CritiFlip: an efficient bit-flip attack based on critical weight identification

Engineering notes

Key topics: autonomous driving. See the paper for implementation details and experimental results.

Chinese explanation / 中文解读

中文解读待补充：本站会优先为端到端自动驾驶、BEV感知、3D目标检测、轨迹预测、路径规划、LiDAR感知等高价值论文补充中文说明。

Original abstract

Abstract Recent studies have demonstrated that deep neural networks (DNNs) are highly vulnerable to bit-flip attacks (BFAs), where modifying only a few bits in memory can severely degrade model performance. However, existing BFA techniques typically rely on exhaustive searches over the entire parameter space and overemphasize single-bit flipping capability, leading to limited effectiveness in the presence of modern defenses. To address this challenge, we propose CritiFlip, an efficient BFA framework based on critical-weight identification. CritiFlip locates critical parameters through gradient computation and random perturbation, and performs targeted bit flips on them. By constraining the search to less than 0.1% of the total parameters, the framework greatly improves attack efficiency without compromising destructive power. Furthermore, we demonstrate that multi-bit flipping per iteration yields stronger degradation than single-bit strategies, especially when attacking defense-hardened models enhanced with weight reconstruction. Extensive experiments on multiple architectures and datasets confirm that CritiFlip maintains high attack potency with drastically reduced computation, even against hardened quantized models. These results indicate that exploiting non-uniform parameter sensitivity can provide a practical and effective avenue for evaluating and strengthening DNN robustness at the hardware level.

Links and sources

• PDF from original source

Comments