Bit-flip attacks (BFAs) pose a serious threat to deep neural networks (DNNs) deployed in edge environments, where limited physical protection and constrained resources expose model weights to hardware fault injections. By flipping only a small number of carefully selected bits, an adversary can severely degrade model accuracy or even induce targeted misbehavior. Existing defenses typically follow one of two paradigms: increasing the attack cost through robustness enhancement or attempting post-attack recovery through redundancy or weight reconstruction. However, these approaches either lack recovery capability or incur prohibitive overhead for resource-constrained edge devices. In this paper, we propose BFA-Shield, a resilient and collaborative defense framework that integrates pre-deployment robustness enhancement with lightweight runtime detection and exact post-attack recovery. The key insight of BFA-Shield is that binary weight determinism enables efficient anomaly localization and precise bit-level recovery, which is fundamentally difficult to achieve in multi-bit quantized models. Specifically, we adopt robustness-enhanced binary neural network training to reduce the attack surface, employ checksum-based runtime monitoring to detect and localize bit flips, and perform direct bit correction without retraining or model reloading. We evaluate BFA-Shield against both random and gradient-guided bit-flip attacks on ResNet and VGG architectures using the CIFAR-10 and ImageNet datasets. Experimental results demonstrate that BFA-Shield substantially increases the attack difficulty while maintaining low storage and runtime overhead. Compared with the INT8 model, BFA-Shield significantly reduces model storage requirements while preserving high post-attack accuracy, making it a practical and effective defense solution for edge-deployed DNNs.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

BFA-Shield: A Resilient Collaborative Defense Framework for DNNs Against Bit-Flip Attacks

  • Jianing Wang,
  • Xue Tian,
  • Hongxia Ma,
  • Jing Yu,
  • Chi Chen

摘要

Bit-flip attacks (BFAs) pose a serious threat to deep neural networks (DNNs) deployed in edge environments, where limited physical protection and constrained resources expose model weights to hardware fault injections. By flipping only a small number of carefully selected bits, an adversary can severely degrade model accuracy or even induce targeted misbehavior. Existing defenses typically follow one of two paradigms: increasing the attack cost through robustness enhancement or attempting post-attack recovery through redundancy or weight reconstruction. However, these approaches either lack recovery capability or incur prohibitive overhead for resource-constrained edge devices. In this paper, we propose BFA-Shield, a resilient and collaborative defense framework that integrates pre-deployment robustness enhancement with lightweight runtime detection and exact post-attack recovery. The key insight of BFA-Shield is that binary weight determinism enables efficient anomaly localization and precise bit-level recovery, which is fundamentally difficult to achieve in multi-bit quantized models. Specifically, we adopt robustness-enhanced binary neural network training to reduce the attack surface, employ checksum-based runtime monitoring to detect and localize bit flips, and perform direct bit correction without retraining or model reloading. We evaluate BFA-Shield against both random and gradient-guided bit-flip attacks on ResNet and VGG architectures using the CIFAR-10 and ImageNet datasets. Experimental results demonstrate that BFA-Shield substantially increases the attack difficulty while maintaining low storage and runtime overhead. Compared with the INT8 model, BFA-Shield significantly reduces model storage requirements while preserving high post-attack accuracy, making it a practical and effective defense solution for edge-deployed DNNs.