# Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks

arXiv: https://arxiv.org/abs/1905.12032 · HTML: https://mlsanity.com/paper/1905.12032/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2019.

## Built on by (most cited first, 26 of 26)

- [Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits](https://mlsanity.com/paper/2102.10496/) (2021)
- [Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks](https://mlsanity.com/paper/2111.12965/) (2021)
- [Formalizing Generalization and Robustness of Neural Networks to Weight Perturbations](https://mlsanity.com/paper/2103.02200/) (2021)
- [Hardly Perceptible Trojan Attack against Neural Networks with Bit Flips](https://mlsanity.com/paper/2207.13417/) (2022)
- [Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspective](https://mlsanity.com/paper/2302.09457/) (2023)
- [AI Risk Management Should Incorporate Both Safety and Security](https://mlsanity.com/paper/2405.19524/) (2024)
- [Poisoning Attacks and Defenses on Artificial Intelligence: A Survey](https://mlsanity.com/paper/2202.10276/) (2022)
- [One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training](https://mlsanity.com/paper/2308.07934/) (2023)
- [Versatile Weight Attack via Flipping Limited Bits](https://mlsanity.com/paper/2207.12405/) (2022)
- [RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy](https://mlsanity.com/paper/2103.13813/) (2021)
- [DeepPoison: Feature Transfer Based Stealthy Poisoning Attack](https://mlsanity.com/paper/2101.02562/) (2021)
- [FooBaR: Fault Fooling Backdoor Attack on Neural Network Training](https://mlsanity.com/paper/2109.11249/) (2021)
- [Adversarial Parameter Attack on Deep Neural Networks](https://mlsanity.com/paper/2203.10502/) (2022)
- [Exploiting Vulnerabilities in Deep Neural Networks: Adversarial and Fault-Injection Attacks](https://mlsanity.com/paper/2105.03251/) (2021)
- [ZeBRA: Precisely Destroying Neural Networks with Zero-Data Based Repeated Bit Flip Attack](https://mlsanity.com/paper/2111.01080/) (2021)
- [Non-Singular Adversarial Robustness of Neural Networks](https://mlsanity.com/paper/2102.11935/) (2021)
- [New data poison attacks on machine learning classifiers for mobile exfiltration](https://mlsanity.com/paper/2210.11592/) (2022)
- [On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs](https://mlsanity.com/paper/2412.20087/) (2024)
- [BDFA: A Blind Data Adversarial Bit-flip Attack on Deep Neural Networks](https://mlsanity.com/paper/2112.03477/) (2021)
- [Variation Enhanced Attacks Against RRAM-based Neuromorphic Computing System](https://mlsanity.com/paper/2302.09902/) (2023)
- [An Incremental Gray-box Physical Adversarial Attack on Neural Network Training](https://mlsanity.com/paper/2303.01245/) (2023)
- [Cross-Silo Federated Learning Across Divergent Domains with Iterative Parameter Alignment](https://mlsanity.com/paper/2311.04818/) (2023)
- [SilentStriker:Toward Stealthy Bit-Flip Attacks on Large Language Models](https://mlsanity.com/paper/2509.17371/) (2025)
- [Attacking Deep Learning AI Hardware with Universal Adversarial Perturbation](https://mlsanity.com/paper/2111.09488/) (2021)
- [Detection and Recovery Against Deep Neural Network Fault Injection Attacks Based on Contrastive Learning](https://mlsanity.com/paper/2401.16766/) (2024)
- [Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks](https://mlsanity.com/paper/2606.04317/) (2026)

## Abstract (arXiv)

Despite the great achievements of deep neural networks (DNNs), the vulnerability of state-of-the-art DNNs raises security concerns of DNNs in many application domains requiring high reliability.We propose the fault sneaking attack on DNNs, where the adversary aims to misclassify certain input images into any target labels by modifying the DNN parameters. We apply ADMM (alternating direction method of multipliers) for solving the optimization problem of the fault sneaking attack with two constraints: 1) the classification of the other images should be unchanged and 2) the parameter modifications should be minimized. Specifically, the first constraint requires us not only to inject designated faults (misclassifications), but also to hide the faults for stealthy or sneaking considerations by maintaining model accuracy. The second constraint requires us to minimize the parameter modifications (using L0 norm to measure the number of modifications and L2 norm to measure the magnitude of modifications). Comprehensive experimental evaluation demonstrates that the proposed framework can inject multiple sneaking faults without losing the overall test accuracy performance.