A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networks

Abstract

Deep neural network models are massively deployed on a wide variety of hardware platforms. This results in the appearance of new attack vectors that significantly extend the standard attack surface, extensively studied by the adversarial machine learning community. One of the first attack that aims at drastically dropping the performance of a model, by targeting its parameters (weights) stored in memory, is the Bit-Flip Attack (BFA). In this work, we point out several evaluation challenges related to the BFA. First of all, the lack of an adversary's budget in the standard threat model is problematic, especially when dealing with physical attacks. Moreover, since the BFA presents critical variability, we discuss the influence of some training parameters and the importance of the model architecture. This work is the first to present the impact of the BFA against fully-connected architectures that present different behaviors compared to convolutional neural networks. These results highlight the importance of defining robust and sound evaluation methodologies to properly evaluate the dangers of parameterbased attacks as well as measure the real level of robustness offered by a defense.

A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters

“…When dealing with parameter extraction, a usual assumption is that the adversary knows A M . This is the case for cryptanalysis-like approaches [2,7], active learning techniques [16,19] and recent efforts relying on physical attacks such as side-channel (SCA) [1,8] or fault injection (FIA) [18,6] analysis. Interestingly, whatever the adversarial goal, victim model architecture is a crucial information: it is compulsory for fidelity scenarios, and its knowledge significantly strengthen attacker's abilities to succeed in task-performance ones [15].…”