Versatile Weight Attack via Flipping Limited Bits.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning Security

Background:

• Deep neural networks are vulnerable to various attacks like backdoor and adversarial attacks.
• Existing attacks primarily target the training or inference stages.
• A gap exists in understanding and mitigating attacks during the model deployment stage.

Purpose of the Study:

• To introduce and formalize a novel bit-flip based weight attack paradigm.
• To develop flexible formulations for different attack objectives (effectiveness, stealthiness, bit-flip constraints).
• To present specific attack strategies: Single Sample Attack (SSA) and Triggered Samples Attack (TSA).

Main Methods:

• Proposed a general formulation for bit-flip weight attacks with effectiveness and stealthiness goals.
• Developed SSA as a binary optimization problem.
• Developed TSA as a mixed integer programming (MIP) problem with a learnable trigger.
• Reformulated MIP problems into continuous optimization using advanced integer programming techniques.
• Applied the Alternating Direction Method of Multipliers (ADMM) for efficient solution approximation.

Main Results:

• Demonstrated the effectiveness of the proposed bit-flip weight attack methods through extensive experiments.
• Showcased the superiority of the developed attack strategies over existing paradigms.
• Validated the flexibility and efficiency of the ADMM-based solution approach.

Conclusions:

• The bit-flip based weight attack is a viable and potent threat during model deployment.
• The proposed flexible formulation and ADMM-based optimization effectively address SSA and TSA.
• This research highlights the need for enhanced security measures against deployment-stage attacks on deep neural networks.