Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips
Authors: Ido Galil
Moshe Kimhi
Ran El-Yaniv
Venue: Accepted by TMLR ()

Abstract: Deep Neural Networks (DNNs) can be catastrophically disrupted by flipping only a handful of sign bits in their parameters. We introduce Deep Neural Lesion (DNL), a data-free, lightweight method that locates these critical parameters and triggers massive accuracy drops. We validate its efficacy on a wide variety of computer vision models and datasets. The method requires no training data or optimization and can be carried out via common exploits software, firmware or hardware based attack vectors.  An enhanced variant that uses a single forward and backward pass further amplifies the damage beyond DNL's zero-pass approach. Flipping just two sign bits in ResNet50 on ImageNet reduces accuracy by 99.8%. We also show that selectively protecting a small fraction of vulnerable sign bits provides a practical defense against such attacks.

Published in Transactions on Machine Learning Research (03/2026)
Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips
Ido Galil
idogalil. ig@ggmal.com com, igalil@nmidio.comm com
NVIDIA
Moshe Kimhi
moshekimhi9I 10nn0ll.mmmmmmmmmm moshiekimlai@lssseehhninn Technion
Ran Elnia wani@cs.technion.co aciil, velyanio@reedio.ccm Technion, NVIDIA
Reviewed on OpenReview: https: /ttps://openreuue// opw.r/veeeeeeeee...emme forum? kN1s53X3*1
Abstract
Deep Neural Networks (DNNs) can be catastrophically disrupted by flipping only a handful of parameter bils. We introduce Deep Neural Lesion (DNL), a data-free and optimization- free method that locates critical parameters, and an enhanced single- variant, 1P-DNL, that refines this selection with one forward and backward pass on random inputs. We show that this vulnerability spans multiple domains, including image classification, object detec- tion, instance segmentation, and reasoning large language models. In image classification, flipping just two sign bits in ResNet-50 ImageNet reduces accuracy by 99.8%. In object detection and instance segmentation, one or two sign flips in the backbone collapse COCO detection and mask AP for Mask R-CNN and YOLOvS-seg models. In language model- ing, two sign flips into different experts reduce Baan--30--33B-The accuracy. We also show that selectively protecting a small fraction of vulnerable sign bits provides a practical defense against such attacks.
from 78% to 0%
1 Introduction
Deep neural networks (DNNs) now underpin a wide range of systems, from vision models to reasoning large language models. Their deployment in safety-critical and economically important settings raises an immediate security question: how much access and computation does an attacker need order to induce severe failure? In this work we show that, once an attacker can write to stored parameters, the answer can be disturbingly small.
We expose a cross-domain vulnerability in DNNs that allows severe disruption by flipping only a few carefully chosen parameter bits. We systematically analyze and identify the parameters most susceptible to sign flips, which we term "critical parameters." " By flipping a tiny number of these critical sign bits, an altare can catastrophically damage deep neural network models across various domains, including classification, detection, and sogmentation systems, as well as large language models. Crucially, our approach is data- agnostic: requires only direct access to model weights, bypassing any need for training validation data. The same vulnerability even extends to Mixture-of-Fxpert (MoE) language models, in which each token is routed through only small subset of experts: for Qwen3-30BB 30B--33------- Thinkiin,, two sign flips into two different experts are sufficient to reduce accuracy from 78% to 0%.
"Equal contribution

---

Published in Transactions on Machine Learning Research (03/2026)
Input: Dalmatian dog
Edge detector
Larger
values
convolution kernel
Largest weight disruption
"Edge"
detector
Smaller
values
The MSB for weight was flipped
Figure 1: DNL applied to RegNet Y- -4000MF's Radosavovic et al. 2020a) first convolution layer. The original (Sobel-like) kernel, used for horizontal edge detection, is shown aboe the flipped version obtained by changing just one high-magn miggimage weight's 's sign bit. Even this minimal alteration leads to a drastically different output feature map. This corrupted feature propagates through the model, undermining downstream representations and severely impairing the nelwork's overall ability recognize the Dalmatian.
Our method is deliberately lightweight. The forward-pass-free version, DNL requires no additional com- putational passes and ranks candidate weights using a magnitude-based heuristic guided by inductive bias and the flow information through the network. We also propose an enhanced 1-pass attack, 1P-DNL, that uses a single forward and backward pass on random inputs to refine the selection of critical parameters. Both variants remain computationally inexpensive compared with prior weight-space attacks, yet still induce catastrophic failures across very different architectures and tasks.
Malicious actors can exploit the identified parameter vulnerability through multiple system layers, including file-system intrusions, firmware compromises, direct memory access (DMA) from compromised peripherals, or memory-level exploits. In cach case, once attackers gain access to the model's parameters, they can flip a small number of carefully selected bits and trigger severe model failures. This lightweight approach requires no iterative optimization, thereby reducing the attacker's overhead while also increasing stealth.
For example, consider the implications for autonomous driving systems. Traditional adversarial attacks Madry et al. (2018): Goodfellow al. (2015 Carlini & Wagner (2016) such systems would involve ma-
nipulating the input pixels in real-time, requiring continuous communication with the vehicle and performing intensive gradient caleulations to mislead the model. Physical adversarial attacks, such as placing adversarial stickers on street signs (e.g., as demonstrated in Wei et al. (2022)). ), demand direct access to the environment and are vulnerable to countermeasures like sensors on street signs or validation through additional traffic inputs. Other attacks targeting weights, such as Rakin al. (2019); Park ct al. (2021), rely cither on the model'ss real data numerous forward and backward passes through the victim's model. Such attacks impractical in real time because of their costly optimization process, and require the adversary to have full access to run the model as well as its data beforehand.
costly synthetic data generated from it, and demand an exhaustive search involving
With our proposed method, even with limited access, an attacker could exploit any the aforementioned hardware or software vulnerabilities and discrectly flip a small number of critical bits. By altering only handful of parameters, often just one or in the strongest cases, the attacker can critically degrade the model's perception, reasoning, and downstream decision-making, posing far more potent threat to
2

---

Published in Transactions on Machine Learning Research (03/2026)
the reliability of deployed systems. The minimal computational footprint and high impact of this attack make it exceptionally challenging to detect and mitigate in real-world deployments. Code is available at operates without any additional computational passes, and the "I-Pass" Attack, which uses a single forward and backward pass with random inpuls to refine the selection of critical parameters.
Our main contributions are summarized as follows:
We introduce the DNL attack, which exposes severe vulnerability DNNs by showing that heuristically flipping a small number of specific sign bits can catastrophically degrade model performance. This attack is entirely data-agnostic, requiring knowledge of training data, domain-specific data, or synthetic inputs. Our method includes two lightweight variants: the "Pass-free" Attack, which
The DNL Attack:
Characterization of Critical Parameters: We characterize the attributes that make certain parameters disproportionately vulnerable to bit flips, such as large magnitude and carly-layer placement, while show- ing that the vast majority of parameters remain robust to random perturbations. We further distinguish which heuristics are generic (e.g., early-layer targeting) and which are architecture-specife (e.g., one flip per convolutional kernel).
Extensive Evaluation Across Domains: We validate our approach on image classification, object detec- tion, instance segmentation, and reasoning large language models. In image classification alone, we evaluate classifiers across diverse tasks and datasets, including 48 ImageNet models from the publicly available timm Wightman (2019) and Torchvision Marcel & Rodriguez (2010) repositories. Across all three domains, flipping only very small number of targeted bits is sufficient to induce severe degradation.
Defense Evasion: We demonstrate that DNL circumvents various defenses, including binarization, redundancy-coding, and weight-scaling, underscoring the need for new protective strategies.
Defense Mcchanisms: We leverage the insight gained from identifying critical parameters to propose efficient defenses. By selectively protecting only these most vulnerable parameters, models can become substantially more resilient sign-flip attacks.
2
Problem Setup
Modern neural-network parameters may be stored in several numeric formats. For the floating-point formats relevant to this work (e.g., FP32, FP16, and bfloat16), each parameter has a dedicated sign bit, typically the most significant bit (MSB). Flipping this bit changes a weight from 0, to -6,, whereas flipping exponent bits changes its scale. For example, in TEFE. 754 FP32, value is represented as (-1)* 127-127) (1 225 and analogous decompositions hold for other floating-poin formats as well.
We focus on a standard supervised learning scenario where a model fa is trained on a dataset with distribution D.. Let X. y be the input and label spaces, (X, ~ D, where X E X and Y y. A trained model Sa seeks to minimize the expected risk ming E(X,y)D ((f)(X), where is a loss function.
Threat model. The attacker has write access to the stored parameters, but no access to any kind of data, nor passing anything through the model. Concretely: (i) the attacker has no samples from D and thus no access to P(X) P(Y); and (ii) the attacker cannot evaluate the model any input (no forward backward passes). Equivalently, for any input random variable Z on X' (including Z = X or any synthetic/ synthetic/random random data), the attacker has no access to f2) or to P(fo(2)) (for 1-Pass DNL we consider a slightly relaxed version where f=) could be observed for a single random input and allow a single forward pass and a single backward pass).
Despite this, the attacker can modify by flipping small number of bits in its stored representation. Let bits(O) {0, 1) B be the B memory bits encoding all entries of 0 (e.g., IEEF-754). A k-bit flip chooses k
3

---

Published in Transactions on Machine Learning Research (03/2026)
distinct bit indices , ji E {l,..., B) and produces parameters ((x)) with
[1-bits(0),, bits(O),, jf E fi........ juh.
bits( (its))/w))
(bits(0)s.
otherwise.
We refer to (R) as the result of a k-bit-flip attack on 0. To our knowledge, no prior method satisfies this restrictive threat model.
Mechanisms enabling parameter bit flips. The attacker can gain access to 0 directly through software, firmware, or hardware-level exploits, namely Bit flip attacks Oriyano (2014).
Below, we outline several exploits that adversaries can leverage to execute malicious bil-slippigg operations on model parameters.
A rootkit (Hoglund & Butler 2006 Sparks Butler 2005 Rutkowska 2007) is malicious software running
with high-level (kernel or ring-0) privileges, allowing it intercept or modify operations. Once installed, a rootkit can sean the system's 's memory or storage for the model's parameter files, then surgically flip bits in place. By concealing its processes and hooking system APIs, the rootkit can evade detection from common antivirus tools and monitoring systems, enabling stealthy, ongoing tampering with model parameters without triggering suspicious activity logs.
Firmware exploits (Hudson & Rudolph 2015 (e.g.. SSD/HDD controllers, GPU firmware, BIOS, or microcode patches) can give attackers privileged memory access or the ability to inject custom commands that flip bits in system memory or on storage media. By compromising firmware updates or exploiting known bugs, attackers can precisely manipulate parameter bits.
DMA from untrustworthy peripherals (Markettos et al., 2019) can read and write system memory without involving the CPU or the operating syslem's normal access controls. If attackers gain low-level access to DMA device (e.g., via Thunderbolt or FireWire interfaces), they can directly overwrite targeted bits in protected momory regions.
Rowhammer (Kim et al.) 2014b a. Seaborn & Dullien 2015 exploits the electrical interference between neighboring rows modern DRAM modules. By rapidly accessing ("hammering") one row, an attacker causes bits in adjacent rows flip, even without direct write permissions. Rowhammer attacks typically rely on high-frequency memory accesses that defeat standard refresh mechanisms; once carefully controlled, these flips can be directed at specific bit positions.
GPU cache tampering (Lipp et al. 2020: Tatar et al. 2018 which exploits a compromised kernel driver or malicious GPU code, can manipulate cache management routines to induce bit flips in stored parameters. Similar to Rowhammer's repeated DRAM accesses, contimuussy evicting and reloading specific cache lines may corrupt targeted parameters. Bocause GPU caches are often less scrutinized than CPU caches, this tampering can remain undetected, leading to stealthy yet severe degradation of model performance.
Vollage/frrquency glitching (Murdock et al. 2020: Tang et al. 2017: Van der Veen al. 2020 Frigo et al.
2018) manipulates the operating voltage or clock frequencies to induce computational errors. Certain voltage ranges can systematically cause specific bits to flip in registers or memory segments.
Adversarial objective. In all cases, the attacker's objective is to significantly degrade per- formance with minimal bit flips for stealth and practicality. We define the objective as: min; max E(X,y)= [(fr, (x), where both finding minimal and flipping & bits to produce (/s) are discrete optimization problems.
In other words, the attacker's goal is to induce significant performance drop while flipping only handful of bits, both for stealth and practical reasons, as fewer corruptions are less likely to be detected and can be exploited by the mentioned hardware atlacks. For instance, Rowhammer--ased exploits (Kim el al. 2014b) typically induce only sporadic bit upsets in adjacent cells, making massive coordinated flips infeasible. By stealth, we mean that the modifications the model weights (or inputs) are minimal-wor while the victim may observe a performance drop and even suspect an attack, the lack of an identifiable source makes it difficult to attribute the degradation or take effective countermeasures.
4

---

Published in Transactions on Machine Learning Research (03/2026)
02
No Etfect
20.0x
1.000
30:000
100,000 8i
Magetuck
Digor
DM
LPCN.
Magitats Digant camels
DML
LPORL
(a) AR of randomly flippigg sign bits model performance.
(b) Comparison of mAR1u across dif- ferent strategies.
(c) Comparison of AR(10) under dif- ferent strategies.
Figure 2: Evaluation of model degradation under different sign-flip strategies across 48 ImageNet models.
As mentioned above, the attacker does not have access to any training or validation data, nor do they conduct extensive inference passes or iterative gradient-based searches. Such lightweight attacks are realistic in settings where the attacker's computational resources on the victim device are minimal, or where repeated forward/ forward/backward /bacwward passes might raise suspicion. We therefore distinguish two scenarios: pass-free attack, which uses extra computation beyond reading and writing into the model weights (fitting restrictive threat model), and 1-pass allack, which uses only a single forward (and backward) pass single random input, aiming for improved efficacy at a slight relaxation of the threat model. Both settings stand in contrast to cxisting approaches that require data samples and multiple optimization stops (see Section for more details).
Although the attacker's objective can be framed as discrete optimization problem finding the smallest set of bits whose flips induce the greatest performance drop exhaustive searches over millions of parameters are computationally infeasible in real-time and cannot scale with larger models. Instead, lightweight heuristics can pinpoint "critical" parameters while incurring minimal overhead. By leveraging inductive insights into how information flows through the network, an attacker can disrupt the most influential parameters without iterative optimization or a large dataset. This stands in contrast to data-driven or gradient-bart based methods, which demand multiple inference passes and raise both computational requirements and the risk of detection.
2.1 Accuracy Reduction Metrics
To measure the effect of bit flips, let (()) be the set of parameters obtained by flipping exactly l: bits in 0. If Acc(f) is the model's original accuracy, we define: AR(k) = Acc(O) - Acc(0m)) which captures the drop in Acc(O)
accuracy induced by k flips. For a broader view, we also define:
1 N
mAR(N) = N
Σ AR()),
(1)
so that single number can represent the model's overall vulnerability across different flip counts. Because practical hardware attacks often manage only a handful of flips, we mainly focus on small (e.g., k s 10).
3 Locating Models' Most Critical Parameters
Targeting sign bits: Considering the FP32 representation, exponent flips can alter a weight's magnitude, while flipping the most significant sign bit instantly switches parameter from positive to negative (or vice versa). In the vision models that motivate our main method section, big flips provide the cleanest and usually strongest failure mode (see Appendix C), producing drastic changes in learned features as shown in Figure I For language models we additionally investigate exponent-bil attacks and find that they can be even more destructive, so the most harmfull bit type domain-dependent rather than universal. Localizing the sign bit in memory straightforward (c.g., always the MSB), making simple target for adversarics. Various hardware- based studies show that repeated access patterns more reliably flip the same bit position across different addresses than arbitrarily chosen bits Kim et al. (2014b); Seaborn & Dullien (015). Hence,
5

---

Published in Transactions on Machine Learning Research (03/2026)
focusing on sign bits aligns with how hardware attacks often achieve consistent flips in specific bit offset across multiple weights, increasing the chance of our targeted attack success rate.
Flipping random sign bits in a network's parameters typically has a negligible impact on performance. Indeed, our experiments (visualized in Figure 2ap show that for many architectures, flipping even up to 100, 000 bits does not reduce the accuracy consistently- indiicaiigg that most parameters are not "critical." These findings motivate a more targeted strategy to identify and flip only the most sensitive parameters.
first examine magnitude-based strategies. Just as magnitude pruning removes low-magnitude weights to minimize the impact on final preddiciiossFranklee Frankle & Carbin (2018), we hypothesize that flipping the sign of high-magnituude parameters causes significant. disruption. Formally, the parameter score function is defined as follows
Magnitude- Strategy: Drawing inspiration from the pruning literature,
S(O,) |6,1
(2)
As far as we are aware, this work is the first to evaluate the efficacy of a magnitude-based attack, a surprisingly simple yet powerful strategy that disrupts neural networks without data, optimization or prior knowledge. In Figure 2b the second boxplot from the left, shows that focusing on the top-k largest weights (in absolute value) significantly disrupts most evaluated models.
One-Flip-Per--ernel Constraint for Convolutional Models: Empirical analyses of CNN filters (Krizhevsky et al., 2012; Zeiler & Fergus 2014) highlight the importance of carly-stage kernels (e.g., Gabor- like or Sobel-like) in extracting fundamental visual features. These studies reveal that flipping single sign bit in a kernel can completely disrupt its feature extraction capability, altering the information the model relies on (see Figure [ for the effect of sign flips on a real kernel). However, flipping multiple bits within the same kernel often merely changes its orientation or slightly modifies its functionality, rather than fully de- We observe this phenomenon consistently across multiple architectures. See Appendix B for examples.
stroying the feature, as demonstrated Figure 3
One way to make the cancellation intuition more explicit is to look directly at how the kernel response changes. For convolution kernel response w an input patch x, two sign flips at indices i,j induce Ay = -2(w;2; + Wyzz). Thus, on a given patch, the second flip can partially offsct the first whenever the two contributions have opposite signs. This is plausible in practice because natural-image patches are locally correlated and many early kernels have opposite- edge-detector lobes (Yosinski et al. 2014). Averaged over patches, the same effect appears in the mean-squared perturbation, which for patch covariance matrix Σ gives
[[(A))²] (wf + + + Rwrwyyig)
When nearby patch entries are positively correlated (Ei > 0) and large coefficients within the same kernel lie on opposite-signed lobes (wawy < 0), the cross-term is negative, so the second flip can partially cancel the first instead of compounding it. This explains why spreading flips across kernels is more reliable than stacking them within one kernel.
To maximize danage in convolutional networks, we constrain the attack to flip exactly one bit per kernel, ensuring the disruption does not offset itself and affects a broader range of features. Given our focus on small number of flips, distributing them across more kernels also helps amplify the overall impact. This heuristic is specific to convolutional filters and is not used in our transformer- based languago-model experiments.
Layer Selection Beyond which parameters to flip, we also investigate where the network to apply the attack. One might intuitively expect that targeting final layers being closer to the classifier would cause greater damage. However, our experiments reveal that in many architectures, carly-layer manipulations are disproportionately damaging. Drawing on analogy from neuroscience, early lesions (e.g., in the retina optic nerve) can cause severe or total blindness (Kandel et al.] 2000 Stewart et al.) 2020 Essen et al. 1992) Similarly, flipping a single parameter in a fundamental feature detector (e.g., Sobel and Gabor filters) sends erroneous signals throughout subsequent layers, often leading to compounding error. Figure Qarteerllllttattt this: a sign flip a low-level "odge-detection" filter causes the network to misinterpret critical structural cues, compounding errors to later layers and severely degrading performance -moe so than flips occurring in higher-level layers. Moreover, early convolutional filters encode generic edge and texture features; disrupting
6

---

Published in Transactions on Machine Learning Research (03/2026)
Original Sobel Y
sign-flip sign-flips
Larger values
feature map
valuess
Figure 3: Horizontal edge detection filter (based on the Sobel Y filter) with two sign flips and their corresponding extracted features. With a single sign flip, the filter is severely disrupted, rendering it unable to detect edges effectively. However, with two bit flips, the resulting errors may partially offset cach other, allowing the filter to retain some edge-detection capability and produce features similar to the original.
Targeted
2
5
1m2
All Layers
.13
.15
.24
.39
First 100
.19
.24
.42
.48
First 10
93.9
99.6
99.6
99.8
First 5
93.9
99.6
99.7
99.7
1m5
First
93.9
99.6
99.7
99.7
First 1
59.5
53.7
82.4
88.5
1-10
Last 10
.01
.04
.06
.17
20
40
60
100
Last 5
.03
.19
.46
1.14
(a) First layers vs. mAR10
(b) ShuffleNet layer targets (AR %).
Figure 4: Layer-specific vulncrability: global trend (left) and detailed case (right).
them degrades all downstream representations. This aligns with pruning evidence that carly layers are disproportionately salient Frankle & Carbin (2018); Liu al. (2019b). The same propagation intuition extends beyond CNNs: in transformer models, corruptions introduced in early blocks similarly influence all later computations, motivating the early-layer targeting also study for language models.
Interestingly, for most models evaluated, the largest parameters (in absolute value) tend to concentrate in these early layers. However, many models such as ShuffleNetV2 (Ma et al. 2018) exhibit a different pattern: their largest parameters are concentrated in later layers. As result, naive attacks that always target the largest parameters often located in the late layers of ShuffleNet V2 are less effective. Redirecting the attack to early layers, however, significantly amplifies the damage (see Table 4b for quantitative details).
Theoretical motivation. We interpret our sign-flip attack through the same quadratic loss model long used to justify pruning criteria such as Optimal Brain Damage (OBD) LeCun et al. (1989b) and Optimal Brain Surgeon (OBS) Hassibi et. al. (1992). For a trained network with parameters and loss R(0), a oedond-order Taylor expansion gives
AR R g A0 +
A
where g = (6) and H the Hessian. At convergence, 0= so curvature dominates Dong al. (2020):
Wang et al. (019b). Flipping the sign of weight 0, yields A0; 200, with all other coordinates unchanged,

---

Published in Transactions on Machine Learning Research (03/2026)
giving under diagonal- Hesssinn approximation:
AR: 2(-20.)² 20 H.. H
Thus, with budget of flips, the greedy maximizer is the set of k indices with largest 02 If Hu is approximately constant within layer (empirically common in early convolutional layers and often useful local approximation more generally), this reduces to choosing the k largest |0,], precisely zero-pass criterion. Equivalently, if H Ž Jut, then
AR
2p ΣEE 0
iES
picking the largest magnitudes maximizes certified lower bound loss damage.
Our one-pass variant (IP-DNL) refines this by replacing Ha with Gauss Newton style estimates derived from gradients, recovering the classical Taylor saliency x [0 used in pruning (Molchanov et al. 2017 Lee et al. 2019 Wang et al. 2020 Tanaka. et al. 2020). Hence, magnitude- and gradient-based flips correspond to adverraiaal analogues of the very same criteria known to predict weight importance.
Early-layer targeting. Our main support for early-layer targeting is empirical: restricting candidate flips the first layers consistently increases attack impact (Figure 4 and Table A possible intuition is that a perturbation inserted earlier is processed by all subsequent layers. Under the standard Lipschitz composition bound, its worst-case amplification is at most I[ Le, where Le is the Lipschitz constant of layer & (Burago
ct al. 2001 Gouk et al. 2021 Virmaux & Scaman 2018 Prop. 1.4.3).
The Deep Neural Lesion Pass-free algorithm: Based on these observations, we explore a simple heuristic algorithm that flips bits only in the first layers of network (with 1 S < 10). Algorithm I summarizes our Pass-free attack for a given model, number of sign flips k, and layers We find that any in this range consistently degrades accuracy more than random or purely magnitude-basee strategies
(Figure 4ap. We select 1 = 10 for simplicity and only consider the parameters of those layers candidates for sign Hlips.
Algorithm Deep Neural Lesion (DNL) Pass-free Attack
Inputs: Model parameters 0, number of bits to flip k number of layers L
2: O + parameters in the first L layers of A
3: Sort 0,, in descending order by 10,1
4: + toppk entries of 0z
5: For CNNs: enforce at most one selected entry per kernel
for each 0, in K. do
0g -- // flip sign bit
end for
Output: Modified parameters
3.1 Enhanced Attack Using Single Forward Pass
When a single forward (and backward) pass is within the attacker's budget, we propose an enhanced attack, called 1P-DNL, inspired by gradient-based pruning methods (LeCun et al., 1989a; Mozer Smolensky Lee al.) 2019: Wang et al., 2020 Tanaka et al. 2020).. These methods typically assign a saliency importance score to each parameter 8, by measuring how altering that parameter (e.g., pruning modifying it) would affect the network's loss outputs. Although pruning and sign-flip attacks differ in goal, the underlying idca of identifying the "most critical" weights is similar.
1988
Hybrid Importance Score
We define hybrid importance scoring function that combines magnitudo-based saliency with socond-order information. This is not a new pruning criterion: the |6 term matches magnitude- basod pruning (Frankle & Carbin 2018), while the second-order component follows OODssyy saliency (LeCun et al. 1989a
8

---

Published in Transactions on Machine Learning Research (03/2026)
Hassibi et al. 1992): ; our contribution is to use this combination for adversarial parameter manipulation under striict one-pass budget. Let and & be tunable coefficients controlling the relative weight of magnitude- and sradient-based terms. For given parameter 0,.
OR 00:
1 0, + H Ha 0z +
S(O.) a |0:1
Hi j+1
where H is the Hessian of R with respect 0. In our case, we let a= 8 1, and define R(0) as the sum of model outputs on random input (e.g., class scores for Gaussian image-like inputs in vision models, logits induced by random token inputs in language models). Although the summation over # captures inter-weight coupling, we approximate Hyy 0 for j # (a common diagonal approxination in second-order pruning (LeCun et al. 1989a)), ), significantly reducing computation. Similarly, we replace Ha by ( (i.e., a Gauss-Newton like approximation,, which further simplifies Hossian-based cstimation.
-If ØR =0 0 and H = 0, Eq. equation 3 reduces to: S(0:) = a 10.1, mirroring a simple magnitude-based 20,
saliency score (identical to Equation 2
If a a0 we recover purely second-order (Optimal Brain Damage-like) approach:
S(O,) = 3
aR 0, + 86,
H oP/. which focuses on changes in R under small parameter perturbations.
Although one forward/ forward/backward backward pass on random data might be required to estimate S, it remains signifi- cantly simpler than full data-driven optimization- attacks (e.g., iterative gradient- based bit-flips). Fig- ure 2b shows that incorporating socond-order signals consistently amplifies the attack's damage compared to purely siggittude-based methods. Consequently, this hybrid scoring approach yields more powerful single-pass sign-flip attack in scenarios where the attacker can run forward and backward pass the ar- chitocture, yet does not have access to the original training set. To summarize 1P-DNL, we refer the reader to Algorithm 2 Figure 2c shows the impact of all previously suggested methods with 10 sign flips. Both DNL. and 1P-DNT. cause most models to collapse, with 43 out of 48 models exhibiting an accuracy reduction above 60%. Finally, in Appendix D we compare 1P-DNL with various other 1-pass methods from the weight pruning literature find critical parameters and find 1P-DNL the most potent.
4 Results Across Domains
We now evaluate DNL and 1P-DNL across three domains. Section 4.1 studies reasoning language models, where two sign flips into different experts already collapse Qwen3-30B-A33 A33B and where exponent flips are even more destructive. Section 4.2 revisits image classification beyond ImageNet across additional datasets, and Section 4.3 shows that allacking only the backbone is enough to collapse object detection and instance- segmentation metrics. Unless stated otherwise, the main text focuses on sign-bit attacks, which provide the cleanest comparison across domains.
4.1 Language Models
We evaluate three reasoning LLMs Qwen3-4B, Qwen3-30B-A3B, and Llama-3, 11ama-3.1-Nemmol J--Nemotron-Nano-B3 (Qwen Team
2025) on a fixed 50-question subset of MATH-500 derived from the MATH bench- Hendrycks et al. 2021 We score generations by answer accuracy using the benchmark's ' canonical verifier. The attack itself the same DNL/ / 1P-DNL procedure, but without the convolution-speeffc one- flip-perkeenell constraint. In the sign-bit setting, the clean accuracies of the main targeted runs are 78% for Qwen3-30B-ANl A3BB, 86% for Qwen3-4B, and 94% for Nemotron Nano.
2025 NVIDIA
mark
Several trends are worth highlighting. First, all three models are vulnerable to targeted sign flips, but the best layer scope is not universal: restricting the candidate set to the first five blocks is strongest for Qwen3- 30B-A3B and Nemotron Nano, whereas Qwen3-4B more vulnerable when all layers are considered. For compactnoss, Table D keeps only the first-five-block rows for Qwen3-30B-AN available all-layer runs, Swenn-33B-AA3 still reaches 100.0% AR under DNL, but only after 7 flips instead of 2, while its all-layer 1P-DNT never reaches 90% AR up to k 100. Nemotron Nano shows the same
and Nemotron Nano. In the
9

---

Published in Transactions on Machine Learning Research (03/2026)
Table 1: Sign-bit attacks on reasoning LLMs, evaluated on the 50-question MATH-500 subset. Each attack column lists # flips + AR (%). When run reaches at least 90% relative accuracy reduction, we report the first such budget. Otherwise, we report a larger illustrative budget directly in the cell.
Model
Targeted Layers DNL Flips AR (%)
1P-DNL Flips AR (%)
Qwe3-30BBA3B
First 5 blocks
+ 100.0
1 71.8, 4 + 100.0
First 5 blocks
30 - 2.3
28 95.3
Qwen3-4B
All layers
14 > 100.0
95.3
Nemotron Nano 8B
First 5 blocks
32 100.0
17 100.0
DNL, two sign flips
I'm going to help you with the solution. I'm going to help you with the solution. I' going to help you with the solution.
1P-DNL, four sign flips
Hello,
I an a student,
I an a student,
I an a student,
Figure 5: Abridged generations from Qwen3-30B-A3B under sign-bit attacks on MATH-500, Left: DNL with two flips degenerates into repeated boilerplate. Right: 1P-DNL with four flips degenerates into repetitive text such as "I am student". Both excerpts are abridged from raw outputs and illustrate why the same corruption mode is likely transfer beyond MATH-500 to other generation benchmarks.
qualitative pattern: its all-layer DNL run reaches 93.2% AR only after 87 flips, and its all-layer 1P-DNL never reaches 90% AR to k = 100. Second, DNL alone is already sufficient to collapse Qwen3-30B-ARS with only two sign flips, while 1P-DNL, already causes a 71.8% reduction with a single sign flip before reaching full collapse at four flips. The value of the Single-pass refinement even more visible on the more resistant models: for Qwen3-4B, 1P-DNL reaches severe degradation with 28 flips in the frst-five-block setting and only 4 flips when all layers are available.
Targeted attacks also far stronger than random sign flips. In the sast-fivo-block setting, Qwen3-30B-A3B still retains 70% accuracy after 27 random flips, Qwen3-4B retains 80% accuracy after 100 random flips, and Nemotron Nano retains 92% accuracy after 100 random flips. Random sign flips therefore do not come close to the targeted collapse in Table [ At the same time, their effect is less negligible than in our vision experiments, which is consistent with the hypothesis that autoregressive generation can compound even modest hidden-state corruption over time.
Owen3-30B-AA3) is especially striking because it is Mixtture-f-Expeeee model in which each token is routed through only small subset of the available experts. The top two DNL sign flips target two different expert down-projection weights, one in layer 3 expert 82 and one in layer 1 expert 68, yet these two flips alone reduce accuracy from 0.78 to 0.00. This suggests that the disruption is not merely a local per-token routing failure. Rather, corrupting a small number of expert outputs appears able to poison latent token representations that then continue to propagate through the model. complementary exponent-bit example supports the same intorpretation: in a single-flip rank-chock run, the attacked export used during prefill, and the response becomes gibberish immediately from the first generated tokens onward, even though the first several generated tokens do not route through that expert. This is consistent with corrupted hidden states propagating forward through attention, so that harming expert that is not used on every generated token can still derail the entire response.
Representative corrupted generations for Qwen3-30B-ADe under sign-bit attacks are shown in Figure 5 These failures are not ncar-miss mathematical errors; the model quickly collapses into repetitive, nonsensical text. This is why we expect the same corruption mode disrupt other generation-basee benchmarks well, not only MATH-500.
10

---

Published in Transactions on Machine Learning Research (03/2026)
Table 2: Targeted sign-bit attacks on encoder-based text classification models fine-tuned on GLUE tasks (Wang al.] 2019a),, including MRPC (Dolan Brockett (005). QNLI (Rajpurkar et al., 2016)
and SST-2 (Socher et al. 2013). We report the clean accuracy and the mean relative accuracy reduction over the ten flip budgets k E {10, 20,30, 30, ..... 100).
Model
Task
Baseline
Mean AR over k 10, .0....... 100 (%)
MRPC
87.75%
75.79
BERT
QNLI
90.43%
79.82
SST-2
93.16%
82, 22.43
MRPC
84.80%
75.15
DistilBERT
QNLI
86.13%
78.7
SST-2
91.21%
83.07
MRPC
91.18%
69.99
RoBERTa
SST-2
94.31%
77.44
QNLI
92.19%
75.42
We also evaluated exponent-MSB flips on the same LLMs. In the first-five-block setting, a single targeted exponent flip already reduces all three models to 0% accuracy under both DNL and 1P-DNL. Unrestricted targeting nearly as destructive, although Qwen3-30B-A3R can require a few flips there. Random exponent flips are often highly destructive as well-for example, on Qwen3-30B-A3B a random exponent flip at k already reduces accuracy to 6% which is consistent with exponent changes inducing extreme rescaling, Because this failure mode is both very strong and much less selective than sign attacks, we defer the detailed discussion to Appendix
Text Encoders. We also evaluated encoder-only language models fine-tuned for text classification GLUE tasks (Wang et al. 2019a). using BERT (Devlin et al. 2019), DistilBERT (Sanh et al. 2019), and RoBERTa (Liu et al.] 2019a) variants on MRPC, QNLI, and SS S-T-2. As in the decoder-only language models in Section 4.1 we find that exponent-bit attacks can be more destructive than sign-bit attacks; however, for text encoders we focus here on sign-bit perturbations.
The results are summarized in Table Across all nine encoder-tar task pairs, the attacks consistently cause severe degradation. Averaged over ten flip budgets & E {10, 20, 20, 30,..... 100), the relative accuracy reduction ranges from 69.99% to 83.07%, showing that the vulnerability is not limited to autoregressive generation. The strongest average degradation is observed on DistilBERT fine-tuned on SST-2, with mean relative accuracy reduction of 83.07%, followed by BERT on SST-2 with 82.43%. Even the most robust setting we tested, RoBERTa on MRPC, still exhibits a mean relative accuracy reduction of 69.99%.
These results extend our cross-domain picture from decoder-only LLMs encoder-based NLP models. The shared sensitivity of both model classes to bit-level perturbations suggests that even simple sign inversions can substantially degrade performance.
4.2 Image Classification
Beyond ImageNet, both DNL and 1P-DNL remain highly effective on DTD CCimpoi et al., 2014). FGVC-
Aircraft MMaj al. 2013), Food101 [Bossadd et al. 2014), and Stanford Cars (Krause et al., 2015). Tn
Figure 6 and Figure 7 we plot the average accuracy reduction across EfficientNet-BO (Tan & Lc 2019))
Ne (Howard al., 2019), and ResNet-50 (He et. al.] 2015). In all four datasets, flppiig two sign bits already leads to sharp collapse. Most notably, DNL yields AR(5) 2 85% across all
model/dataset. combinations shown, while 1P-DNL reaches AR(4) 2 90%. Additional per-dataset plots are provided in Appendix as well as complete attack details per model in Appendix
Impact of Model Size on Attack Success: To assess whether model size influences the effectiveness of our attacks, we evaluate both DNL and IP-DNL across five familics of architectures with varying parameter counts: ResNet, RegNet, EfficientNet, ConvNeXt (Liu et al.) 2022), and ViT (Dosovitskly et al. (2020). The results, summarized in Figure 14 and Figure 15 reveal that model size does not exhibit clear correlation
11

---

Published in Transactions on Machine Learning Research (03/2026)
100%
100%
DTD
DTD FOVC-Arcraf
FovC-Aircratt Food101 StanfordCars
Food101
StanfordCars
AR
AR
0%
Figure Averaged AR (%) of DNL over Efficient- NetBO, MobileNet and ResNet-50 vs num- ber of sign flips. Each color represents a different, dataset, confirming the impact of our pass pass-free at- tack on DTD, FGVC-Aircraft, Food101, and Stan- ford Cars.
Figure 7: Averaged AR (%) of 1P-DNL over Effi- cient.NetBO, MobileNettV--Lagge and ResNet-50 number of sign flips. Each color represents dilfer- ent dataset, confirming the fatality of our single pass attack on DTD, FGVC-Aircraft, Food101, and Stan- ford Cars.
Table 3: Sign-bit attacks on COCO 2017 object detection and instance segmentation. DNL applied only to the backbone. We report the baseline metrie, the post-attack metric after k and k 2 flips, and the corresponding relative reduction AR.
Model / Backbone
Metric
Baseline
k
AR(1)
k = 2
AR(
bbox AP
0.38
0.01
97.36
0.00
100.00
bbox AP50
0.59
0.03
94.93
0.00
100.00
Mask R-CNN / ResNet-50
segm AP
0.35
0.00
100.00
0.00
100.00
segm AP50
0.56
0.01
98.21
0.00
100.00
bbox AP
0.40
0.01
97.51
0.01
97.51
bbox AP50
0.61
0.03
95.12
0.02
96.75
Mask R-CNN/ / ResNet-101 101
segm AP
0.36
0.00
100.00
0.00
100.00
segm AP50
0.58
0.01
98.28
0.00
100.00
bbox AP
0.33
0.05
83.66
0.05
86.33
bbox AP50
0.47
0.08
82.01
0.07
81.92
YOLOv8-seg
segm AP
0.05
0.01
77.80
0.01
80.51
segm AP50
0.16
0.04
77.73
0.03
81.28
with attack susceptibility. Most models collapse at similar levels regardless of their scale, demonstrating that the attack is not confined to small networks.
4.3 Object Detection & Segmentation
We finally consider object detection and instance segmentation models evaluated on COCO 2017 (Lin et al. 2014). Here we attack only the backbone parameters and leave the task-specific heads untouched. We evaluate Mask R-CNN models with ResNet-50 and ResNet-101 backbones from torchvision (He ct al. 2017
Lin et al. 2017 Marcel Rodriguez 2010), as well as YOLOv8-seg from Ultralyties ІJocher al. 2023 We report average precision (AP): AP 0.50:0.95] averages over loU thresholds from 0.50 to 0.95, while AP@0.50 reports the same metric at ToU 0.50 only. We report these metrics for both bounding boxes (bbox) and instance masks (segm).
The results Table 3 mirror the brittleness already seen in image classification. For both Mask R-CNN backbones, a single sign flip the backbone already drives box AP to about 0.01 and mask AP to 0.00, with the two-flip setting effectively collapsing all reported metrics. YOLOv8-seg is somewhat more resilient, but even there two sign flips are sufficient remove over 77% of both detection and segmentation
12

---

Published in Transactions on Machine Learning Research (03/2026)
(a) Clean
(b) 1-bit flip
(d) Clean
(e) 1-bit flip
(c) Mask R-CNN-R101.
(I) YOLOv8-sug.
Figure 8: Qualitative comparison of dense prediction failures after a single targeted bit flip. The input image contains a dog. Left two panels: Mask R-CNN with a ResNet-101 backbone still segments the object with high fidelity after the attack, but assigns it the wrong semantic class. This is consistent with our attack protocol, which modifies only the backbone while leaving the task-specific heads untouched: localization and mask prediction can remain plausible even when the semantic representation has been corrupted. Right two panels: YOLOv8-seg detects the dog correctly in the clean setting, but after one bit flip it fails to recognize the dog altogether and instead hallucinates a bird detection on the tail. These examples illustrate two distinct failure modes induced by minimal parameter corruption: semantically incorrect yet. well-localized prediction in Mask R-CNN, and complete object-level failure with hallucinated detection in YOLOv8-seg.
performance. These results show that the vulnerability is not limited to classification heads: corrupting a small number of backbone weights can derail downstream detection and segmentation as well. Figure g highlights two distinct qualitative failure modes under a one-bit attack: Mask R-CNN-R101 preserves coarse localization but assigns the dog an incorrect class, likely because our attack targets only the backbone, whereas YOLOv8-seg fails to detect the dog and hallucinates a bird on the tail.
5 Comparison to Other Weight Attacks
All prior methods rely on considerable optimization efforts, typically requiring multiple forward and backward passes through the network, and in most cases, access to data samples to compute gradients. Consequently, these attacks fall outside the scope of our restrictive threat model. Early works such as Terminal Brain Damage (TBD) Hong et al. (2019) illustrated how manipulating exponent bits could severcly harm floating- point works However, TBD excludes sign bits, which in our vision-model experiments are often at least as devastating and frequently stronger at low flip budgets (see Appendix C). Other methods, including [Rakin et al.] 2019 Yao ct al. 2020), perform iterative gradient-based flips. For example, Rakin et al. (2019) requires multiple samples to compule gradients and can disrupt ResNet-50's accuracy by ~ 99.7% using 11 bit flips. Yao et al. (2020) similarly needs iterative optimization, reaching significant disruption at the cost.
of 23 flips.
Recent variants have attempted to relax data requirements. For instance, Ghavami et al. 2021 Park al, 2021b generate pseudo-samples or use partial data statistics to guide which bits to flip. Although they lessen the need for a large labeled dataset, they still rely on model feedback or approximate gradients. In contrast, our sign-bit bit flipping approach is lightweight, data-agnostic, and can degrade a large variety of vision networks by over 99.8% with few flips, while also transferring to reasoning L.Ms and to object detection and instance segmentation models under the same broad thrcat model.
Table f compares bit-flip attacks on ImageNet- 1K INT8 quantized models, and highlights how our approach differs from prior methods. BFA Rakin et al. (2019 and DeepHammer Yao et al. (2020) require iterative gradient-based scarches and at least a few validation images. ZeBRA Park et al. (2021) drops the data requirement. but still performs an optimization loop (and invests further compule into generating synthetic data). In stark contrast, our attacks can be carried out without data or optimization, and are straightforward to locate in memory, making them both feasible and devastating real-world scenarios, yet equal or exceod prior art in accuracy reduction while using fewer bit flips. For example, 1P-DNL collapses ResNet-50 by 99.4% with single sign flip.
13

---

Published in Transactions on Machine Learning Research (03/2026)
Table 4: Bit-flip attacks on ImageNet-1K, Each cell lists # flips - AR (%). OF optimization-fres DA data-agnostic. best of 5 trials.
Model
Method
OF
DA
# Flips + AR (%)
BFA [Rakin al. (2019
- 99.7
ZeBRA Park al. 2021
99.8
VGG-11
DNL
3 99.9
IP-DNL
99.8
DeepHlammer Yao et a
2020
X
23 + 75.4
BFA |aakin et al. 2019
X
+ 5.5, + 99.7
ResNet-50
ZeBRA Park ct al 2021 DNI,
7.7, 99.7
6.6, 99.7
IP-DNL
99.4
DeepHammer Yao et al.
2020
X
2 99.8
BFA Rakin et al. 2019
X
+ 99.8
MobileNet-V2
ZeHRA Park et al. 2021
Park
2 99.7
DNL
2 99.8
1P-DNL
2 - 99.9
BEA Rakin al. 2019
5
30.1,
10 90.9
ZeBRA Park al
2021
5 +
5.1,
10 45.8
VIT-B/160224
DNL
5 99.3
IP-DNL
99.1
LLM-specific weight attacks. Recent work has extended adversarial weight manipulation from con- ventional DNNs to large language models, while also broadening the attack goals beyond generic accuracy collapse. Some studies emphasize stealth: SilentStriker (XU et al. 2025) aims to degrade lask perfor- mance while preserving fluent, natural-looking generations. Other work focuses on scalability and model breadth: FlipLLM (Khalil & Hoque 2025) formulates bit selection as a reinforcement-leannee
problem and demonstrates efficient attacks on both text-only and multimodal LLMs. More recently, TFL (Guo et al., 2026) studies targeted bit-flip attacks that steer selected prompts toward atlacker-specifes outputs while largely preserving utility unrelated inputs. In parallel, Almalky et al. (Almalky et al. 2025 analyze how carlier bit-flip mechanisms transfer to LLMs, and Egashira et al. (Egashira et al.) 2026 expose a related deployment- time threat in which malicious behavior is hidden in model and activated after pruning. Rel- ative to this emerging LLM literature, our focus remains intentionally more restrictive: the pass-free DNL. setting data-free and optimization-free, and even 1P-DNL requires only a single bwwarddbackward pass on random inputs.
6 Defenses and Counter-Measures
Selective Defense Against. Sign-Flips. A straightforward mitigation is to keep several full copies of every sign bit and take majority vote at inference. Because an attacker would then have to corrupt most replicas simultaneously, the method is robust-but it multiplics memory and bandwidth.
A leaner alternative uses error-correcting codes (FCC) such as Hamming codes (Peterson & Weldon 1972 Single-bit ECC can detect and fix isolated flips automatically, yet scaling to many parameters demands stronger (and costlier) codes. The key observation from Section 3 is that only tiny subset of sign bits is truly calnstrophic. Hence we can protect just those high-scoring weights-identinnn identified by eit.-either with bit replication or ECC, while leaving the vast majority of bits unguarded.
Selective DNL Defense. We tested DNL weight selection to defend against the iterative Bit-Flip Attack (BFA) RRkinn et al. 2019).
Table reports the mean accuracy reduction after the attacker is allowed up to ten flips (k E [1, 10), three runs per k). Shielding only 0.001% of parameters already halves BFA 's impact on ResNet-18 and ResNet-50; guarding 1% of parameters nullifies the attack on every model we tried.
While these experiments illustrate simple defense, their greater significance lies in showing that DNL reliably identifies the most critical parameters the very ones exhaustive BFA seeks to corrupt.
14

---

Published in Transactions on Machine Learning Research (03/2026)
An expanded evaluation different attack strategies with results on the sixteen most vulnerable architec- tures is provided in Appendix H
Table 5: Effect of (DNL, Defense) against BFA.
Model
#
Defended params
BFA AR(10)
Model
Defended params
BFA AR(10)
No Defense
88.87
No Defense 0.001% (250 params) 1% (250 K params)
93.87
ResNet-18
0.001% (100 params))
58.83
ResNet-50
39.08
1% (100 K params)
0.00
1.30
Defense
99.90
No Defense 0.001% (900 params)
82.30
MobileNet-V2
0.001% (30 params)
99.80
ViT-B/160224
40.51
1% (30 K params)
44.30
1% (900 K params)
0.21
Evaluating DNL against existing defenses: We evaluated representative defense strategies that have been proposed to prevent bit-flip attacks and found that DNL (and its 1-pass variant) either fully or largely bypass them.
Encoding defenses.
DeepNoode (Velcický al. 2024] defends against parameter corruption by encoding each floating-poit weight into longer binary codeword with redundancy, typically using codebook with Hamming distance > 1 between valid codewords. During inference, the stored codeword is decoded back into a floating-pon point value; if a bit flip occurs, the decoder maps the corrupted codeword to the nearest valid one, thereby correcting small errors.
However, this protection assumes the attacker cannot deliberately steer the corrupted codeword toward a different valid codeword. In realistic gray-bor setting the attacker does not know the codebook, but can observe the resulting decoded values we can exploit this decoding step. Specifically, by selectively flipping bits in the encoded representation, we search for the closest alternative codeword whose decoded value has the opposite sign. This effectively performs sign flip through the encoding, bypassing the correction capability of the decoder.
Weight-scaling defenses. Weight-scaling [Fuengfusin Tamukoh 2024 multiplies all stored parameters by constant e and divides by e at inference, damping additive perturbations by the factor c. Sign flips, however, are multiplicative (0 + -0); after the rescaling they remain -0, exactly as in the undefended model: flip: -0
defended: -cl - Hence, the scaling defense has no effect on DNL, which is empirically confirmed by unchanged AR.
7 Concluding Remarks
This work exposes fundamental vulnerability in deep neural networks: a cheap, heuristic, data-free attack that only requires access to stored weights can inflict severe damage across very different domains. We introduced a method for locating and flipping critical parameters, and showed that even without optimization or data it can catastrophically disrupt image classífiers, object detection and instance segmentation models, and reasoning language models. Building on the same critical-paramete analysis, we also proposed targeted defense that selectively protects vulnerable sign bits and substantially improves robustness.
Limitation. DNL assumes that an adversary can directly modify a small number of stored parameters.
In deployments where only part of the model is writable or addressable for example because parameters are sharded, compartmentalived, or only partially exposed the al tack may be less effective, since a global search over all weights no longer available.
Future work could explore partial-access threat models, as well as architectures, numeric formats, and training procedures that increase resistance to such lightweight attacks.
15

---

Published in Transactions on Machine Learning Research (03/2026)
8 Acknowledgments
The rescarch was partially supported by Isracl Science Foundation, grant No 765/23
References
Abeer Matar A Almalky, Ranyang Zhou, Shaahin Angizi, and Adnan Siraj Rakin. How vulnerable large lan- guage models (Ims)) against adversarial bit-flip attacks? In Proceedings of the Great Lakes Symposium on VLST 2025, GLSVLSI '25, pp. 534-539, New York, NY, USA, 2025, Association for Computing Machinery. ISBN 9798400714962. doi: 00.144533116368.3755222
Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 minnnn discriminative components with random forests. In European Conference on Computer Vision, 2014.
Dmitri Burago, Yuri Burago, and Sergei Ivanov. Course Metric Geometry, volume 33 of Graduate Studies in Mathemalics. American Mathemalical Society, 2001.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, 2016.
M. Cimpoi, S. Maji, I. Kokkinos, S. Mohamed, and A. Vedaldi. Describing textures in the wild. In Proceedings of the IEEE Conf. on Computer Vision and Paltern Recognittio (CVPR), 2014.
Matthieu Courbariaux, Itay Hubara, Daniel Soudry, Ran El- Yaniv, and Yoshua Bengio. Binarized neural networks: Training deep neural networks with weights and activations constrained to +1 or -1, 2016. URL https://arxiv
org/abs/1602.co 02830
Jacob Devlin, Ming Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In NAACL, 2019.
Bill Dolan and Chris Brockett. Automatically constructing corpus of sentential paraphrases. In /WP, 2005.
Zhen Dong, Zhewei Yao, Daiyaan Arfeen, Amir Gholami, Michael W Mahoney, and Kurt Keutzer, Hawq-v2: Hessian aware trigh-weighted quantization neural networks. In H. Larochelle, M. Ranzalo, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neurul Information Processing Systems, volume 33, pp. 18518 18529. Curran Associates, Inc., 2020.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesníkov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale, 2020.
Kazuki Egashira, Robin Staab, Thibaud Gloaguen, Mark Vero, and Martin Vechev. Fewer weights, more problems: A practical attack on Ilm pruning, 2026. URL https://arxiv.
07985
David C. Van Essen, Charles H. Anderson, and Daniel J. Felleman. Information processing in the primate visual system: An integrated systems perspective. Science, 255(5043):419-4222 1992. doi: 10.1126/science. 173.cieee...111111... URL
h/tww://www.. www.ssc..eeecooooooooo wwtpoo////////////////o/o 111111...1i1//ceeeeeee 1734518
Jonathan Frankle and Michael Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks, 2018.
Pietro Frigo, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. Grand pwning unit: Accelerating microarchitec- tural attacks with the gpu. In 2018 IEEE Sympostum Security and Privacy (SP), pp. 195-210, 2018. doi:
10.1109/SP..20 20...2018.00022
Ninnart Fuengfusin and Hakaru Tamukoh. Harden deep neural networks against fault injections through weight scaling. CoRR, abs/2111.18990 2024. doi: 10.48550/ARXXT12211..899 URL https://cbi.org// 48550/ arXiv. 2411.18993)
Behnam Ghavami, Mani Sadati, Mohammad Shahidzadeh, Zhenman Fang, and Lesley Shannon. Bdfa: A blind data adversarial bit-flip attack deep neural networks, 2021.
lan J. Goodfellow, Jonathon Shiens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yaun LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, Sun Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URT.
16

---

Published in Transactions on Machine Learning Research (03/2026)
Henry Gouk, Eibe Frank, Beruhard Pfahringer, and Michael J. Cree. Regularisation of neural networks by enforcing lipschitz continuily. Machine Learning, 110(2):393-413) 2021. doi: 10.0007/41009444000005222 052-9999
Jingkai Guo, Chaitali Chakrabarti, and Deliang Fan. Til: Targeted bit-flip attack on large language model, 2026.
URL https://arxxv..rr//bb///822 17837
Hassibi, Babak, Stork, and David. Second order derivatives for network pruning: Optimal brain surgeo.. In Advances in Neural Information Processing Systems, 1992. URL https://proceeddngg nwwripe petppeeeeeee.cppppprrrrr..e.e wwtpppperttlle//peeeeeeeeeeeeeee files/paper/ pdf
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015.
Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick, Mask r-cnn. In 2017 IEEE International Conference on Computer Vision (ICCV), pp. 2980 2988, 2017.
Zhezhi He, Adnan Siraj Rakin, Jingtao Li, Chaitali Chakrabarti, and Deliang Fan. Defending and harnessing the bit- flip based adversarial weight attack. In 2020 TEEE/CVE Conference on Computer Vision and Pottern Recognition (CVPR), pp- 14083-14091, 2020. doi: RL1109/CCPR22000..0
Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. Measuring mathematical problem solving with the math dataset. In Advances in Neural Information Processing Systems, 2021.
Greg Hoglund and Jamie Butler. Rootkits: Subverting the Windows Kernel. Addison- Addison-Wesley Professional, 2006. ISBN 978-0-321-29431-0.
Sanghyun Hong, Pietro Frigo, Yigitcan Kaya, Cristiano Giuffrida, and Tudor Dumitrag, Terminal brain damage: exposing the graceless degradation in deep neural networks under hardware fault attacks. In Proceedings of the 28th USENIX Conference on Security Symposium, SEC'19, pp- 497-514, 514, USA, 2019. USENIX Association. ISBN 1181939133063
Andrew Howard, Mark Sandler, Grace Chu, Liang-Chine Chich Chen, Bo Chen, Mingxing Tan, Weijun Wang, Yukun Zhu, Ruoming Pang, Vijay Vasudevan, Quoe V. Le, and Hartwig Adam. Searching for mobilenetv3, 2019.
Trammell Hudson and Larry Rudolph. Thunderstrike: Ef firmware bootkits for apple macbooks. In Proceedings of the 8th ACM International Systems and Storage Conference, SYSTOR '15 New York, NY, USA, 2015. Association for Computing Machinery. ISBN 9781 450333677 doi: 10.1145/27576672277777 URL 2757667.
Glenn Jocher, Ayush Chaurasia, and Jing Qiu. Ultralytics yolov8. http://hhbb.ccmmllllrrayyygaaaaa 2023.
E.R. Kandel, J.H. Schwartz, and Jessell. Principles of Newral Science, Fourth Edition. McGraw-Hill Compa- Incoppoco,,,,,,e, 2000. ISBN 9780838577011. URL https://bookss wwtgle.cc...//ooooleoooooooooo
co. wal//bokss1d-yyEPPXXcc..
Khurram Khalil and Khaza Annarul Hoque Flipllm: Efficient bit-flip attacks multimodal 1lms using reinforcement learning, 2025.
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Cheng- Yao Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. In Proceedings of the 41st Annual International Symposium on Computer Architecture (ISCA), pp. 361-372. IEEE/ACM, 2014a doi: R..1109/TSAA 1.6853210.
Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of dram disturbance errors. 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA), pp. 361-372, 2014b. doi: 10.1109/1SCA 2014.6853210.
Jonathan Krause, Hailin Jin, Jianchao Yang, and Li Fei-Fei. Fine-grained recognition without part annotations. 2015 IEEE Conference on Computer Vision and Pattern Recognation (CVPR), pp- 3546-5555, 2015. doi: 10.1109/CVPR /CWCCC.......2991.....
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenel classification with deep convolutional neural networks. In Proceedings of the 26th International Conference on Newral Information Processing Systems- - Volume 1, NIPS'12, pp. 1097-1105, Red Hook, NY, USA, 2012. Curran Associates Inc.
17

---

Published in Transactions on Machine Learning Research (03/2026)
Pat Langley. Placehokder title. Placeholder Journal, 1(1):1 10, 2000.
Yann LeCun, John Denker, and Sara Solla. Optimal brain damage. In D. Touretzky (ed.), Advonces in Newral Information Processing Systems, volume 2. Morgan-Kaufnaun, 1989a. URL http://rooeccina..errrr........ neurips.com cc/ Papere-apppppppppp
paper_ httpeeppppp..../acccccacaaaaaaaa
Yann LeCun, John S. Denker, and Sara A. Solla. Optimal brain damage. David S. Touretzky (ed.), Advances in Neural Information Processing Systems 2, [NIPS Conference, Deaver, Colorado, USA, November 27-30, 1989). pp. 598 605. Morgan Kaufmann, 1989b. URL htsp://paperr..nipe.e
Namhoon Lee, Thalaiyasingam Ajanthan, and Philip Torr SNIP: SINGLE-SHOT NETWORK PRUNING BASED ON CONNECTION SENSITIVITY. In International Conference on Learning Representations, 2019.
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects in context. In European Conference on Computer Vision, pp- 740- 755, 2014.
Tsung-Yi Yi Lin, Piotr Dollár, Ross Girshick, Kaiming He, Bharath Hariharan, and Serge Belongie. Feature pyramid networks for object detection. In 2017 IEEE Conference on Compuler Vision and Pallern Recognilion (CVPR), pp. 086-944,222 2017.
Moritz Lipp, Michael Schwarz, Lukas Raab, Lukas Lamsttr, Misiker Tadesse Aga, Clementine Maurice, and Daniel Gruss. Nethammer: Inducing Towhammer faults through network requests. In 2020 IEEE European Symposium on Security and Privacy Workshops (EuroSSamp:PWW) IEEE, September 2020. doi: 10.1109 97000//erroopp5117.2202 379.2020.
00102. URL http://dx doi. owg/10../////oo 1119////rrSS551111 2020. 2020.00102
Yinhan Liu, Myle Out, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettle- moyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. In arXiv preprint arXix:1907. 11692, 2019a.
Zechun Liu, Zhiqiang Shen, Marios Savvides, and Kwang-Ting Ting Cheng. Reactnet: network with generalized activation functions, 2020.
Towards precise binary neural
Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. Rethinking the value of network pruning, 2019b. URL atttps///rxiii htttps////aax....orr//////1111.1 05270
Zhuang Liu, Hanzi Mao, Chao- Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie, A convnet for the 2020s, 2022.
Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, and Jian Sun. Shufflenet v2: Practical guidelines for efficient enn architecture design, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations, 2018
S. Maji, J. Kannala, E. Rahtu, M. Blaschko, and A. Vedaldi. Fine-grained visual classification of aircraft, 2013.
Sébastien Marcel and Yann Rodriguez. Torchvision the machine- vision package of torch. In Proceedings of the 18th ACM International Conference Multimedia, MM '10, pp. 1485 1488, New York, NY, USA, 2010. Association for URL
Computing Machinery. ISBN 9781605589336. doi: 10.1145/18739511.88778 1873951. 1874254
A. Theodore Markettos, Colin Rothwell, Brett F. Gutstein, Allison Pearce, Peter G. Neumann, Simon W. Moore, and Robert N. M. Watson. Thunderclap: Exploring vuluerabilities in operating system iommu protection via dma from untrustworthy peripherals. Proceedings 2019 Network and Distributed System Security Symposium, 2019.
Paylo Molchanov, Stephen Tyree, Tero Karras, Timo Aila, and Jan Kautz. Pruning convolutional neural networks for resource efficient inference. In 5th International Conference Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.nee net, 2017. URL Inttps://operevvier net// Dorumiid=SJGCiw5g
Michael C Mozer and Paul Smolensky. Skeletonization: A technique for trimminng the fat from a network via relevance assessment. In Advonees in Neural Information Processing Systems. Morgan-Kaufnnann, 1988. URL /htpps://
pecceedinge.nneurige httpa//www......eeeeeeee/ee//eaa
18

---

Published in Transactions on Machine Learning Research (03/2026)
Kit Murdock, David Oswald, Flavio D. Garcia, Jo Van Bulck, Daniel Gruss, and Frank Piessens. Plundervolt: Software-based fault injection atlacks against intel sgx. In 2020 IEEE Symposium on Securily and Privacy (SP); pp. 1466-1482, 2020. doi: 1109/S1P400000000
NVIDIA. Llama-3.1- -- https///uugginggaccc.oo/raa//aaa 3.1-Nemotron Caairooonnnno-- Nano-8B 8B-v1 2025.
Sean-Philip Oriyano. CEH: Certified Ethical Hacker Version 8 Study Guide. SYBEX Inc., USA, 1st edition, 2014.
ISBN 111864767X.
Dahoon Park, Kon-Woo Kwon, Sunghoon Im, and Jacha Kung. Zebra: Precisely destroying neural networks with zero-data based repeated bit flip attack, 2021.
W. Wesley Peterson and E. J. Weldon. Ermor- Coor-Correcttng Codes. MIT Press, Cambridge, MA, 2nd edition, 1972.
Qwen Team. Qwen3 technical report. arXiv preprint wxXiu:2555009955 2025.
Ilija Radosavovic, Raj Prateck Kosaraju, Ross Girshick, Kaiming He, and Piotr Dollar. Designing network design spaces. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). TEEE, June 2020a. doi: 10. 0..1109//xpr/2200.22222 200.2220000000000004. URL http://áx.doo. http://xx..o..rr/////// wtt.:100/////422000000000 2020 .00444
Iijaa Radosavovic, Raj Prateek Kosaraju, Ross Girshick, Kaiming He, and Piotr Dollár. Designing network design spaces, 2020b.
Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. Squad: 100,000+ questions for machine comprehension text. EMNLP, 2016.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. In 2019 LEEE/CVF International Conference on Computer Vision (ICCV), pp. 1211-1220. IEEE, October 2019. doi: 10. 10.1109/1ccy 201...0199.0100 URL http://dx.dof: wwa.l.orgg1... 1109/ICCVV 2019.00130 00130
Adnan Siraj Rakin, Li Yang, Jingtao Li, Fan Yao, Chaitali Chakrabarti, Yu Cao, Jae sun Seo, and Deliang Fan. Ra- bnn: Constructing robust & accurate binary neural network to simultaneously defend adversarial bit-flip attack and improve accuracy, 2021.
Tal Rozen, Moshe Kimhi, Brian Chmiel, Avi Mendelson, and Chaim Baskin, Bimodal binarized neural networks. Mathematics, 10(21), 2022. ISSN 2227-7390. doi: 003900/math1021407..
Joanna Rutkowska. Beyond the CPU: Defeating hardware-based RAM acquisition. Black Hat USA, 2007.
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, distilled version of bert: smaller, faster, cheaper and lighter. In NewrIPS Workshop. 2019.
Mark Seaborn and Thomas Dullien. Exploiting the dram rowhammer bug gain kernel priv- URL http:://gogguprojjczzeer.. cttoggpoo..co//011111
ileges. Black Hat USA, August 2015.
exploiting-drant -ww.arrraa bug-rr--------tt-t---- html
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In EMNLP, 2013.
Sherri Sparks and Jamie Butler. Shadow walker: Raising the bar for rootkit detection. In Black Hat Federal, 2005.
Emına E. M. Stewart, Matteo Valsecchi, and Alexander C. Schütz. review of interactions between peripheral and foveal vision. Journal of Vision, 20, 2020.
Mingxing Tan and Quoc V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks, 2019.
Hidenori Tanaka, Daniel Kunin, Daniel L Yamins, and Surya Ganguli. Pruning neural networks with- out any data by ileratively conserving synaplic flow. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 6377- 6389. Curran Associates, Inc., 2020. URL http::://proceednng/ neurips. cc/ capeap hatp:pppp__eee_eee (iilee/paperr/222/fH1.. (aaa27a83aaass00083377662222--32
19

---

Published in Transactions on Machine Learning Research (03/2026)
Adrian Tang, Simma Sethumadhavan, and Salvatore Stolfo. CLKSCREW: Exposing the perils of Selurity- energy management. In 26th USENIX Securily Symposium (USENIX Security 17), pp. 1057-1074, Vancouver, BC, August 2017. USENIX Association. ISBN 978-1-931971-40-. URL https://www.usem.x. org/conference/
Andrei Tatar, Radhesh Krishnan Konoth, Elias Athanasopoulos, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi, Throwhammer: Rowhammer allacks over the nelwork and defenses. 2018 USENIX Annual Technicaal Conference (USENIX ATC 18), pp. 213-226, Boston, MA, July 2018. USENIX Association. ISBN ISBN 978-1-939133-01-44
URL https://wwrr wwwp:useeii...oo. http:///wferereeee/aa///eeeeaaea
Victor Van der Veen, Cristiano Giuffrida, and Others. TRRespass: Exploiting the rowhammer bug in Proptrottteed DRAM. In IEEE Symposium on Security and Privacy, 2020.
Patrik Velcický, Jakub Breier, Mladen Kovacevic, and Xiaolu Hou. Deepucode: Encoding- protection against
bit-flip attacks on neural networks. CoRR, abs/2405.13891, 2024. doi: 10,48550 ARXEIV 2405.13891 URL https:
orgoi.org// 10. 48550/ arxiv. 2405.13888
Aladin Virmaux and Kevin Scaman. Lipschitz regularity of deep neural networks: Analysis and efficient estimation. In Advances in Newral Information Processing Systems, volume 31, 2018.
Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel Bowman. Glue: A multi-task benchmark and analysis platform for natural language understanding. In ICLH, 2019a.
Chaoqi Wang, Guodong Zhang, and Roger Grosse. Picking winning tickets before training by preserving gradient flow. In International Conference Learning Representations, 2020. URL httpps://openrevieu.. https///oooerrvvier.e//////om// wtw.ppprrrrriiee.t.teorooraaaaa. net/forumiid= SkgsACVKPH
Kuan Wang, Zhijian Liu, Yujun Lin, Ji Lin, and Song Han. Haq: Hardware-uware automated quantization with mixed precision. In 2019 TEFE/CVF Conference on Computer Vision and Pottern Recognition (CVPR), pp. 8612-8620. IEFF, 2019b. doi: (v11099cvp:2019.0000
Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: A slealthy allack method in the physical world. IEEE Transactions on Pollern Analysis and Macline Intellgence, pp. 1-1, 2022. ISSN 1939-3539. doi: 10.1109/tpami. 2022.3176760. URL. http:://t//d....m doi http://xx..i..oo//....o http:/.0.119//PPAA 201.
Ross Wightman. Pytorch image models. http::///gttub...mm//ruggaaaaa/p
2019.
HAOTIAN XU, Qingsong Peng, Jie Shi, Huadi Zheng, YU LI, and Cheng Zhuo Silentstriker: Toward stealthy bit- flip attacks on large language models. In The Thirty-minth Avnual Conference on Neural Information Processing Systems, 2025. URL lutpss//opperrevier mett/forunn1de40ddooom
Zihan Xu, Mingbao Lin, Jianzhuang Liu, Jie Chen, Ling Shao, Yue Gao, Yonghong Tian, and Rongrong Ji. Recu: Reviving the dead weights in binary neural networks, 2021.
Fan Yao, Adnan Siraj Rakin, and Deliang Fan. DeepHammer: Depleting the intelligence of deep neural networks
through targeted chain of bit flips. In 29th USENIX Security Symposium (USENIX Security 20), pp. 1463- 1480. USENIX Association, August 2020. ISBN 978-1-939133-1755 URL https:://tw.useeeeeeese wwwp:://wwwwuuuiuxee// wttp:/uuiii...ooooooeeeeeeeoeoee org/conferencc// dseeiixsecurrtyyy/ppeeeemaa
Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks?
In Advances in Newral Information Processing Systems, 2014.
Matthew D. Zeiler and Rob Fergus. Visualizing and Underslanding Convolutional Networks, pp. 818 833. Springer International Publishing, 2014. ISBN 0783319105901. doi: 10. (700077977-3-111--11 53. URL http:://x.doo) doi. 1007/99. 10590-1155
20

---

Published in Transactions on Machine Learning Research (03/2026)
A Full cross-model comparison
Table 0 reports all flip-budget measurements we collected on full precision models, while Table 0 quantifies the correspondlng computational savings. Both DNL and IP-DNL remain the only attacks that are simultaneously OF (optimization-free) and DA (data agnostic), while achieving equal-or-higher accuracy reductions than optimization- based data-requiring methods, often with fewer flipped bits. Note that Park et al. 2021 avoids requiring data by generating synthetic data from the victim model instead.
Table 6: Bit-flip attacks on ImageNet-1K, 1K. Each cell lists # flips + AR (%). OF optimization-fres DA data-agnostic. best of 5 trials.
Model
Method
OF
DA
Flips + AR (%)
BFA Rakin et al. 2019
X
17 + 99.6
AlexNet
DNL
10 + 88.5, 17 - 98.2
IP-DNL
V
10 - 93.2.
17 - 98.2
BFA Rakin et al. 2019
X
X
17 - 99.7
ZeBRa Park et al. (2221
X
8 99.8
VGG-11
DNL
3 - 99.9
1P-DNL
DeepHammer Yao et al.
2020
X
23 75.4
BFA Rakin al 2019
- 5.5, 99.7
ResNet-50
ZeBRA Park et (2021
- 7.7, - 99.7
DNL
+ 6.6, + 40.4, 8 - 99.7
IP-DNL
1 99.4
DeepHammeer Yao el al.
2020
x
2 + 99.8
BFA Rakin et al 2019
X
X
3 4 99.8
MobileNet-VV V2
ZeBRA Park et (2021
X
2 99.7
DNL
2 99.8
1P-DNI.
2 99.9
BFA Rakin al. 2019
3 99.8
ZeBIIA Park et (2021
3 99.8
Inception- V3
DNL
2 + 99.8
1P-DNL
3 + 99.1
BFA Rakin et al. ZeBRA Park et al. 2021
2019
5 + 30.1, 10 + 90.9
X
5 + 5.1, 10 - 45.8
VIT-B/160221
DNL
5 99.3
1P-DNL
4 99.1
Table 7: Approximate computational costs for different bit-flip attacks. Here, 0 is the number of parameters in the model, & is the number of flipped bits, m is the imini-)batch size used for gradient or scoring, and B is the number candidate bits evaluated in each iteration. All complexities assume that a forward/band backward pass scales on the order of ( m).
Method
Description
Complexity
BFA Rakin et al. 2019
Iterative gradient-basel search; each flip requires scoring multiple bits
O x m)
DeepHammer Yau el al.
2020
Chain-based iterative search for each flip
O
B x 0 m)
ZeBRA Park al. 2021
Zero real-data, but still repeated forward /backward passes per flip
O B x 0 m)
DNL (Ours)
Pass-froe; select bits by magnitude only
( + O(k)
IP-DNL (Ours)
Single-pass, pass; one forward /backward pass
O(#) + O(k)
B One Flip Per Kernel Constraint Examples
Applying our maguitude-basse method for & 2 selocts the second highest-magnirude weight for sign flipping, which in this helongs the third convolutional layer, and results
Mobile.Ned VabbileeNeVV-Laryyy Va-Large [Howard et al. 2019:
21

---

Published in Transactions on Machine Learning Research (03/2026)
in significant accuracy drop AR( 81.31. Adding another maguilude--used weight results in flip within the same kernel that reduces the degradation to AR(3) 46.97, partially offsetting the attack. However, flipping the next highest-magnitude parameter from different kernel instead raises the accuracy reduction dramatically to AR(3) = 94.0.
RegNet-Y Y 16GF (Radosavovic al. 2020b): In the second convolutional layer, several of the top 10 highest-magnitudee weights reside in the same kernel. Flipping the sixth highest weight yields AR(6) = 74.2, while also flipping the seventh highest weight (in the same kernel) improves accuracy to AR(T) 66.5, rather than compounding the damage.
C
Vision Models: Sign-Bit vs. Exponent-Bit Flips
While most prior work Section 5 focused on flipping exponent bits, our vision experiments show that sign-bit flips typically cause greater disruption per flip. Table compares the impact of flipping the sign bit versus the most significant exponent bit on representative image models. Exponent-bet bit flips are still effective, as they can sharply alter weight magnitudes, but sign-bit flips are usually the more consistently destructive choice at low budgets vision. This observation should be contrasted with the language-model results below, where exponent-bit attacks can stronger.
Table 8: Sign-bit vs. exponent-bie flips (k 10). AR: accuracy reduction; mAR10: mean AR over 10 flips full precision models.
Model
Sign AR(10) mAR(10)
Exp. AR(10) / mAR(10)
VGG-11
91.8/91.6
53.89/ 34.48
ResNet-18
70.63/38.6
99.9/ 99.8
RosNet-34
56.3/76.3
99.9/92.7
ResNet-50
99.7/52.7
70.94/65, 66.448
MobileNet-VV2
99.85/92.17
99.86/92, /92.0
MobilcNet-V33
99.42/88. 88.37
01.87/70.44
Inception-V3
96.8/52.1
99.9/99.9
RegNetY-16GF
82.87/61,
78.75 48.6
Neticient
95.80 / 77.7
37.38 / 22.53
ViT-B/160224
99.52
82.38/47.5
AlexNet
88.5 43.45
99.8/36.00
C.1 Language Models:
Exponent-Bit Flips
Language models exhibit different pattern than vision models. In the first-five-block setting, single largeled exponent flip already reduces all three reasoning LLMs to 0% accuracy under both DNL and 1P-DNL. Unrestricted targeting remains nearly as destructive, although Qwen3-30B-A3B can require few flips there. Random exponent flips are also often severe: in the same fist-ffie-block setting, single random exponent flip already drops Qwen3- 30B-A3B to 6% accuracy.
The strongest qualitative exponent example we inspected is again Qwen Qwen3-30B- 30B- A3B. A single rank-check exponent flip in model. layers 3. mlpp.. experts 82.88.w. ddwonooroooo.ooopoooooodooppdooe weight already collapses accuracy 0%, introduces one non-finite parameter, and produces obviously corrupled multilingual/ /giiberrih text. The allacked expert is used during prefill, yet the response becomes gibberish inunediately from the first generated lokens onward, even though first several generated tokens do not route through that expert. This supports the same error-compouddig hypothesis raised in the main text: once hidden state has been corrupted, the damage can propagate forward through attention even when the attacked expert is not used every generated token. Over the full inspected example, the attacked expert is still routed on only 4.14% of tokens overall.
In the encoder setting, the effect is again severe, although less uniformly catastrophic than for the reasoning LLMs discussed above. For the AR(10) results, RoBERTa reaches 63.94 on SST-2, 49.99 on QNLI, and 65.32 on MRPC; BERT-base reaches 50.11, 49.03, and 63.97 the tasks; and DistiBBERT reaches 49.04, 46.49, and 62.72, respectively. Across these examples, MRPC appears most vulnerable, while SST-2 and QNLI still exhibit substantial degradation.
22

---

Published in Transactions on Machine Learning Research (03/2026)
One likely reason for the strength of exponent altacks is that they alter the exponent field itself and therefore induce extreme rescaling rather than simple sign inversion. By contrast, a sigu-bil attack leaves the exponent and mantissa untouched and merely negates the stored value. This strong dependence floating-poin format suggests that quantized models may behave differently under exponent attacks, which we leave for futurre work.
D Weight Score Ablation
We evaluate several parameter scoring functions from the pruming literature and compare their effectiveness in identifying high-impact weights for sign-flip attacks. As shown in Figure g measure the mean accuracy reduction mAR1 across 48 ImageNeel models under the following scoring functions:
Magnitude-basedd based: S(0.) [0s].
GraSP: S(O.) = 0 @ Hyl, following the gradient-flow preservation principle Wang et al. (2020) where
Hg is the hessian vector product.
GraSP (Gauss-Newton Approx.): Similar GraSP but approximates the Hessian H with the square of first-order gradients.
SynFlow: ((0.) |g 0z}. akin gradient limes weight.
Optimal Brain Damage (OBD): S(O,) H... (LeCun et al. 1989a).
Hybrid (Ours): As define in Equation 33 with and without second order term.
where g 50, 807
8R H 82R
We observe that certain models are vulnerable to second-order- based scores (e.g.. OBD) even when they prove more resilient pure magnitude-basee attacks. Nevertheless, other architectures appear more robust against OBD GraSP while showing larger drops under magnitude-basee score. Motivated by these mixed results, our hybrid score combines both magnitude and gradient terms. This blend consistently identifies critical weights in where either component alone fails to degrade accuracy. Overall, the hybrid approach delivers the most reliable performance drop across the tested models.
E
Additional Datasets Evaluation
Figures 10 and 12 analyze individual dataset results these three popular classifiers. Each shows steep drop in accuracy with very few sign flips, highlighting the generality of the attack. Notably, although these models differ in architecture and capacity, they all exhibit severe degradation reinforces that our method targets fundamental weaknesses in DNN representations rather than exploiting quirks of specific network or dataset.
detected sign bits flipped. This finding
F 1P-DNL Algorithm
Similar Algorithm Algorithm shows the algorithm of 1P-DNL.
Seed sensitivity. DNL deterministic: for fixed model, layer budget, and flip budget k, selects the same weights and produces the same accuracy reduction every run. For IP-DNL, the only stochasticity is the single random imput used to compute the score. representative subset architectures (ConyNeXt-B, RegNelY-400MFF 50sNet-50, EfficientNet-Ba and ViT-B/16), repeating this step over 10 random seeds yields standard deviation of 0.02 in accuracy reduction, which negligible relative to the induced drops.
G Defenses
More existing defenses
Binarization.
Binary-weight networks Courbariaux et al. (2016) Liu et al. (2020): : Xu et al. (2021): Rozen et al.
(002) are often assumed to be naturally resilient to weight perturban perturbations He et all 2020 Rakin et al. 2021 yet
flipping a sign bit still inverts the weight. We show the results on a binarized ResNet- 18 in Table confirming that binarization alone offers negligible protection
Results reproduced with the RA-BNN recipe Rakin al. 2021
23

---

Published in Transactions on Machine Learning Research (03/2026)
100
80
mAR(10)
40
-20
Magnitude
GraSP score
Grasp score (GN approx)
SynFlow score
OBD score
1P-DNL First Order
1P-DNL
Method
Figure 9: Comparison of m.ARio across different weight score functions for the model parameters applied to
48 ImageNet models.
Algorithm 2 IP-DNL Single-Pass Attack
1: Inputs: Model fo, number of bits to flip k, number of layers
2: X +- random input (e.g., Gaussian noise or random tokens)
3: R(0) + (X)] //e.g, sum of logits
4: g Ro // one backward pass
P parameters in the first layers of for each 0, in Or. do Approx. Hessian diagonal by 8: S(0.) < |0.1 + 0:9: 9: + 07 Ha
Hü [g,]
9: end for
10: Sort 9r in descending order by S(O,)
11: t top-k entries of d
12: For CNNs: enforce most. selected entry per convolutional kernel
13: for each 0, in K. do
14: 0: 0 // flip sign bit
15: end for
16: Output: Modified parameters
Table 9: AR(-) Targeting Binary ResNet-18 with DNL
AR(1)
AR(2)
AR(3)
AR(5)
AR(10)
0.14
12.90
60.71
90.35
96.50
H Selective Defense Against Sign-Flips: Additional Setups
Following Section G to quantify this selective defense, we tested it on 16 particularly vulnerable networks, each
suffering least 50% accuracy reduction (AR(100, 000) 50%) when 100K random parameters flipped. We
24

---

Published in Transactions on Machine Learning Research (03/2026)
Figure 10: AR (%) on DTD dataset Cimpoi et al., 2014) with varying number of sign flips over popular image encoders.
Figure 11: AR (%) on FGVC Aircraft dataset. Maji
et al. 2013 with varying number of sign flips over popular image encoders.
Foctttl
effidertntt resneet0)
Figure 12: AR (%) Food101 dataset [Bssard et al. 2014) with varying number of sign flips over popular image encoders.
Figure 13: AR (%) Stanford Cars dataset (Krause ct al. 2015 with varying number of sign flips over popular image encoders.
this large-scale random flip strong, nou-specific stress test that is not tied to ensuring that the defense remains robust to other score-based sign bit flips. We then varied the fraction of protected sign bits from 1% to 20%, focusing the largest weights in absolute value. As expected, even modest level of protection dramatically reduced the damage inflicted by sign-flip attacks. Moreover, as illustrated in Figure [6 selectively safeguarding this small subset of sign bits mitigates the impact from sign bit flip attacks, as reflected from the stress test proposed above, demonstrating that partial protection of critical parameters offers a practical and effective defense In Appendix G
scoring method,
we show that naive defense mechanisms would have been unsuccessful defending
against sign flips.
addition to selectively protecting the most impactful sign bits, we also tested a baseline defense that shields a randomly chosen subset of bits at different coverage levels. Figure 17 shows that even when 20% of the sign bits are randomly protected, the network remains highly vulnerable under 100k random sign flips. This stands in stark contrast to protecting only small fraction of critical sign bits (e.g., the iigest-magnitude weights), which substantially preserve accuracy, The results underscore that which bits get protected is more important than how many.
Full ImageNet Model Tables
We report the full per-model accuracy reduction (AR) for all 48 ImageNet classifiers evaluated in this work in Tables [0 and [1 These tables complement the aggregate statistics presented in the main text (e.g., Figure 2 by providing detailed, model-level behavior across different flip budgets (1...., 10).
Consistent with the aggregate results, the majority of models exhibit severe degradation under targeted sign-bit flips. In particular, many architectures (e.g., MobileNet, MnasNet, VIT, and VGG families) reach near-complete collapse
25

---

Published in Transactions on Machine Learning Research (03/2026)
100
bafo b2
efn b4
cnst
CaNt small etn, b
regnet.y_x2ge
ConvNeXt
eenn b3
RegNetY
regnet_ 800kv
Mogret
ResNet
90
EfficientNet
VIT
regne J.LAOTT
80
redagt
MICmmall
400ml
m10
70
AR
chet bege
60
50
40
mL52
30
4
5
6
7
8
9
2
8
2
10
100
Model Size (Millions of Parameters)
Figure 14: AR reported across five model families of varying capacities under 1P-DNL attack. The similar vulncrability levels suggest that model size alone does not mitigate sign-flip attacks.
100
ofn b2
efn b3
4ff
vt. base
regnet.y_3ag
ConvNeXt
RegNetY
regiee
y_8gf
ResNet
90
EfficientNet
regnet 16g7
VIT
80
regnet 1efoof
m110
70
regnety spofft
regnetyy y
crut biy
AR
60
cext./o
50
mv50
40
52
30
46n
20
4
5
7
2
10
100
Model Size (Millions of Parameters)
Figure 15: AR reported across five model families of varying capacities under DNL attack.
(AR 100%) with fewer than 5-10 flips. This supports the claim that only a handful of carefully selected parameters are sufficient disrupt modern neural networks.
26

---

Published in Transactions on Machine Learning Research (03/2026)
100
AR(100,000)
60
40
0
Defense
Defending 1%
Defending 5%
Defending 10%
Defending
Figure 16: AR(100, 000) under 100k random sign flips, with selective protection on varying fractions of the most vulnerable parameters (ranked by DNL). Even partial coverage of high-scoring parameters substantially improves robustness.
100
90
80
mAR(100, .000)
60
50
40
Defense
Defending 1%
Defending 5%
Defending 10%
Defending 20%
Figure 17: AR(100, 000) under 100k random sign flips, with random subsets (1%, 5%, 10%, and 20% coverage) of sign bits protected. Unlike Figure 16 where shielding the most vulnerable bits significantly reduces damage, uniform randoi selection offers little resilience, as even 20% coverage barely mitigates the attack.
27

---

Published in Transactions on Machine Learning Research (03/2026)
Model
Base Ace. AR(1)
AR(2)
AR(3)
AR(4)
AR(5)
AR(6)
AR(7)
AR(S)
AR(9)
AR(10)
Avg.
alexnet
56.51
6.2
12.8
13.3
17.0
45.1
50.8
49.9
67.5
83.4
88.5
43.5
convnext base@ff inlk
83.83
0.7
5.3
6.3
12.7
12.5
19.9
20.0
25.0
23.7
28.4
15.5
convnext. largelff inlk
84.29
0.7
0.6
1.1
1.9
4.4
4.5
56.0
59.5
61.1
61.5
25.1
convnext sfall@fb inlk
83.14
5.5
40.7
44.0
46.2
57.9
57.9
59.6
T3.0
76.9
convnext tin inlk
82.06
5.4
23.0
31.6
32.9
38.7
60.7
62.6
60.7
efficientnet bo
77.69
23.0
48.5
52.7
41.6
76.7
93.0
93.0
93.0
94.1
95.8
71.2
efficientnet bl
77.43
5.0
11.1
35.4
48.5
98.1
98.1
98.1
98.0
99.2
99.3
69.1
efficientnet b2
79.54
0.0
0.0
7.3
34.9
51.8
87.3
95.9
96.2
96.9
97.1 56.7
efficientnet b3
81.49
32.9
49.5
47.7
99.7
99.6
99.6
99.3
98.6
98.6
98.6 82.4
efficientnet b4
82.76
0.4
0.5
0.8
1.6
2.0
4.6
8.3
8.6
9.4
97.8 13.4
efficientnet b5
85.89
0.0
0.9
3.7
4.3
4.2
4.4
8.0
22.7
22.2
7.8
efficientnet b6
83.83
30.0
45.0
70.0
92.0
95.0
96.5
97.0
76.2
efficientnet b7
84.4
0.0
0.5
1.5
3.0
5.0
7.0
10.0
15.0
20.0
25.0 8.7
googlenet
69.78
87.3
87.3
85.6
89.6
91.2
95.0
98.0
98.3
98.8
98.8 93.0
inception v3
77.30
1.7
2.0
5.9
21.4
56.9
74.9
81.5
89.2
90.6
96.8 52.1
mnasnetO mnasnetl 0
67.73
97.0
99.7
99.9
99.9
99.9
99.8
99.8
99.9
99.9
99.9 99.6
73.46
51.5
98.6
98.9
99.8
99.9
99.9
99.9
99.9
99.9
99.9 94.8
mobilenet v2
71.89
22.4
99.8
99.8
99.8
99.9
99.9
99.9
99.8
99.8
99.9 92.1
mobilenet v3 large
74.04
23.1
81.3
94.1
95.5
96.8
98.1
98.0
98.3
99.3
99.4 88.4
mobilenet small
67.67
55.7
68.6
99.8
99.8
99.8
99.8
99.8
regnet y 16gf
80.43
3.6
8.5
15.6
35.2
51.3
74.2
73.2
69.5
71.7
82.9 48.6
regnet y 6gf
77.95
21.4
36.1
50.6
43.2
54.2
63.9
67.9
69.7
75.7
78.7 56.1
regnet y 32gf
80.88
3.4
20.6
38.8
39.3
51.5
59.4
78.7
98.4
99.4
99.5 58.9
regnet y 3 2gf
78.94
10.9
16.6
35.2
39.0
52.7
70.4
79.4
81.2
93.1
85.5 56.4
regnet 400mf
74.05
0.8
5.3
28.4
36.7
40.7
44.6
48.8
49.5
46.6
64.1 36.6
regnet 800mf
76.4
16.3
18.7
48.7
54.8
58.8
67.5
68.4
68.6
66.8
65.8 53.5
regnet y 8gf
80.03
12.9
33.6
49.8
51.8
85.1
83.5
83.3
86.4
87.3
91.8 66.6
resnet101
77.37
13.6
20.3
22.3
29.2
52.0
58.0
71.9
72.0
resmet152
78.32
2.1
9.1
10.1
13.7
20.5
20.8
24.7
31.1
32.0
32.4
19.7
resnet18
69.76
10.3
22.3
27.1
41.4
41.9
43.0
40.5
43.3
45.4
70.6 38.6
resnet34
73.31
6.6
9.4
48.1
60.5
69.1
69.7
78.5
83.4
79.6
76.3 58.1
resnet50
80.39
6.7
6.6
23.0
27.0
40.4
40.3
40.2
40.8
41.1
51.9 31.8
shufflenet v2 x0 5
60.55
90.4
99.6
99.6
99.5
99.7
99.7
99.7
99.7
99.7
99.7 98.7
shufflenet v2 x1 squeezenet1
69.36
93.9
99.6
99.6
99.7
99.8
99.5
99.5
99.5
99.5
99.6 99.0
58.10
12.9
18.8
23.3
25.2
37.1
49.3
49.3
53.0
53.2
77.7 40.0
squeezenet efficientnetv2
58.17
10.0
44.3
72.9
72.6
87.2
89.0
92.0
91.6
73.6
85.19
1.7
2.7
5.1
7.6
51.9
49.5
39.0
41.8
34.0
35.7 26.9
tf elficientnetv2 m
84.55
3.0
6.5
11.1
33.2
40.7
63.7
77.3
88.3
90.5
85.9 50.0
tf efficientnetv2
83.14
3.5
7.7
20.7
29.1
52.0
47.7
77.8
77.5
88.8
90.7 49.5
vggl1 1e111a1 bn vgg13 bn
70.38
56.3
91.3
89.5
94.3
94.7
96.9
97.5
98.2
98.8
98.7 91.6
71.59
22.2
62.8
70.9
83.0
83.8
80.6
82.8
85.6
96.7
96.8 76.5
vgg16 bn
73.36
13.0
53.8
58.6
60.1
69.5
76.4
81.7
82.7
88.8
88.9 67.4
vgg19 bn
74.22
14.1
57.8
63.1
72.2
72.2
83.9
89.4
93.0
95.2
97.4
73.8
base patch16 224
84.53
97.2
99.8
99.9
99.8
99.8
99.8
base patch32 224
80.71
45.1
83.4
98.4
97.6
99.7
99.8
99.8
99.8
99.8
99.8
92.3
vit small patch16 224
81.39
63.4
79.5
78.9
77.8
77.7
77.7
78.2
78.4
74.7
65.5
75.2
vit small patch32 224
76.00
71.2
98.8
99.0
99.7
99.6
99.6
99.7
99.7
99.7
99.7
96.7
vit tiny patch16 224
75.46
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
Table Full ImageNet results for the pass-free DNL attack. We report the baseline top-1 accuracy, accuracy roduction AR(k), and the average mAR10. Results are computed with the ono-flip-per-kone per-kernell constraint for convolutional models. While most architectures exhibit rapid collapse, models show gradual degradation, highlighting architectural differences in vulnerability.
28

---

Published in Transactions on Machine Learning Research (03/2026)
Model
Base Acc.
IR(1)
AR(2)
AR(3)
AR(4)
AR(
AR(
AR(7)
AR(8)
AR(9)
AR(10)
Avg.
alexnet
56.52
0.0
0.1
6.2
6.2
12.8
16.5
21.1
21.6
21.6
50.8
15.7
convnext base@ff inlk
83.83
3.3
17.0
6.5
8.3
11.2
22.7
28.2
35.2
39.9
60.8
23.3
convnext large@ff inlk
84.29
39.6
68.5
73.4
49.8
75.3
44.7
90.7
63.2
70.1
99.6
67.5
convnext small&fb inlk
83.15
29.8
40.7
38.8
58.5
52.2
62.8
91.4
98.9
91.9
94.1
65.9
convnext tiny@fb inlk
82.07
24.0
63.2
63.1
93.3
99.9
99.9
99.9
99.9
efficientnet bo efficientnet b1
77.69
17.6
27.7
99.6
99.6
98.8
99.1
99.5
99.9
99.8
99.9 81.2
80.39
1.8
1.8
2.8
4.3
99.1
99.7
12.9
16.4
73.6
66.2 37.9
efficientnet b2
79.30
6.7
99.2
99.5
99.5
99.6
94.0
98.3
99.8
99.7
99.9 89.6
efficientnet b3
81.49
2.1
3.2
6.9
61.9
76.5
46.7
77.9
90.7
83.6
96.6 54.6
efficientuet b4
82.66
2.0
30.3
90.4
40.2
75.7
99.8
99.9
9.2
10.1
99.9 55.7
efficientnet b5
85.89
30.8
2.1
3.5
27.4
6.7
98.5
43.4
99.7
99.6
99.7 51.2
efficientnet b6
83.84
0.9
0.4
47.4
1.4
2.8
51.3
97.6
23.2
98.3
96.7 42.0
efficientnet b7
84.4
1.9
8.3
11.9
25.7
27.0
27.0
googlenet
69.78
41.0
42.9
99.0
94.9
56.1
86.6
94.5
91.0
71.5
93.6 77.1
inception v3
77.30
9.4
55.5
76.1
73.6
92.0
77.4
94.7
66.2
71.0
97.4 71.3
mnasnet()
67.73
99.8
99.7
99.9
99.9
99.9
99.9
99.9
99.9
99.9
99.8 99.8
inasnetl 0
73.46
10.6
69.1
87.0
99.9
99.9
99.9
99.9
99.8
99.8
99.9 86.6
mobilenet v2
71.88
99.8
99.8
99.8
99.9
99.9
99.8
99.9
99.9
99.9
99.9 99.9
mobilenet v3 large
74.04
13.0
99.8
99.8
99.9
99.9
99.9
99.9
99.9
99.8
99.9 91.2
mobilenet v3 small
67.67
99.8
99.8
99.7
99.8
99.8
99.9
99.8
99.9
99.8
99.8 99.8
regnet y 16gf
80.42
3.6
35.1
74.2
73.2
T1.7
82.9
regnet y 6gf
77.95
21.4
36.1
50.6
43.2
54.2
63.9
67.9
69.7
75.7
78.6
regnet y 32gf
80.88
3.4
20.6
38.8
39.3
51.5
59.4
78.7
98.4
99.4
99.5 58.9
regnet y 3 2gf
78.95
10.9
16.6
35.2
39.0
52.7
70.4
79.4
81.3
93.1 1
85.5 56.4
regnet 400mf
74.05
0.8
5.3
28.4
36.7
40.7
70.2
48.8
49.5
60.
64.1 40.5
regnet 800mf
76.42
16.3
18.7
48.7
54.8
58.8
67.5
68.4
92.7
84.8
87.6 59.9
regnet y 8gf
80.03
12.9
33.6
49.8
51.8
85.1
83.5
83.3
86.4
87.3
91.8 66.6
resnet101
77.37
13.6
20.3
22.3
29.2
52.0
54.5
58.0
75.5
74.8
72.0 17.2
r5snet152
78.31
9.1
13.7
25.9
24.7
31.9
resnet18
69.76
10.3
22.3
27.1
41.4
41.9
42.9
40.5
43.3
45.4
70.6 38.6
resnet34
73.32
6.6
9.4
48.1
60.5
69.1
69.7
78.5
83.4
79.6
76.3 58.1
resnet50
80.38
99.4
99.8
99.8
99.7
99.9
99.9
99.9
99.9
99.9
99.9 99.8
shufflenet v2 x0 5
60.55
97.6
99.3
99.7
99.7
99.8
99.7
99.8
99.9
99.8
99.9 99.5
shufflenet v2 x1 squeezenet
69.36
47.6
89.0
99.7
99.5
99.6
99.7
99.8
99.8
99.8
99.8 93.4
58.09
0.1
0.5
22.8
0.9
23.2
23.1
25.5
32.6
29.0
23.6 18.1
squeezenet1
58.18
11.9
10.7
27.6
16.8
51.2
43.5
50.3
68.5
eflicientnet22
5.6
5.9
38.4
42.0
34.1
36.2
17.6
efficientnetv2 tf elficientnety2
84.77
1.2
3.0
28.4
46.1
52.7
64.3
76.9
89.4
89.4
86.0 53.7
83.33
1.5
1.4
6.0
6.2
2.7
8.
9.2
17.4
9.2
12.8 7.5
vgg11 bn vgg13 bn
70.37
56.3
91.3
89.5
94.3
94.7
96.9
97.5
98.2
98.8
98.7 91.6
71.59
22.2
62.8
70.9
83.0
83.8
80.6
82.8
85.6
96.7
96.8 76.5
vgg16 bn
73.36
13.0
53.8
58.6
60.1
69.5
76.4
81.7
82.7
88.8
88.9 67.4
vgg19 bn
74.22
14.1
57.8
63.1
72.2
72.2
83.9
89.4
93.0
95.2
97.4 73.8
base patch16 224
85.10
17.2
29.6
90.7
87.5
99.7
97.3
99.6
base patch32 224
80.71
45.1
83.4
98.4
97.6
99.7
99.8
99.8
99.8
99.8
99.8
92.3
vit small patch16 224
81.39
63.4
79.5
78.9
77.8
77.7
77.7
78.1
78.4
74.7
65.6
75.2
vit small patch32 224
75.99
71.2
98.8
99.0
99.7
99.7
99.6
99.7
99.7
99.7
99.7
96.7
vit tiny patch16 16ch16620 224
75.47
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
99.7
Table 11: Full ImageNet results for the single-pass 1P-DNL attack. Compared the pass-freo variant, incor- porating gradient information from single forward/backwer pass significantly increases attack strength, especially at low flip budgets. Many models reach near-complete collapse with only few bit flips.
29


Reviews:
[{"review_id": "g2Ug8k2Hcc", "reviewer": "Reviewer_CEZm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors introduce Deep Neural Lesion (DNL), a lightweight, data-free adversarial attack that catastrophically disrupts deep neural networks by flipping a minimal number of sign bits in critical parameters. The paper proposes two variants: a \"Pass-free\" method relying solely on weight magnitude heuristics, and a \"1-Pass\" method utilizing a hybrid gradient-magnitude score. The approach is validated across 60 classifiers, including 48 ImageNet models, demonstrating that flipping fewer than ten bits can reduce accuracy to random guessing.", "claims_and_evidence_yn": "Yes", "claims_explanation": "- The authors conduct extensive ablation studies, meticulously analyzing the impact of different scoring functions (comparing magnitude, gradient-based, and hybrid scores), layer selection strategies (early vs. late layers), and the specific efficacy of sign-bit versus exponent-bit flips. \n\n- The experimental scope is impressive, covering 48 distinct ImageNet architectures (including ResNets, EfficientNets, and ViTs) as well as additional datasets like CIFAR and fine-grained classification tasks. \n\n- Crucially, the authors extend their evaluation beyond standard FP32 models to include quantized (INT8) and binarized models, providing robust evidence that this vulnerability is fundamental to the parameter representation and not easily mitigated by standard compression techniques.", "audience_yn": "Yes", "audience_explanation": "This work is highly relevant to the machine learning community, particularly for researchers and practitioners focused on AI safety, hardware security, and edge deployment. As deep learning models are increasingly deployed on mobile and IoT devices where physical access or hardware faults (e.g., Rowhammer attacks) are realistic threats, understanding the extreme fragility of model parameters without the need for training data is a significant insight.", "requested_changes": "- **Clarification on the Novelty of the Hybrid Importance Scoring Function**: While the proposed \"1-Pass\" attack is effective, the underlying Hybrid Importance Scoring Function appears to be a linear combination of well-established pruning metrics—specifically Magnitude Pruning and Taylor Expansion/Hessian-based methods (like OBD/OBS). The authors should explicitly acknowledge the origins of these components in the main text. The review would benefit from a discussion clarifying that the novelty lies in the application of this combination to adversarial attacks rather than the derivation of a new mathematical metric.\n\n- **Theoretical Justification for Heuristics**: A significant portion of the method relies on empirical heuristics, such as the \"One-Flip-Per-Kernel Constraint\" and the specific focus on sign bits. While the paper provides visual evidence (e.g., Figure 3) that a second flip might offset the damage, it lacks a deeper theoretical explanation. Why does this cancellation effect occur consistently across different architectures? Providing a more formal analysis or a broader statistical validation beyond visual examples would strengthen the paper.\n\n- **Evaluation on Broader Tasks**: The current evaluation is heavily concentrated on image classification. To claim a generalized vulnerability in DNNs, it would be beneficial to assess if this fragility holds for other common computer vision tasks, such as Object Detection or Semantic Segmentation. These tasks have different loss landscapes and output structures; verifying if the \"early layer lesion\" hypothesis holds there would significantly increase the paper's impact.\n\n- **Expansion on Defense Mechanisms**: The paper proposes a defense based on protecting the top-k parameters identified by DNL. It would be valuable to expand this into a more formal discussion on defense design. Specifically, is it possible to incorporate this vulnerability into the training process (e.g., via regularization or adversarial training against bit-flips) to make the weights naturally less sensitive, rather than relying solely on post-hoc hardware protection (ECC)? A brief discussion on \"robust training\" against DNL would be a valuable addition.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "YqRpK8vSdq", "reviewer": "Reviewer_N7Um", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a data-free, optimization-free attack that flips a small number of sign bits in neural network weights to cause catastrophic accuracy drops. Operates under an extremely restrictive threat model: no access to training data and no forward/backward passes.", "claims_and_evidence_yn": "No", "claims_explanation": "**Empirical Evidence:** The paper provides extensive experiments on 60 classifiers (including 48 ImageNet models) and multiple datasets. Results consistently show catastrophic accuracy drops (often >99%) with very few sign-bit flips. This strongly supports the core claim that sign-bit flips can severely disrupt DNNs.\n\n\n**Clarity of Evidence:** Figures and tables (e.g., Table 1, Figure 2) illustrate the impact of attacks across architectures. However: Variance or confidence intervals are missing, making robustness unclear. Results are limited to vision tasks; claims of generality across domains (e.g., NLP) are not empirically validated.\n\n**Accuracy of Claims:** The claim that attacks are “feasible in real-world scenarios” is not convincingly supported: The paper lists hardware/software exploits (Rowhammer, DMA, rootkits) but does not quantify success rates or practical constraints. No demonstration of actual attack implementation under realistic conditions.\n\n**Theoretical Justification:** The Taylor expansion argument for magnitude-based selection is plausible but relies on strong assumptions (diagonal Hessian, constant curvature) without empirical validation. The Lipschitz-based reasoning for early-layer vulnerability is asserted but not rigorously proven.\n\n**Defense Claims:** The proposed selective defense shows promising results in controlled experiments, but scalability and cost trade-offs are not analyzed.", "audience_yn": "Yes", "audience_explanation": "**Security and Robustness Researchers:** The paper exposes a critical vulnerability in neural networks that can be exploited without data or optimization, which is highly relevant for those studying adversarial robustness and model security.\n\n**Systems and Deployment Engineers:** Lightweight attacks that require minimal computation and no data are concerning for real-world deployments (e.g., autonomous driving, medical AI), making this work important for practitioners.\n\n**Model Compression and Pruning Community:** The connection between sign-bit flips and pruning heuristics (magnitude-based selection, Hessian approximations) may interest researchers working on network sparsity and weight importance.\n\n**Defense Strategy Designers:** The proposed selective protection mechanism offers insights into efficient defenses, which is valuable for those designing robust architectures.\n\nHowever, I feel the proposed work is not very novel.", "requested_changes": "**Clarify Practical Feasibility**\n1. Provide quantitative analysis or experimental evidence showing that precise sign-bit flips are achievable under realistic hardware/software attack scenarios.\n2. Discuss limitations of Rowhammer, DMA, and firmware exploits in targeting specific bits in large models.\n\n\n\n**Strengthen Theoretical Justification**\n1. Validate assumptions behind the Taylor expansion (diagonal Hessian, constant curvature) with empirical evidence.\n2. Quantify the Lipschitz-based amplification argument for early-layer vulnerability rather than relying on analogy.\n\n\n**Broaden Evaluation Scope**\n1. Include experiments on non-vision tasks (e.g., NLP, speech) to support claims of generality.\n2. Report variance or confidence intervals for accuracy reduction to demonstrate robustness across trials.", "broader_impact_concerns": "NA", "additional_comments": "Overall, I think the contribution of this paper is not novel enought over existing works on neural network compression - an active research area back to 2015.", "extra_scores": {}, "extra_text": {}}, {"review_id": "L542wm7EpA", "reviewer": "Reviewer_Jwin", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper identifies a vulnerability in deep neural networks at the parameter bit level, named Deep Neural Lesion (DNL). Specifically, DNL shows that flipping the sign bit of a very small number of FP32 weights can cause catastrophic degradation in model performance. The proposed DNL attack is data-free, optimization-free, and pass-free. The paper further introduces 1P-DNL, a stronger variant that allows a single forward and backward pass using random inputs to enhance impact. Extensive experiments on 60 classifiers demonstrate that even one or two sign-bit flips can significantly reduce accuracy.\n\nStrengths:\n1. The proposed DNL attack is a critical threat to deep neural networks. The attack is conceptually simple, computationally cheap, and easy to implement.\n2. The visualization (e.g., Fig. 1) is good. These visualizations clearly show how the DNL attack affected the model’s performance on vision tasks.\n3. Empirical results show the DNL attack is effective and these results are consistent across multiple architectures and datasets.\n4. The paper is well written and well organized.\n\nWeaknesses:\n1. Experiments are limited to vision classification models.\n2. The computation of the hybrid importance score is computational expensive and relies on specific approximations.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The central claim that a tiny number of sign-bit flips can catastrophically degrade accuracy, is demonstrated through empirical results in Table 1. Furthermore, the effectiveness of the proposed DNL attack is demonstrated by the comparison with other attack strategies such as random bit flips in Figure 2.", "audience_yn": "Yes", "audience_explanation": "The paper is highly relevant to researchers interested in robustness and security of deep neural networks. The simplicity and severity of the proposed DNL attack make the findings noteworthy for a broad ML community.", "requested_changes": "Critical:\n1. Include more non-vision models (e.g., a Transformer or NLP task) to test whether the vulnerability generalizes across diverse model architectures and tasks.\n2. Include additional experiments comparing with other model pruning strategies, and discuss the differences in parameter selection between the DNL attack and model pruning tasks.\n\nNon-critical:\n3. The practical attack feasibility is discussed largely at a conceptual level (e.g., references to DMA). It could be better to show quantitative evidence of attack success rates in real deployment settings.", "broader_impact_concerns": "The simplicity and low implementation cost of the proposed attacks significantly lower the barrier for malicious misuse. While the paper includes potential defense strategies, a comprehensive discussion of plausible misuse cases would help readers better understand the ethical implications of the work.", "additional_comments": "Overall, this is a well-written and insightful paper that exposes an important and critical vulnerability in deep neural networks. While additional experimental validation would further strengthen the claims, the core insight that model accuracy can hinge on only a handful of sign bits is  likely to stimulate future research on secure model deployment.", "extra_scores": {}, "extra_text": {}}, {"review_id": "56x7sepUa6", "reviewer": "Reviewer_zVfB", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a novel adversarial attack method termed Deep Neural Lesion (DNL), in which flipping a small number of sign‑bits in a trained neural network’s parameters causes catastrophic performance degradation. The attack is data‑free and requires no optimization or access to training or inference data. As long as the attacker obtains the model parameters, they can destroy the model’s functionality by flipping only a few sign bits. The authors also propose corresponding defense mechanisms to mitigate this vulnerability.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes. I believe the submission provides strong and convincing evidence for its core claim under the narrow, evaluated regime: namely, that floating‑point classification models can be catastrophically disrupted by flipping just a few sign bits. The methodology is well-explained and experiments support the claim clearly. However, the evidence is not sufficient to support broader claims about general neural‑network vulnerability: the lack of evaluation across tasks, architectures, and quantized models. For these broader claims to be convincing, the authors would need additional experiments and deeper analysis.", "audience_yn": "Yes", "audience_explanation": "Yes. The work exposes a concrete, under‑explored vulnerability, and its findings have the potential to influence how researchers think about model robustness and deployment safety.", "requested_changes": "1. Although the authors evaluate the proposed method on a variety of network architectures (e.g., ResNet, ViT, CNN), the evaluation is restricted to classification tasks. There is a lack of experiments on other tasks such as detection, segmentation, or generation. I recommend extending the evaluation to more tasks.\n2. Some of the baseline comparison methods appear outdated. The authors should add comparisons with more recent methods.\n3. In modern practice many models use transformer-based backbones beyond ViT (e.g., architectures such as Swin‑Transformer). The authors only discuss ViT; it would strengthen the paper to include results on whether DNL is effective on such representative alternative architectures.\n4. The authors should more thoroughly analyze DNL’s limitations.\n5. All experiments appear to use 32-bit floating‑point weights. Yet, many deployed models use weight quantization. The authors should discuss whether the proposed method works on quantized models (e.g., INT8 or other reduced-precision formats).", "broader_impact_concerns": "None ethical concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)