Recent studies have extensively investigated gradient-based and random bit-flip attacks (BFAs) on quantized neural network weights, along with corresponding defense mechanisms. However, defenses for protecting 32-bit full-precision deep neural networks (DNNs) remain under-explored, despite their widespread use and heightened vulnerability. To address this gap, we propose a runtime defense mechanism based on parameter clipping, which dynamically identifies and mitigates the impact of BFAs through anomaly detection. By analyzing the anomalous distribution of parameters and gradients induced by attacks, our method leverages Median Absolute Deviation (MAD) to detect outliers and applies a two-step rectification: clipping the most significant outliers to zero and processing neighboring parameters using local statistics. Experimental results show that our approach significantly mitigates gradient-based and random BFAs on three DNN models (a self-constructed model, ResNet-20, ResNet-18) and three popular datasets (MNIST, CIFAR-10, ImageNet), achieving test accuracies up to 95.59% on MNIST, 81.18% on CIFAR-10, and 62.88% on ImageNet under bit-flip attacks (BFAs). Compared to state-of-the-art methods, our approach achieves an average improvement of 28.90% on MNIST, 42.76% on CIFAR-10, and 32.48% on ImageNet following BFA attacks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Anomaly-Driven Defense: Mitigating Bit-Flip Attacks in Deep Neural Networks via Runtime Parameter Clipping

  • Kaiyan Wen,
  • Xinyu Wang,
  • Jiale Zhao,
  • Fanjin Xu,
  • Yaohua Wang

摘要

Recent studies have extensively investigated gradient-based and random bit-flip attacks (BFAs) on quantized neural network weights, along with corresponding defense mechanisms. However, defenses for protecting 32-bit full-precision deep neural networks (DNNs) remain under-explored, despite their widespread use and heightened vulnerability. To address this gap, we propose a runtime defense mechanism based on parameter clipping, which dynamically identifies and mitigates the impact of BFAs through anomaly detection. By analyzing the anomalous distribution of parameters and gradients induced by attacks, our method leverages Median Absolute Deviation (MAD) to detect outliers and applies a two-step rectification: clipping the most significant outliers to zero and processing neighboring parameters using local statistics. Experimental results show that our approach significantly mitigates gradient-based and random BFAs on three DNN models (a self-constructed model, ResNet-20, ResNet-18) and three popular datasets (MNIST, CIFAR-10, ImageNet), achieving test accuracies up to 95.59% on MNIST, 81.18% on CIFAR-10, and 62.88% on ImageNet under bit-flip attacks (BFAs). Compared to state-of-the-art methods, our approach achieves an average improvement of 28.90% on MNIST, 42.76% on CIFAR-10, and 32.48% on ImageNet following BFA attacks.