# DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips

arXiv: https://arxiv.org/abs/2003.13746 · HTML: https://mlsanity.com/paper/2003.13746/

## Key facts

- Cited by 56 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Mar 2020.

## Built on by (most cited first, 30 of 56)

- [Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems](https://mlsanity.com/paper/2401.05778/) (2024)
- [Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits](https://mlsanity.com/paper/2102.10496/) (2021)
- [DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories](https://mlsanity.com/paper/2111.04625/) (2021)
- [Hardly Perceptible Trojan Attack against Neural Networks with Bit Flips](https://mlsanity.com/paper/2207.13417/) (2022)
- [Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes](https://mlsanity.com/paper/2110.13541/) (2021)
- [RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery](https://mlsanity.com/paper/2101.08254/) (2021)
- [One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training](https://mlsanity.com/paper/2308.07934/) (2023)
- [RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy](https://mlsanity.com/paper/2103.13813/) (2021)
- [What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction](https://mlsanity.com/paper/2201.09650/) (2022)
- [GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs](https://mlsanity.com/paper/2411.13757/) (2024)
- [HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networks](https://mlsanity.com/paper/2111.01932/) (2021)
- [Don't Knock! Rowhammer at the Backdoor of DNN Models](https://mlsanity.com/paper/2110.07683/) (2021)
- [A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networks](https://mlsanity.com/paper/2209.14243/) (2022)
- [PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips](https://mlsanity.com/paper/2412.07192/) (2024)
- [SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models](https://mlsanity.com/paper/2509.21843/) (2025)
- [Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips](https://mlsanity.com/paper/2502.07408/) (2025)
- [Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables](https://mlsanity.com/paper/2309.06223/) (2023)
- [On the Relationship Between Robustness and Expressivity of Graph Neural Networks](https://mlsanity.com/paper/2504.13786/) (2025)
- [Evaluation of Parameter-based Attacks against Embedded Neural Networks with Laser Injection](https://mlsanity.com/paper/2304.12876/) (2023)
- [DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs](https://mlsanity.com/paper/2305.08034/) (2023)
- [Fault Injection on Embedded Neural Networks: Impact of a Single Instruction Skip](https://mlsanity.com/paper/2308.16665/) (2023)
- [Verification of Bit-Flip Attacks against Quantized Neural Networks](https://mlsanity.com/paper/2502.16286/) (2025)
- [BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Models](https://mlsanity.com/paper/2505.16670/) (2025)
- [TFL: Targeted Bit-Flip Attack on Large Language Model](https://mlsanity.com/paper/2602.17837/) (2026)
- [BDFA: A Blind Data Adversarial Bit-flip Attack on Deep Neural Networks](https://mlsanity.com/paper/2112.03477/) (2021)
- [SoK: A Systems Perspective on Compound AI Threats and Countermeasures](https://mlsanity.com/paper/2411.13459/) (2024)
- [LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems](https://mlsanity.com/paper/2509.10682/) (2025)
- [SilentStriker:Toward Stealthy Bit-Flip Attacks on Large Language Models](https://mlsanity.com/paper/2509.17371/) (2025)
- [Hammering the Diagnosis: Rowhammer-Induced Stealthy Trojan Attacks on ViT-Based Medical Imaging](https://mlsanity.com/paper/2510.24976/) (2025)
- [FaRAccel: FPGA-Accelerated Defense Architecture for Efficient Bit-Flip Attack Resilience in Transformer Models](https://mlsanity.com/paper/2510.24985/) (2025)

## Abstract (arXiv)

Security of machine learning is increasingly becoming a major concern due to the ubiquitous deployment of deep learning in many security-sensitive domains. Many prior studies have shown external attacks such as adversarial examples that tamper with the integrity of DNNs using maliciously crafted inputs. However, the security implication of internal threats (i.e., hardware vulnerability) to DNN models has not yet been well understood. In this paper, we demonstrate the first hardware-based attack on quantized deep neural networks-DeepHammer-that deterministically induces bit flips in model weights to compromise DNN inference by exploiting the rowhammer vulnerability. DeepHammer performs aggressive bit search in the DNN model to identify the most vulnerable weight bits that are flippable under system constraints. To trigger deterministic bit flips across multiple pages within reasonable amount of time, we develop novel system-level techniques that enable fast deployment of victim pages, memory-efficient rowhammering and precise flipping of targeted bits. DeepHammer can deliberately degrade the inference accuracy of the victim DNN system to a level that is only as good as random guess, thus completely depleting the intelligence of targeted DNN systems. We systematically demonstrate our attacks on real systems against 12 DNN architectures with 4 different datasets and different application domains. Our evaluation shows that DeepHammer is able to successfully tamper DNN inference behavior at run-time within a few minutes. We further discuss several mitigation techniques from both algorithm and system levels to protect DNNs against such attacks. Our work highlights the need to incorporate security mechanisms in future deep learning system to enhance the robustness of DNN against hardware-based deterministic fault injections.