Collaborative Research: SaTC: CORE: Small: Understanding and Taming Deterministic Model Bit Flip attacks in Deep Neural Networks

深度神经网络(DNN)被广泛应用于各种决策任务，如访问控制、医疗诊断和自动驾驶。DNN模型的漏洞会严重扰乱推理行为，导致安全和安全敏感应用程序的灾难性后果。虽然已经做出了大量的努力来保护DNN免受外部对手(例如对抗性示例)的攻击，但通过利用硬件威胁(即故障注入攻击)来篡改DNN模型完整性的内部对手可能会引起前所未有的担忧。该项目旨在对基于硬件的故障攻击导致的DNN安全问题提供见解，并探索如何提高未来深度学习系统针对此类内部对手的健壮性和安全性。该项目针对一个关键的研究课题，即保护深度学习系统免受基于硬件的模型篡改。硬件故障攻击(例如Rowhammer)的最新进展可以确定地向DNN模型注入故障，导致包括模型权重在内的关键DNN参数中的比特翻转。这种威胁可能是极其危险的，因为它们可能会使对手在推断阶段恶意操纵预测结果。该项目旨在系统地了解DNN模型比特翻转攻击在实际系统中的实用性和严重性，并研究软件/体系结构级别的保护技术，以保护DNN免受内部篡改。研究的重点是量化DNN，它对模型篡改表现出更高的鲁棒性。本项目将包括以下研究工作：(1)研究量化DNN对不同攻击目标下模型权值确定性比特翻转的脆弱性；(2)探索增强量化DNN模型内在稳健性的算法途径；(3)设计有效的系统和体系结构层防御机制，全面抵御DNN模型比特翻转攻击。该项目将导致向更广泛的硬件安全和人工智能安全社区传播共享数据、攻击文物、算法和工具。该奖项反映了NSF的法定使命，并已通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Deep neural network (DNN) is widely deployed for a variety of decision-making tasks such as access control, medical diagnostics, and autonomous driving. Compromise of DNN models can severely disrupt inference behavior, leading to catastrophic outcomes for security and safety-sensitive applications. While a tremendous amount of efforts have been made to secure DNNs against external adversaries (e.g., adversarial examples), internal adversaries that tamper DNN model integrity through exploiting hardware threats (i.e., fault injection attacks) can raise unprecedented concerns. This project aims to offer insights into DNN security issues due to hardware-based fault attacks, and explore ways to promote the robustness and security of future deep learning system against such internal adversaries. This project targets one critical research topic, namely securing deep learning systems against hardware-based model tampering. Recent advances in hardware fault attacks (e.g., rowhammer) can deterministically inject faults to DNN models, causing bit flips in key DNN parameters including model weights. Such threats can be extremely dangerous as they could potentially enable malicious manipulation of prediction outcomes in the inference stage by the adversary. The project seeks to systematically understand the practicality and severity of DNN model bit flip attacks in real systems and investigate software/architecture level protection techniques to secure DNNs against internal tampering. The study focuses on quantized DNNs which exhibit higher robustness against model tampering. This project will incorporate the following research efforts: (1) Investigate the vulnerability of quantized DNNs to deterministic bit flipping of model weights concerning various attack objectives; (2) Explore algorithmic approaches to enhance the intrinsic robustness of quantized DNN models; (3) Design effective and efficient system and architecture level defense mechanisms to comprehensively defeat DNN model bit flip attacks. This project will result in the dissemination of shared data, attack artifacts, algorithms and tools to the broader hardware security and AI security community.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.