# SNIFF: Reverse Engineering of Neural Networks with Fault Attacks

arXiv: https://arxiv.org/abs/2002.11021 · HTML: https://mlsanity.com/paper/2002.11021/

## Key facts

- Cited by 22 papers in the map (data through 7 Oct 2026).
- First posted on arXiv 23 Feb 2020.

## Built on by (most cited first, 22 of 22)

- [I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences](https://mlsanity.com/paper/2206.08451/) (2022)
- [Privacy Side Channels in Machine Learning Systems](https://mlsanity.com/paper/2309.05610/) (2023)
- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameters](https://mlsanity.com/paper/2211.05590/) (2022)
- [A Survey on Failure Analysis and Fault Injection in AI Systems](https://mlsanity.com/paper/2407.00125/) (2024)
- [FooBaR: Fault Fooling Backdoor Attack on Neural Network Training](https://mlsanity.com/paper/2109.11249/) (2021)
- [A Desynchronization-Based Countermeasure Against Side-Channel Analysis of Neural Networks](https://mlsanity.com/paper/2303.18132/) (2023)
- [Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Models](https://mlsanity.com/paper/2308.16703/) (2023)
- [A Survey of Model Extraction Attacks and Defenses in Distributed Computing Environments](https://mlsanity.com/paper/2502.16065/) (2025)
- [A Review of Confidentiality Threats Against Embedded Neural Network Models](https://mlsanity.com/paper/2105.01401/) (2021)
- [Model Inversion Attack against Transfer Learning: Inverting a Model without Accessing It](https://mlsanity.com/paper/2203.06570/) (2022)
- [AI-driven Reverse Engineering of QML Models](https://mlsanity.com/paper/2408.16929/) (2024)
- [DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks](https://mlsanity.com/paper/2405.13891/) (2024)
- [Side-Channel Analysis of OpenVINO-based Neural Network Models](https://mlsanity.com/paper/2407.16467/) (2024)
- [The Quantum Imitation Game: Reverse Engineering of Quantum Machine Learning Models](https://mlsanity.com/paper/2407.07237/) (2024)
- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [BDFA: A Blind Data Adversarial Bit-flip Attack on Deep Neural Networks](https://mlsanity.com/paper/2112.03477/) (2021)
- [DeepBaR: Fault Backdoor Attack on Deep Neural Network Layers](https://mlsanity.com/paper/2407.21220/) (2024)
- [The Weight of a Bit: EMFI Sensitivity Analysis of Embedded Deep Learning Models](https://mlsanity.com/paper/2602.16309/) (2026)
- [Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent](https://mlsanity.com/paper/2311.01205/) (2023)
- [TrEEStealer: Stealing Decision Trees via Enclave Side Channels](https://mlsanity.com/paper/2604.18716/) (2026)
- [Characterizing the Fault Response of the Intel Neural Compute Stick 2 Under Single-Pulse Electromagnetic Fault Injection](https://mlsanity.com/paper/2605.22437/) (2026)

## Abstract (arXiv)

Neural networks have been shown to be vulnerable against fault injection attacks. These attacks change the physical behavior of the device during the computation, resulting in a change of value that is currently being computed. They can be realized by various fault injection techniques, ranging from clock/voltage glitching to application of lasers to rowhammer. In this paper we explore the possibility to reverse engineer neural networks with the usage of fault attacks. SNIFF stands for sign bit flip fault, which enables the reverse engineering by changing the sign of intermediate values. We develop the first exact extraction method on deep-layer feature extractor networks that provably allows the recovery of the model parameters. Our experiments with Keras library show that the precision error for the parameter recovery for the tested networks is less than 10-13 with the usage of 64-bit floats, which improves the current state of the art by 6 orders of magnitude. Additionally, we discuss the protection techniques against fault injection attacks that can be applied to enhance the fault resistance.