T-BFA: Targeted Bit-Flip Adversarial Weight Attack
T-BFA: Targeted Bit-Flip Adversarial Weight Attack
复制标题
DOI：
10.1109/tpami.2021.3112932
复制
发表时间：
2020-07
影响因子：
23.6
通讯作者：
A. S. Rakin;Zhezhi He;Jingtao Li;Fan Yao;C. Chakrabarti;Deliang Fan
中科院分区：
文献类型：
--
作者：
A. S. Rakin;Zhezhi He;Jingtao Li;Fan Yao;C. Chakrabarti;Deliang Fan
传统的深度神经网络(DNN)安全大多与著名的对抗性输入示例攻击有关。最近，对抗性攻击的另一个维度，即对DNN权重参数的攻击，被证明是非常强大的。其中，基于比特翻转的对抗性权重攻击(BFA)通过在权重参数中注入极少量的错误来劫持正在执行的DNN函数。BFA以前的工作集中在无目标攻击上，该攻击可以通过翻转存储在计算机存储器中的极少量的加权比特来将所有输入黑客攻击到随机输出类中。本文首次提出了基于目标BFA的对抗性权重攻击(T-BFA)，该攻击可以故意将选定的输入误导到目标输出类。该目的是通过分类相关的脆弱加权比特搜索算法来识别与目标输出的分类高度相关的加权比特来实现的。我们提出的T-BFA算法的性能在多种DNN结构上都得到了成功的验证。例如，只需在ResNet-18的8800万个权重比特中翻转27个，我们的T-BFA就可以在ImageNet数据集中将所有来自Hen类的图像错误分类为Goose类(即100%的攻击成功率)，同时保持59.35%的验证准确率。此外，我们在一个运行DNN计算的真实计算机原型系统上成功地演示了我们的T-BFA攻击，该系统使用基于Ivy Bridge的Inteli7 CPU和8 GB DDR3内存。
Traditional Deep Neural Network (DNN) security is mostly related to the well-known adversarial input example attack. Recently, another dimension of adversarial attack, namely, attack on DNN weight parameters, has been shown to be very powerful. As a representative one, the Bit-Flip-based adversarial weight Attack (BFA) injects an extremely small amount of faults into weight parameters to hijack the executing DNN function. Prior works of BFA focus on un-targeted attack that can hack all inputs into a random output class by flipping a very small number of weight bits stored in computer memory. This paper proposes the first work of targeted BFA based (T-BFA) adversarial weight attack on DNNs, which can intentionally mislead selected inputs to a target output class. The objective is achieved by identifying the weight bits that are highly associated with classification of a targeted output through a class-dependent vulnerable weight bit searching algorithm. Our proposed T-BFA performance is successfully demonstrated on multiple DNN architectures for image classification tasks. For example, by merely flipping 27 out of 88 million weight bits of ResNet-18, our T-BFA can misclassify all the images from ’Hen’ class into ’Goose’ class (i.e., 100% attack success rate) in ImageNet dataset, while maintaining 59.35% validation accuracy. Moreover, we successfully demonstrate our T-BFA attack in a real computer prototype system running DNN computation, with Ivy Bridge-based Intel i7 CPU and 8GB DDR3 memory.