder- ated learning. ICI.R, 2019.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. ICLR, 2018.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. NDSS, 2017.
Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen, and Wei Liu. Exact adversarial attack to image captioning via structured output learning with latent variables. In CVPR, 2019.
Fan Yao, Adnan Siraj Rakin, and Deliang Fan. Deephammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips. In USENIX Security Symposium, pp. 1463- 1480, 2020.
Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In-So Kweon. Cd-uap: Class discriminative universal adversarial perturbation. In AAAI, 2020a.
Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In So Kweon. Understanding adversarial exam- ples from the mutual influence of images and perturbations. In CVPR, 2020b.
Pu Zhao, Siyue Wang, Cheng Gongye. Yanzhi Wang, Yunsi Fei, and Xue Lin. Fault sneaking attack: A stealthy framework for misleading deep neural networks. In ACM DAC, pp. 1-6. IEFF, 2019.
12

---

Published as a conference paper at ICLR 2021
A UPDATE b BY GRADIENT DESCENT
In this section, derive the gradient of L w.E.. b, which is adopted to update b by gradient descent (see Eq. (10)). The derivation consists of the following parts.
Derivation of iL1 (6) For clarity, here we firstly repeat some definitions,
Li (B., B,) max (m p( O B.) + 6,00) + max (x(æ; O B. m + 0,0),
(12)
plæ; O B.) [B((B.)): (B:): Ji..; (BB,,))] g( O),
(13)
Q-1
k(v) 20-22-1 10 +
Σ
2 11: A
(14)
1=1
Then, obtain that
0p(æ; O B:)
(1( T :.... (2; θ) Vl(B..)) ")
|9n (2; θ)
(15)
0B,
0B,,
VB.Cc
[2 2 ..... 2 A is constant, and here indicates the last layer; 9j (x; - denotes the j-th entry of the vector g( θ) Utilizing (15) we have
where Vh(u)
ac (B,, B,)
O. if p(æ; O,B.) m aB
OB.
0, otherwise
(16)
0L, (B., B.)
Op
p(:; O, < m
BB
OB,
0, otherwise
Thus, we obtain that
aL,
aL1 (B,,
Reshape 0L, B,)
Reehhape
)}
(17)
ab
OB
ÄB,
where Reshape(-) elongates matrix to vector along the column.
Derivation of OC2 (b)/b.... For clarity, here we firstly repeat the following definition
L2 (B,
Σ O, O ( B., B.). 2=1
(18)
where fy(x; θ (I.....KMs.. B,) Softmax(p(æ;; O B,),) or Softmax(p(æ;; O,B,) in-
dicates the posterior probability of æ, w.r.t. class j. and we simply denote fxx;) E [0, 1] as the posterior probability vector of σ;, {(x, 91) denotes the auxiliary sample set. E(.,)) is specified as the cross entropy loss. Then, we have
aL2 (B, B.)
(I(v 5) ff O. K)(s,) B,)) 0p(x,; O, B.
Σ
(19)
OB,
ÖB,
B.)) where I(a) of is true, otherwise T(a)= 0. Thus, obtain
aC [B, B.)
Σ
N
(I(N =t) f((xx; θ, B
0p(a,; O B,)
(20)
aB,
ØB,
i=1
@C2(6) ab
Reshape 0C, (B., (C, B.), Reshape OC2 (B.,
(B,, B.)
(21)
aB.
AB,
Derivation of @L(6))
According to Eq.
8) and utilizing Eqs.
17 and
21 we obtain
OL(b) (b)
(C)
1 +2 ( (000--2))tt +2 b). a2a p bl2 --kktu kt
ab
ab
ab
(22)
13

---

Published as a conference paper at ICLR 2021
B ALGORITHM OUTLINE
Algorithm Continuous optimization for the BIP problem (5).
The original quantized DNN model f with weights θ B, attacked sample with ground- truth label s, target class t, auxiliary sample set {( y: J=
Input:
X, k, and
Output: b.
1: Initial uh. un. ug. 2f. =2.
2z.
6" and +- O:
2: while not converged do
3: Update un 4++
u2 11 and ug as Eq.
4: Update br+1 as Eq. 10)
5: Update 21+1, 222
and 2/
as Eq.
6:
<- r --r++
7:
end while
C COMPLEXITY ANALYSIS
Table 3: Running time (seconds) of attacking one image for different methods. The mean and standard deviation are calculated by 10 attacks.
FT
TBT
T-BFA
FSA
GDA
TA-LBF
CIFAR-10
1..54
389. 189.722
35.05
2.71 =0.48
0.67
113.38
ImageNet 124.32#3.61
11425.81
19.16#3.52
65.28
61.97
222.95+9.39
The computational complexity of the proposed algorithm (i.e., Algorithm I consists of two parts, the forward and backward pass. In terms of the forward pass, since O (I....K]([[s.)) are fixed during the optimization, their involved terms, including g( O) and p(z; B, are cal- culated only one time. The main cost from B, and B, is O(2(N + 1)C* per iteration, as there N + samples. In terms of the backward pass, the main cost is from the update of br+1, which (22(N + 1)CQ) per iteration in the gradient descent. Since all other up- dates are very simple, their costs are omitted here. Thus, the overall computational cost is (Touterr (2 + 1JCQ (C Tineer))), with Touter being the iteration of the overall algorithm and Timner indicating the number of gradient steps in updating br+1, As shown in Section D the proposed method TA-LBF always converges very fast in our experiments, thus Touter is not very large. As demonstrated in Section E.3 Timner is set to 5 in experiments. In short, the proposed method can be optimized very efficiently.
Besides, also compare the computational complexity of different attacks empirically. Specifi- cally, we compare the running time of attacking one image of different methods against the 8-bit quantized ResNet CIFAR-10 and ImageNet dataset. As shown in Table 3l TBT is the most time- consuming method among all attacks. Although the proposed TA-LBF is not superior to T-BFA, FSA, and GDA in running time, this gap can be tolerated when attacking single image in the deployment stage. Besides, our method performs better in terms of PA-ACC, ASR, and Nuip as demonstrated in our experiments.
D NUMERICAL CONVERGENCE ANALYSIS
We present the numerical convergence of TA-LBF in Fig. Note that || u u113 and || u2 l characterize the degree of satisfaction of the box and fa-sphere constraint, respectively. For the two examples of CIFAR-10 10 and ImageNet, the values of both indicators first increase, then drop, and finally close to O. Another interesting observation is that L, + XL2 first decreases evidently and then increases slightly. Such findings illustrate the optimization process of TA-LBE. the early iterations, modifying the model parameters tends to achieve the two goals mentioned in Section 3.1 in the late iterations, b is encouraged to satisfy the box and 12-sphere constraint. We also observe that both examples stop when meeting ||b
un 11 < 10-1 and |b u2 1 < 10-1 and do not
14

---

Published as a conference paper at ICLR 2021
CIFAR-10 10
ImageNet
50
0.5
0.010
11 2
12472.5
16 wyll
12470.0
0.008
C1 + A.
12467.5
0.4
40
0.006
12465.0
0.3
12462.5
0.1
0.002
12457.5
30
0.0
12455.0
250
500
750
1000
1250
500
1000
1500
iterations
# iterations
Figure 4: Numerical convergence analysis of TA-LBF w.r.t the attacked sample on CIFAR-10 and ImageNet, respectively. We present the values of |b un 11 ||b uulli and L1 + XL2 different iterations attacking 8-bit quantized ResNet. Note that in the left figure 100 and in the right figure is 10a
exceed the maximum number of iterations (i.e., 2000). The numerical results demonstrate the fast convergence of our method practice.
E
EVALUATION SETUP
E.
BASBLINE METHODS
Since GDA (Liu al. 2017a) and FSA (Zhao al. 2019) are originally designed for attacking the frel-precision network, we adapt these two methods to attack the quantized network by applying quantization-awan aware training (Jacob et al. 2018). We adopt the fo-norm for FSA (Liu et al. (017a)) and modification compression for GDA Zhao al.) 2019) to reduce the number of the modified parameters. Among three types of T-BFA (Rakin et al. (220b)), we compare to the most comparable method: the 1-to-1 stealthy attack scheme. The purpose of this attack scheme is misclassify samples of a single source class into the target class while maintaining the prediction accuracy of basic
other samples. Besides, take the fine-tuning (FT) of the last fully-connected layer attack and present its results. We perform attack once for each selected image except TBT (Rakin) al., (020a) and totally 1,000 attacks attacked DNN model misclassifies all inputs with trigger to certain target class. Due to such objective, the number of attacks for TBT is equal the number target classes (i.e., 10 attacks on CIFAR- 10 and 50 attacks on ImageNet).
each dataset. The attack objective TBT is that the
E.2 TARGET MODELS
According to the setting in (Rakin al., 2020a b), we adopt two popular network architectures: ResNet (He et al. 2016) and VGG (Simonyan & Zisserman 2015) for evaluation. On CIFAR-I0. use the pre-trained ResNet-
perform experiments on ResNet-20 and VGG-16. On ImageNet, 18 and VGG- network. neewokr We quantize all networks to the 4-bit and 8-bit quantization level using the layer-wise uniform weight quantization scheme, which is similar to the one involved in the Tensor-RT solution (Migacz 2017).
E.3 PARAMETER SETTINGS OF TA-LBF
For each attack, we adopt a strategy for jointly searching À and k. Specifically, for an initially given k. we search from a relatively large initial value and divide it by 2 the attack does succeed. The maximum search times of À for a fixed k is set to 8. If it exceeds the maximum search times,
Scccceo Downloaded from http:///tt.t.t///....//////////a
"Downloaded from D.tnacacc..iitteeo/oooooo/oo///e
15

---

Published as a conference paper at ICLR 2021
Table 4: Results of all attack methods against models trained with piece-wise clustering CIFAR- 10 (bold: the best; underline: the second best). We adopt different clustering coefficients, including 0.0005, 0.005, and 0.01. The mean and standard deviation of PA-ACC and Nuipp are calculated by attacking the 1,000 images. Our method is denoted as TA-LBE. ANaip denotes the increased Naip
compared to the corresponding result in Table
Clustering Coefficient
ACC
PA-ACC
ASR
Method
NdiP
ANsip
(%)
(%)
(%)
FT
84.2843.49
100.0
1868. 72.42488
360.75
TBT
87.97
66.1
250.30=10977
3.60
T-BFA
86.20+1196
98.5
30.95=6.50
21.04
0.0005
91.42
FSA
87.17 12.44
98.5
222.70.166.5
37.19
GDA
85.28.14.16
100.0
41.33
14.50
TA-LBF
87.92+2.54
100.0
13.47=5.34
7.90
FT TBT
81.08:1:..1
97.9
1774.69
267.18
82.96+2.118
12.7
246.80=1600
0.10
T-BFA
80.80+2.64
98.1
61.72+12.17
51.81
0.005
88.03
FSA
83.10
98.4
231.66--89.21
46.15
GDA
79.23+6625
99.9
64.87+22.78
38.04
TA-LBF
83.63
100.0
25.52+11.59
19.95
FT
78.73+3.54
98.3
241.03
TBT
79.86+2.04
10.1
236,50=1099
-10.20
T-BFA
76.67:13441
98.1
55.49
45.58
0.01
85.65
FSA
80,45+:314
98.0
220.28:110.01
34.77
GDA
75.3347.85
99.7
59.17
32.34
TA-LBF
80.51
100.0
24.60
19.03
double & and search À from the relatively large initial value. The maximum search times of k set 4. On CIFAR-10, the initial and are set to 5 and 100. On ImageNet, initialized as 10t; k is initialized as 5 and 50 for ResNet and VGG, respectively. On CIFAR-10, the in Li is set to 10. On ImageNet, the set to and increased to if the attack fails. U₁ and u2 are initialized as and Ug is initialized as O. 2 and 22 are initialized as and 23 is initialized as is initialized as b. During each iteration, the number of gradient steps for updating b 5 and the step size is set to 0.01 on both datasets. Hyper- pareeeerrseeerrs (p1. P2. P3) (see Eq. (II) are initialized as (10-1, 10-1, 10-9) on both datasets, and increase by 0s + Ps x 1.01, = 1, 2, 3 after each iteration. The maximum values of (P1, P2. Ps)
(50, 50, 5) on both datasets. Besides the maximum
number of iterations (i.e., 2000), we also another stopping criterion, i.e., ||6 ui 10-4 and ||b u2113 & 10-4
MORE RESULTS ON RESISTANCE TO DEFENSE METHODS
F.1 RESISTANCE TO PIECE-WISE CLUSTERING
We conduct experiments using the 8-bit quantized ResNet on CIFAR-10 with different clustering coefficients, We the maximum search times of & to 5 for clustering coefficient 0.005 and 0.01 and keep the rest settings the same as those in Section 4. The results are presented in Table 4 As shown in the table, all values of Naip are larger than attacking models without defense for methods, which is similar to 22 Our method achieves a 100% ASR with the fewest Naip under the three clustering coefficients. Although TBT obtains a smaller A than our method, it fails to achieve satisfactory ASR. For example, TBT achieves only 10.1% ASR when the clustering coefficient is set to 0.01. We observe that for all clustering coefficients, piece-wise wise clustering reduces the original accuracy. Such phenomenon more significant the clustering coefficient increases. The results also show that there no guarantee that if the clustering coefficient is larger (e.g., 0.01), the model is more robust, which is consistent with the finding in (He al. 2020
16

---

Published as a conference paper at ICLR 2021
Table 5: Results of all attack methods against models with larger capacity CIFAR-10. We adopt 3x and 4x width networks. The mean and standard deviation of PA-ACC and Nulp are calculated by attacking the 1,000 images. AN denotes the increased Naip compared to the corresponding
result in Table Model Width
ACC (%)
PA-ACC
ASR
Method
NapP
ANdip
(%)
(%)
FT
86.96=22.9
100.0
4002.52+281.22
2495.01
TBT T-BFA
90.671.5.23
74.1
504.70.22.44
258.00
92.18:114
98.9
30.50
20.59
3x
94.90
FSA
91.40++2.38
99.0
342.20
156.69
GDA
90.79+2.91
100.0
67.53
40.70
TA-LBF
91.42+2..1
100.0
12.29
6.72
FT
86.94.12.78
100.0
4527.6
61.76.88..9. 3699.3
3020.17
TBT
85.391.5.08
90.1
625.50
378.80
T-BFA
92.49
99.4
19.1 14.0000
9.23
4x
95.02
FSA
91. 91.60+242
98.7
$38.93+1000
153,42
GDA
90.76
100.0
66. 36.92.140.8
40.09
TA-LBF
90.94
100.0
8.37 12800
2.80
F.2 RESISTANCE TO LARGER MODEL CAPACITY
we also evaluate all methods against models with a x and 4x width. All settings are the same as those used in Section 4.1 The results provided in Table 5 Among all attack methods, our method is least affected by increasing the network width. Especially for the network with 4x width, our ANaip is only 2.80. The results demonstrate the superiority of the formulated BIP problem and optimization. Moreover, compared with piece-wise clustering, having a larger model capacity can improve the original accuracy, but increases the model size and the computation complexity.
Besides the results of networks with 2x width shown in Section 4.3
G DISCUSSIONS
G.1 COMPARING BACKDOOR, ADVERSARIAL, AND WEIGHT ATTACK
An attacker can achieve malicious purposes utilizing backdoor, adversarial, and weight attacks. In this section, we emphasize the differences among them.
Backdoor attack happens in the training stage and requires that the attacker can tamper the training data even training process (Liu et al. 2020b Li et al., 2020). Through poisoning some training samples with trigger, the attacker stage. For example, images with reflections are misclassified into a target class, while benign images classified normally (Liu al., 2020a). However, such attack paradigm causes the accuracy degradation on benign samples, which makes it detectable for users. Besides, these methods also require to modify samples in the inference stage, which is sometimes impossible for the attacker. Many defense methods against backdoor attack have been proposed, such as the preprocessing- based defense (Liu al. 2017b), the model reconstruction-bassee defense (Liu et 2018a). and the trigger synthesis- based defense (Wang et al. 2019).
control the behavior of the attacked DNN in the inference
Adversarial attack modifies samples in the inference stage by adding small perturbations that re- main imperceptible to the human vision system (Akhtar & Mian 2018). Since adversarial attack only modifies inputs while keeping the model unchanged, has no effect on the benign samples. Besides the basic white-box attack, the black-box attack (Wu et al. 2020b) Chen et al.) 2020) and universal attack (Zhang et al., 2020b a) have attracted wide attention. Inspired by its success in the classification, it also has been extended to other tasks, including image captioning (Xu et al. 2019). retrieval (Bai et al.) 2020 Feng et al. 2020), etc.. Similarly, recent studies have demonstrated many defense methods against adversarial attack, including the preprocessing based defense (Xie al. 2018). the detection-bass based defense (Xu et al.) 2017). and the adversarial Barming-based defense (Carmon et al. 2019 Wu et al. 2020c).
17

---

Published as a conference paper at ICLR 2021
Weight attack modifies model parameters in the deployment stage, which is the studied paradigm in this work. Weight attack generally aims at misleading the DNN model on the selected sample(s), while having minor effect other samples (Zhao et al., 2019 Rakin al. 2020b). Many studies Yao et al. 2020 Breier et al. 2018 Pan 2020) have demonstrated that the DNN parameters can be modified in the bit-level in memory using fault injection techniques (Agoyan al., 2010) Kim itt al., 2014; Selmke et al. 2015) in practice. Note that the defense methods against weight attack have been not well studied. Although some defense methods (He et al. 2020) were proposed, they cannot achieve satisfactory performance. For example, our method can still achieve a 100% attack success rate against two proposed defense methods. Our work would encourage further investigation on the security of the model parameters from both attack and defense sides.
G.2 COMPARING TA-LBE WITH OTHER WEIGHT ATTACKS
We compare TA-LBF with other weight attack methods, including TBT (Rakin et al. (020a), T- BFA (Rakin et al. 2020b), GDA (Liu et al. 2017a), and FSA (Zhao et al. 2019) in this section. TBT tampers both the test sample and the model parameters. Specifically, it first locates critical bits and generates a trigger, and then flips these bits to classify all inputs embedded with the trigger to a target class. However, the malicious samples are easily detected by human inspection or many detection methods Tran et al. 2018 Du et al. 2020). We do not modify the samples to perform TA-LBF, which makes the attack more stealthy. Rakin al. (2020b) proposed T-BFA which misclassifies all samples (N-to-1 version) or samples from a source class (I-to-1 version) into a target class. Our method aims at misclassifying a specific sample, which meets the attacker's requirement in some scenarios. For example, the attacker wants to manipulate the behavior of face recognition engine on a specific input. Since it affects multiple samples, T-BFA maybe not stealthy enough in attacking real-world applications. GDA (Liu et al. 2017a) and FSA (Zhao al. 2019) modify model parameters at the weight-level rather than bit-level. They are designed for misclassifying multiple samples from arbitrary classes, which makes it infeasible for them only modify the parameters connected to the source and target class. They modify more parameters than our method as shown in the experiments. it might be due the reason discussed above. Besides, TBT, T-BFA, and GDA determine the critical weights to modify using heuristic strategies, while our TA-LBF adopts optimization-bart based methods. Although FSA applies ADMM for solving the optimization problem, it has no explicit constraint to control the number of modified parameters, which makes it intends to modify more parameters than GDA and our TA-LBE.
H TRADE-OFF BETWEEN THREE EVALUATION METRICS
CIFAR-10
ImageNet
CIFAR-10
ImageNet
69:400
89
PAACC
69:375
PAAACC
PA-ACC
09.3
69.350
67-
09.325
80-
60.1
86
10
20
30
40
10
35
80
1.0
80
60
100
Nata
Nap
ASR (9))
ASR (%)
Figure 5: Curves of the trade-off between PA-ACC and Naa and the trade-off between PA-ACC and ASR for the proposed TA-LBF on two datasets.
In this section, we investigate the trade-off between three adopted evaluation metrics (i.e., PA-ACC, ASR, and Naip) for our attack. All experiments are conducted on CIFAR-10 and ImageNet dataset in attacking the 8-bit quantized ResNet.
We firstly discuss the trade-off between PA-ACC and NdiP by fixing the ASR as 100% using the search strategy in Appendix [E3 and adjusting the initial X and k to obtain different attack results. The two curves on the left show that increasing the Nuip can improve the PA-ACC when Naip is relatively small; the PA-ACC decreases with the increase of Nпp when Nuip is greater than threshold. This phenomenon demonstrates that constraining the number of bit-flips is essential to ensure the attack stealthiness, mentioned in Section 3.2 To study the trade-off between PA-ACC
18

---

Published as a conference paper at ICLR 2021
and ASR, fix the parameter k as 10 for approximately 10 bit-flips and adjust the parameter À to obtain different PA-ACC and ASR results. The trade-off curves between PA-ACC and ASR show that increasing ASR can decrease the PA-ACC significantly. Therefore, how to achieve high ASR and PA-ACC simultaneously is still an important open problem.
19


Reviews:
[{"review_id": "wIrPpEa32DA", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes an optimization-based algorithm for bit-flipping a limited number\nof bits in a quantized / binarized deep-learning model, so that the prediction on a\ntarget input example is flipped while the prediction on the other examples is as\nuntouched as possible. The problem is formulated as a binary integer programming (BIP)\nproblem, which is then solved using a recent ADMM-based technique. Experiments CIFAR-10\nand ImageNet show that the proposed method outperforms the SOTA.\n\n**Weak points:**\n- The main shortcoming of this paper is the limitedness of the technical contributions.\n\n- The hyper-parameter tuning is not clearly outlined / explained. This is problematic\n  since there are quite a number of hyper-parameters. For example, I can count 4\n  hyper-parameters in equation (9) alone (including ADMM stepsizes rho_i).\n\n- It would be nice to have a back-of-envelop estimation of the complexity (running time,\n  number of flops, etc.) of the proposed method, as a function of the maximum number of\n  bits to flip (say).\n\n**Small issues:**\n- S. Boyd and co-workers have done a great job in popularizing ADMM. However, this method\n  has been around at least since the 70s. Key papers to reference when talking about ADMM\n  include:\n  * Glowinski and Marroco (1975) \"Sur l'approximation, par éléments finis d'ordre un, et\n    la résolution par pénalisation-dualité d'une classe de problèmes de Dirichlet non\n    linéaires dualite d'une classe de problemes de Dirichlet non linéaires\"\n  * Gabay and Mercier (1976) \"A dual algorithm for the solution of nonlinear variational\n    problems via finite element approximation\"\n\n**Strong points:**\n- The strongest point in favor of this paper is that unlike the SOTA methods, the proposed\n  method only flips to a very limited number of bits in the binarized DNN model, while\n  achieving the same or higher accuracy.\n- The experiments are very detailed and well-presented.\n\n**Errors:**\n\n- The equivalence in (6) doesn't seem to make sense. In the definition of $S_p$, $\\hat{b}$ is an element of what ?\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "MmHRoSJzQNK", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes an ADMM based optimization method to conduct adversarial weight attack, and achieves superior or at least comparable performance compared with previous heuristic methods.\n\nPros:\n1. Adversarial weight attack is an interesting research direction with important practical importance and deserve more studies. \n2. The proposed method is mathematically sound. And it empirically outperforms or at least is comparable with previous state-of-the-art methods on undefended models, and consistently outperforms previous methods on defended models.\n\nCons:\nI think this paper as an necessary step towards stronger adversarial weight attacks, which could be used as an evaluation method to benchmark future defense methods.  \n\nSome comments:\n1. Table 1 and 2 may not be the best way to present the results. Considering there are three evaluation dimensions (PA-ACC, ASR and Nflip), I suggest the authors to add some pareto frontier figures. For example, fixing PA-ACC, plot the tradeoff curves between ASR and Nflip of different methods.\n2. What are the time costs of different attacking methods?", "extra_scores": {}, "extra_text": {}}, {"review_id": "0MrD1z4id3", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper describes a bit-flipping white-box attack on deployed neural network classifiers: given a model with quantized parameters, find a perturbation of the parameters bits such that the model with misclassify one specific example, while maintaining high accuracy on other examples.\n\nThe attack is formulated as a binary programmig problem where the parameter bits are the optimization variables and the objective function is an additive tradeoff between an effectiveness term (misclassification loss on the selected example) and a stealthness loss (classification loss on a batch of training examples), a constraint on the number of bit flips is also included. The optimization problem is solved by continuous relaxation using the Lp-box ADMM solver.\n\nThe paper reports experiments on various standard classifiers trained on CIFAR-10 or ImageNet, with different level of quantization. The proposed attack is compared to other weight attacks in the literature, and it achieves comparable or better attack success rate (a measure of effectiveness) and post-attack accuracy (a measure of stealthness).\nThere are also experiments on different values of hyperparameters and on more robust models (obtained either by a defense technique or by making the model bigger).\n\nOverall I find this a valid contribution.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "-QEZB02xvjw", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes a bit-flip attack where model parameters weights are altered such that a certain sample is misclassified to a target class.  While the utilized optimization strategy and the combination of techniques seems interesting, a major concern is the motivation behind the proposed method and why it stands out against prior works. \n- Comparisons in the experiment section show that prior methods are performing on par with the proposed method in terms of the attack success rate and benign accuracy. The major difference seems to be the number of flipped bits. However, the paper in its current form does not state \"why\" the number of flipped bits seems to matter. \n- The method is also performing on par with prior works in terms of the resiliency against defense mechanisms. Therefore, it is not really clear why this work is preferred over prior methods, i.e., does reducing the number of flipped bits matter in the attack?\n- In addition to motivating the number of flipped bits, the authors need to also clarify why the current \"single image\" attack is preferred over other works where all images from a certain class are mapped to the attack target class. It seems like the proposed approach is in fact a special case of the latter scenario which is studied in prior works.\n- The evaluated defense strategies are all passive, i.e., they are performed before the attack and therefore are not aware of the attack strategy. For a comprehensive examination, the authors should also compare with the defense in [1] which applied the defense at the inference phase, assuming a bit-flip attack may have occurred on the model parameters.\n\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The major concerns about this paper are that (1) There are too many hyper-parameters, such as those needed for ADMM. I'd point out that there are adaptive variants of ADMM and heuristics methods for choosing optimization hyper-parameters, although it would be nice if the authors addressed these issues in the paper.  (2) Some reviewers are concerned that, compared to other related attacks, it’s unclear why flipping fewer bits is an important objective - an attacker might only care about poisoning performance and clean data performance.  The authors respond that flipping fewer bits makes the attack more effective when bits are manipulated by a physical method such as manipulating memory.  Despite these criticisms, reviewers agree that the paper is a well thought-out approach that improves the state of the art by some metrics.

Decision: Accept (Poster)