mlsanityData to 7 Oct 2026

Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search

arXiv 1903.12269 ↗First posted 28 Mar 2019cs.CV cs.CRcited by 106

Not on the map. Why?

Abstract (arXiv)

Several important security issues of Deep Neural Network (DNN) have been raised recently associated with different applications and components. The most widely investigated security concern of DNN is from its malicious input, a.k.a adversarial example. Nevertheless, the security challenge of DNN's parameters is not well explored yet. In this work, we are the first to propose a novel DNN weight attack methodology called Bit-Flip Attack (BFA) which can crush a neural network through maliciously flipping extremely small amount of bits within its weight storage memory system (i.e., DRAM). The bit-flip operations could be conducted through well-known Row-Hammer attack, while our main contribution is to develop an algorithm to identify the most vulnerable bits of DNN weight parameters (stored in memory as binary bits), that could maximize the accuracy degradation with a minimum number of bit-flips. Our proposed BFA utilizes a Progressive Bit Search (PBS) method which combines gradient ranking and progressive search to identify the most vulnerable bit to be flipped. With the aid of PBS, we can successfully attack a ResNet-18 fully malfunction (i.e., top-1 accuracy degrade from 69.8% to 0.1%) only through 13 bit-flips out of 93 million bits, while randomly flipping 100 bits merely degrades the accuracy by less than 1%.

Key facts. Cited by 106 papers in the map (data through 7 Oct 2026). First posted on arXiv 28 Mar 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 24; 2022: 8; 2023: 13; 2024: 13; 2025: 21; 2026: 27.

106 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  3. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
  4. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  5. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  6. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  7. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  8. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  9. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  10. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  11. 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 21
  12. 2021Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box settingcited by 20
38 more
  1. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
  2. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  3. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
  4. 2023NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscationcited by 15
  5. 2023One-bit Flip is All You Need: When Bit-flip Attack Meets Model Trainingcited by 14
  6. 2022Versatile Weight Attack via Flipping Limited Bitscited by 13
  7. 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracycited by 11
  8. 2021AGKD-BML: Defense Against Adversarial Attack by Attention Guided Knowledge Distillation and Bi-directional Metric Learningcited by 10
  9. 2021BMPQ: Bit-Gradient Sensitivity Driven Mixed-Precision Quantization of DNNs from Scratchcited by 10
  10. 2024GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMscited by 10
  11. 2021HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networkscited by 9
  12. 2025On Jailbreaking Quantized Language Models Through Fault Injection Attackscited by 8
  13. 2021Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Acceleratorscited by 6
  14. 2021Don't Knock! Rowhammer at the Backdoor of DNN Modelscited by 6
  15. 2022Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systemscited by 6
  16. 2022A Tale of Two Models: Constructing Evasive Attacks on Edge Modelscited by 6
  17. 2023Machine Learning needs Better Randomness Standards: Randomised Smoothing and PRNG-based attackscited by 6
  18. 2021EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetrycited by 5
  19. 2022A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networkscited by 5
  20. 2023Model Extraction Attacks on Split Federated Learningcited by 5
  21. 2023Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Modelscited by 5
  22. 2024Data Free Backdoor Attackscited by 5
  23. 2025SBFA: Single Sneaky Bit Flip Attack to Break Large Language Modelscited by 5
  24. 2021Exploiting Vulnerabilities in Deep Neural Networks: Adversarial and Fault-Injection Attackscited by 4
  25. 2025Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flipscited by 4
  26. 2025From Centralized to Decentralized Federated Learning: Theoretical Insights, Privacy Preservation, and Robustness Challengescited by 4
  27. 2025Input-Triggered Hardware Trojan Attack on Spiking Neural Networkscited by 4
  28. 2021An Overview of Laser Injection against Embedded Neural Network Modelscited by 3
  29. 2021Tolerating Adversarial Attacks and Byzantine Faults in Distributed Machine Learningcited by 3
  30. 2021ZeBRA: Precisely Destroying Neural Networks with Zero-Data Based Repeated Bit Flip Attackcited by 3
  31. 2024Machine Learning in Space: Surveying the Robustness of on-board ML models to Radiationcited by 3
  32. 2024DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networkscited by 3
  33. 2024PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flipscited by 3
  34. 2025Byzantine-Resilient Federated Learning via Distributed Optimizationcited by 3
  35. 2025On the Relationship Between Robustness and Expressivity of Graph Neural Networkscited by 3
  36. 2025LM-Fix: Lightweight Bit-Flip Detection and Rapid Recovery Framework for Language Modelscited by 3
  37. 2023Evaluation of Parameter-based Attacks against Embedded Neural Networks with Laser Injectioncited by 2
  38. 2023DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNscited by 2

50 most cited of 106 All 106 (JSON)