# Attacking Binarized Neural Networks

arXiv: https://arxiv.org/abs/1711.00449 · HTML: https://mlsanity.com/paper/1711.00449/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Nov 2017.

## Built on by (most cited first, 29 of 29)

- [Hardware Approximate Techniques for Deep Neural Network Accelerators: A Survey](https://mlsanity.com/paper/2203.08737/) (2022)
- [On the Adversarial Robustness of Quantized Neural Networks](https://mlsanity.com/paper/2105.00227/) (2021)
- [Investigating the Impact of Quantization on Adversarial Robustness](https://mlsanity.com/paper/2404.05639/) (2024)
- [Quantum HyperNetworks: Training Binary Neural Networks in Quantum Superposition](https://mlsanity.com/paper/2301.08292/) (2023)
- [Recent Advances in Large Margin Learning](https://mlsanity.com/paper/2103.13598/) (2021)
- [QGen: On the Ability to Generalize in Quantization Aware Training](https://mlsanity.com/paper/2404.11769/) (2024)
- [Relationship between Model Compression and Adversarial Robustness: A Review of Current Evidence](https://mlsanity.com/paper/2311.15782/) (2023)
- [2-in-1 Accelerator: Enabling Random Precision Switch for Winning Both Adversarial Robustness and Efficiency](https://mlsanity.com/paper/2109.05223/) (2021)
- [Robust Binary Models by Pruning Randomly-initialized Networks](https://mlsanity.com/paper/2202.01341/) (2022)
- [BitGNN: Unleashing the Performance Potential of Binary Graph Neural Networks on GPUs](https://mlsanity.com/paper/2305.02522/) (2023)
- [BCNN: Binary Complex Neural Network](https://mlsanity.com/paper/2104.10044/) (2021)
- [Tensor Normalization and Full Distribution Training](https://mlsanity.com/paper/2109.02345/) (2021)
- [A Layer-wise Adversarial-aware Quantization Optimization for Improving Robustness](https://mlsanity.com/paper/2110.12308/) (2021)
- [Binarized ResNet: Enabling Robust Automatic Modulation Classification at the resource-constrained Edge](https://mlsanity.com/paper/2110.14357/) (2021)
- [Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networks](https://mlsanity.com/paper/2304.12829/) (2023)
- [Enhancing Robustness of Neural Networks through Fourier Stabilization](https://mlsanity.com/paper/2106.04435/) (2021)
- [The Impact of Quantization on the Robustness of Transformer-based Text Classifiers](https://mlsanity.com/paper/2403.05365/) (2024)
- [Gradient-Based Interpretability Methods and Binarized Neural Networks](https://mlsanity.com/paper/2106.12569/) (2021)
- [Defensive Tensorization](https://mlsanity.com/paper/2110.13859/) (2021)
- [GAAF: Searching Activation Functions for Binary Neural Networks through Genetic Algorithm](https://mlsanity.com/paper/2206.03291/) (2022)
- [Adversarial Attacks on Machine Learning in Embedded and IoT Platforms](https://mlsanity.com/paper/2303.02214/) (2023)
- [Verifying Properties of Binary Neural Networks Using Sparse Polynomial Optimization](https://mlsanity.com/paper/2405.17049/) (2024)
- [From Fuzzy to Exact: The Halo Architecture for Infinite-Depth Reasoning via Rational Arithmetic](https://mlsanity.com/paper/2601.18702/) (2026)
- [BreakingBED -- Breaking Binary and Efficient Deep Neural Networks by Adversarial Attacks](https://mlsanity.com/paper/2103.08031/) (2021)
- [Hardening DNNs against Transfer Attacks during Network Compression using Greedy Adversarial Pruning](https://mlsanity.com/paper/2206.07406/) (2022)
- [ARBiBench: Benchmarking Adversarial Robustness of Binarized Neural Networks](https://mlsanity.com/paper/2312.13575/) (2023)
- [Quantitative Analysis of Deeply Quantized Tiny Neural Networks Robust to Adversarial Attacks](https://mlsanity.com/paper/2503.08973/) (2025)
- [Scalable Digital Compute-in-Memory Ising Machines for Robustness Verification of Binary Neural Networks](https://mlsanity.com/paper/2603.05677/) (2026)
- [Securing LLMs in the Wild: Privacy and Security Challenges at the Edge](https://mlsanity.com/paper/2607.13088/) (2026)

## Abstract (arXiv)

Neural networks with low-precision weights and activations offer compelling efficiency advantages over their full-precision equivalents. The two most frequently discussed benefits of quantization are reduced memory consumption, and a faster forward pass when implemented with efficient bitwise operations. We propose a third benefit of very low-precision neural networks: improved robustness against some adversarial attacks, and in the worst case, performance that is on par with full-precision models. We focus on the very low-precision case where weights and activations are both quantized to ±1, and note that stochastically quantizing weights in just one layer can sharply reduce the impact of iterative attacks. We observe that non-scaled binary neural networks exhibit a similar effect to the original defensive distillation procedure that led to gradient masking, and a false notion of security. We address this by conducting both black-box and white-box experiments with binary models that do not artificially mask gradients.