Improving Robustness Against Stealthy Weight Bit-Flip Attacks by Output Code Matching
- Resource Type
- Conference
- Authors
- Ozdenizci, Ozan; Legenstein, Robert
- Source
- 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) CVPR Computer Vision and Pattern Recognition (CVPR), 2022 IEEE/CVF Conference on. :13378-13387 Jun, 2022
- Subject
- Computing and Processing
Deep learning
Codes
Quantization (signal)
Impedance matching
Computational modeling
Computer architecture
Benchmark testing
Adversarial attack and defense; Deep learning architectures and techniques
- Language
- ISSN
- 2575-7075
Deep neural networks (DNNs) have been shown to be vulnerable against adversarial weight bit-flip attacks through hardware-induced fault-injection methods on the memory systems where network parameters are stored. Recent attacks pose the further concerning threat of finding minimal targeted and stealthy weight bit-flips that preserve expected behavior for untargeted test samples. This renders the attack undetectable from a DNN operation perspective. We propose a DNN defense mechanism to improve robustness in such realistic stealthy weight bit-flip attack scenarios. Our output code matching networks use an output coding scheme where the usual one-hot encoding of classes is replaced by partially overlapping bit strings. We show that this encoding significantly reduces attack stealthiness. Importantly, our approach is compatible with existing defenses and DNN architectures. It can be efficiently implemented on pre-trained models by simply re-defining the output classification layer and finetuning. Experimental benchmark evaluations show that output code matching is superior to existing regularized weight quantization based defenses, and an effective defense against stealthy weight bit-flip attacks.