Collaborative Research: SaTC: CORE: Small: Understanding and Taming Deterministic Model Bit Flip attacks in Deep Neural Networks

深度神经网络（DNN）被广泛部署用于各种决策任务，如访问控制、医疗诊断和自动驾驶。DNN模型的妥协可能会严重破坏推理行为，导致安全和安全敏感应用程序的灾难性后果。虽然已经做出了大量的努力来保护DNN免受外部对手（例如，对抗性示例），通过利用硬件威胁来篡改DNN模型完整性的内部对手（即，故障注入攻击）可能引起前所未有的关注。该项目旨在深入研究基于硬件的故障攻击导致的DNN安全问题，并探索如何提高未来深度学习系统的鲁棒性和安全性，以抵御此类内部攻击。 该项目针对一个关键的研究课题，即保护深度学习系统免受基于硬件的模型篡改。硬件故障攻击的最新进展（例如，Rowhammer）可以确定性地将故障注入DNN模型，导致包括模型权重在内的关键DNN参数的位翻转。这种威胁可能是极其危险的，因为它们可能使对手在推理阶段恶意操纵预测结果。该项目旨在系统地了解DNN模型位翻转攻击在真实的系统中的实用性和严重性，并研究软件/架构级保护技术，以保护DNN免受内部篡改。该研究的重点是量化DNN，表现出更高的鲁棒性对模型篡改。该项目将包括以下研究工作：（1）调查量化DNN对涉及各种攻击目标的模型权重的确定性位翻转的脆弱性;（2）探索增强量化DNN模型内在鲁棒性的算法方法;（3）设计有效和高效的系统和架构级防御机制，以全面击败DNN模型位翻转攻击。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Deep neural network (DNN) is widely deployed for a variety of decision-making tasks such as access control, medical diagnostics, and autonomous driving. Compromise of DNN models can severely disrupt inference behavior, leading to catastrophic outcomes for security and safety-sensitive applications. While a tremendous amount of efforts have been made to secure DNNs against external adversaries (e.g., adversarial examples), internal adversaries that tamper DNN model integrity through exploiting hardware threats (i.e., fault injection attacks) can raise unprecedented concerns. This project aims to offer insights into DNN security issues due to hardware-based fault attacks, and explore ways to promote the robustness and security of future deep learning system against such internal adversaries. This project targets one critical research topic, namely securing deep learning systems against hardware-based model tampering. Recent advances in hardware fault attacks (e.g., rowhammer) can deterministically inject faults to DNN models, causing bit flips in key DNN parameters including model weights. Such threats can be extremely dangerous as they could potentially enable malicious manipulation of prediction outcomes in the inference stage by the adversary. The project seeks to systematically understand the practicality and severity of DNN model bit flip attacks in real systems and investigate software/architecture level protection techniques to secure DNNs against internal tampering. The study focuses on quantized DNNs which exhibit higher robustness against model tampering. This project will incorporate the following research efforts: (1) Investigate the vulnerability of quantized DNNs to deterministic bit flipping of model weights concerning various attack objectives; (2) Explore algorithmic approaches to enhance the intrinsic robustness of quantized DNN models; (3) Design effective and efficient system and architecture level defense mechanisms to comprehensively defeat DNN model bit flip attacks. This project will result in the dissemination of shared data, attack artifacts, algorithms and tools to the broader hardware security and AI security community.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.