Collaborative Research: SaTC: CORE: Small: Understanding and Taming Deterministic Model Bit Flip attacks in Deep Neural Networks

深度神经网络（Deep neural network， DNN）被广泛应用于各种决策任务，如访问控制、医疗诊断和自动驾驶。DNN模型的破坏会严重破坏推理行为，导致安全和安全敏感应用的灾难性后果。虽然已经做出了大量的努力来保护DNN免受外部对手（例如，对抗性示例）的攻击，但通过利用硬件威胁（例如，故障注入攻击）篡改DNN模型完整性的内部对手可能会引起前所未有的关注。该项目旨在深入了解基于硬件的故障攻击导致的深度神经网络安全问题，并探索如何提高未来深度学习系统对此类内部对手的鲁棒性和安全性。该项目针对一个关键的研究课题，即保护深度学习系统免受基于硬件的模型篡改。硬件故障攻击（如rowhammer）的最新进展可以确定性地将故障注入DNN模型，导致包括模型权重在内的关键DNN参数的位翻转。这种威胁可能非常危险，因为它们可能使攻击者在推理阶段恶意操纵预测结果。该项目旨在系统地了解真实系统中DNN模型位翻转攻击的实用性和严重性，并研究软件/架构级保护技术，以确保DNN免受内部篡改。研究的重点是量化dnn，它对模型篡改具有更高的鲁棒性。本项目将包括以下研究工作：(1)研究量化dnn对各种攻击目标的模型权重的确定性位翻转的脆弱性；(2)探索增强量化DNN模型内在鲁棒性的算法方法；(3)设计有效、高效的系统和架构级防御机制，全面挫败DNN模型位翻转攻击。该项目将导致共享数据、攻击工件、算法和工具向更广泛的硬件安全和人工智能安全社区传播。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Deep neural network (DNN) is widely deployed for a variety of decision-making tasks such as access control, medical diagnostics, and autonomous driving. Compromise of DNN models can severely disrupt inference behavior, leading to catastrophic outcomes for security and safety-sensitive applications. While a tremendous amount of efforts have been made to secure DNNs against external adversaries (e.g., adversarial examples), internal adversaries that tamper DNN model integrity through exploiting hardware threats (i.e., fault injection attacks) can raise unprecedented concerns. This project aims to offer insights into DNN security issues due to hardware-based fault attacks, and explore ways to promote the robustness and security of future deep learning system against such internal adversaries. This project targets one critical research topic, namely securing deep learning systems against hardware-based model tampering. Recent advances in hardware fault attacks (e.g., rowhammer) can deterministically inject faults to DNN models, causing bit flips in key DNN parameters including model weights. Such threats can be extremely dangerous as they could potentially enable malicious manipulation of prediction outcomes in the inference stage by the adversary. The project seeks to systematically understand the practicality and severity of DNN model bit flip attacks in real systems and investigate software/architecture level protection techniques to secure DNNs against internal tampering. The study focuses on quantized DNNs which exhibit higher robustness against model tampering. This project will incorporate the following research efforts: (1) Investigate the vulnerability of quantized DNNs to deterministic bit flipping of model weights concerning various attack objectives; (2) Explore algorithmic approaches to enhance the intrinsic robustness of quantized DNN models; (3) Design effective and efficient system and architecture level defense mechanisms to comprehensively defeat DNN model bit flip attacks. This project will result in the dissemination of shared data, attack artifacts, algorithms and tools to the broader hardware security and AI security community.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.