DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks
Fuente:
arXiv
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911898193100800 |
|---|---|
| author | Velčický, Patrik Breier, Jakub Kovačević, Mladen Hou, Xiaolu |
| author_facet | Velčický, Patrik Breier, Jakub Kovačević, Mladen Hou, Xiaolu |
| contents | Fault injection attacks are a potent threat against embedded implementations of neural network models. Several attack vectors have been proposed, such as misclassification, model extraction, and trojan/backdoor planting. Most of these attacks work by flipping bits in the memory where quantized model parameters are stored.
In this paper, we introduce an encoding-based protection method against bit-flip attacks on neural networks, titled DeepNcode. We experimentally evaluate our proposal with several publicly available models and datasets, by using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results show an increase in protection margin of up to $7.6\times$ for $4-$bit and $12.4\times$ for $8-$bit quantized networks. Memory overheads start at $50\%$ of the original network size, while the time overheads are negligible. Moreover, DeepNcode does not require retraining and does not change the original accuracy of the model. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2405_13891 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks Velčický, Patrik Breier, Jakub Kovačević, Mladen Hou, Xiaolu Cryptography and Security Artificial Intelligence Fault injection attacks are a potent threat against embedded implementations of neural network models. Several attack vectors have been proposed, such as misclassification, model extraction, and trojan/backdoor planting. Most of these attacks work by flipping bits in the memory where quantized model parameters are stored. In this paper, we introduce an encoding-based protection method against bit-flip attacks on neural networks, titled DeepNcode. We experimentally evaluate our proposal with several publicly available models and datasets, by using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results show an increase in protection margin of up to $7.6\times$ for $4-$bit and $12.4\times$ for $8-$bit quantized networks. Memory overheads start at $50\%$ of the original network size, while the time overheads are negligible. Moreover, DeepNcode does not require retraining and does not change the original accuracy of the model. |
| title | DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2405.13891 |