A Semi Black-Box Adversarial Bit-Flip Attack with Limited DNN Model Information
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866913609656827904 |
|---|---|
| author | Ghavami, Behnam Sadati, Mani Shahidzadeh, Mohammad Shannon, Lesley Wilton, Steve |
| author_facet | Ghavami, Behnam Sadati, Mani Shahidzadeh, Mohammad Shannon, Lesley Wilton, Steve |
| contents | Despite the rising prevalence of deep neural networks (DNNs) in cyber-physical systems, their vulnerability to adversarial bit-flip attacks (BFAs) is a noteworthy concern. This paper proposes B3FA, a semi-black-box BFA-based parameter attack on DNNs, assuming the adversary has limited knowledge about the model. We consider practical scenarios often feature a more restricted threat model for real-world systems, contrasting with the typical BFA models that presuppose the adversary's full access to a network's inputs and parameters. The introduced bit-flip approach utilizes a magnitude-based ranking method and a statistical re-construction technique to identify the vulnerable bits. We demonstrate the effectiveness of B3FA on several DNN models in a semi-black-box setting. For example, B3FA could drop the accuracy of a MobileNetV2 from 69.84% to 9% with only 20 bit-flips in a real-world setting. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2412_09450 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | A Semi Black-Box Adversarial Bit-Flip Attack with Limited DNN Model Information Ghavami, Behnam Sadati, Mani Shahidzadeh, Mohammad Shannon, Lesley Wilton, Steve Cryptography and Security Despite the rising prevalence of deep neural networks (DNNs) in cyber-physical systems, their vulnerability to adversarial bit-flip attacks (BFAs) is a noteworthy concern. This paper proposes B3FA, a semi-black-box BFA-based parameter attack on DNNs, assuming the adversary has limited knowledge about the model. We consider practical scenarios often feature a more restricted threat model for real-world systems, contrasting with the typical BFA models that presuppose the adversary's full access to a network's inputs and parameters. The introduced bit-flip approach utilizes a magnitude-based ranking method and a statistical re-construction technique to identify the vulnerable bits. We demonstrate the effectiveness of B3FA on several DNN models in a semi-black-box setting. For example, B3FA could drop the accuracy of a MobileNetV2 from 69.84% to 9% with only 20 bit-flips in a real-world setting. |
| title | A Semi Black-Box Adversarial Bit-Flip Attack with Limited DNN Model Information |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2412.09450 |