mlsanityData to 7 Oct 2026

Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits

arXiv 2102.10496 ↗First posted 21 Feb 2021cs.LG cs.CRcited by 49

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack in the training stage and the adversarial attack in the inference stage. In this paper, we study a novel attack paradigm, which modifies model parameters in the deployment stage for malicious purposes. Specifically, our goal is to misclassify a specific sample into a target class without any sample modification, while not significantly reduce the prediction accuracy of other samples to ensure the stealthiness. To this end, we formulate this problem as a binary integer programming (BIP), since the parameters are stored as binary bits (i.e., 0 and 1) in the memory. By utilizing the latest technique in integer programming, we equivalently reformulate this BIP problem as a continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of multipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of our method in attacking DNNs.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 58 references that are in the map. First posted on arXiv 21 Feb 2021.

Builds on

31 of 58 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,548
  7. 2016Universal adversarial perturbationscited by 774
  8. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  9. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  10. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  11. 2018Spectral Signatures in Backdoor Attackscited by 457
  12. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
19 more
  1. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  2. 2019Hidden Trigger Backdoor Attackscited by 359
  3. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  4. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  5. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  6. 2017Neural Trojanscited by 151
  7. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  8. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  9. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  10. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  11. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 55
  12. 2020DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flipscited by 53
  13. 2020Targeted Attack for Deep Hashing based Retrievalcited by 34
  14. 2020CD-UAP: Class Discriminative Universal Adversarial Perturbationcited by 27
  15. 2019Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variablescited by 26
  16. 2019Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networkscited by 25
  17. 2020Adversarial Attack on Deep Product Quantization Network for Image Retrievalcited by 13
  18. 2017Another Flip in the Wall of Rowhammer Defensescited by 11
  19. 2020Blackbox Trojanising of Deep Learning Models : Using non-intrusive network structure and binary alterationscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 8; 2022: 11; 2023: 9; 2024: 16; 2025: 4; 2026: 1.

49 papers.

Sort:

By area:

  1. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  2. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  3. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  4. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  5. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  6. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  7. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  8. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  9. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  10. 2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
  11. 2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Modelscited by 23
  12. 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 21
37 more
  1. 2021Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box settingcited by 20
  2. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  3. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  4. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
  5. 2023One-bit Flip is All You Need: When Bit-flip Attack Meets Model Trainingcited by 14
  6. 2022Versatile Weight Attack via Flipping Limited Bitscited by 13
  7. 2021Backdoor Attack on Hash-based Image Retrieval via Clean-label Data Poisoningcited by 12
  8. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetworkcited by 12
  9. 2024DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domaincited by 12
  10. 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracycited by 11
  11. 2023Security Considerations in AI-Robotics: A Survey of Current Methods, Challenges, and Opportunitiescited by 9
  12. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  13. 2021FooBaR: Fault Fooling Backdoor Attack on Neural Network Trainingcited by 6
  14. 2021Don't Knock! Rowhammer at the Backdoor of DNN Modelscited by 6
  15. 2022Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systemscited by 6
  16. 2022Mind Your Heart: Stealthy Backdoor Attack on Dynamic Deep Neural Network in Edge Computingcited by 5
  17. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  18. 2024How to Inverting the Leverage Score Distribution?cited by 5
  19. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
  20. 2024Data Free Backdoor Attackscited by 5
  21. 2023Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Personscited by 4
  22. 2021Amicable Aid: Perturbing Images to Improve Classification Performancecited by 3
  23. 2024The last Dance : Robust backdoor attack via diffusion models and bayesian approachcited by 3
  24. 2024DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networkscited by 3
  25. 2024Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approachcited by 3
  26. 2025SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarkingcited by 3
  27. 2023Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executablescited by 2
  28. 2025BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Modelscited by 2
  29. 2025SABRE-FL: Selective and Accurate Backdoor Rejection for Federated Prompt Learningcited by 2
  30. 2024DeepBaR: Fault Backdoor Attack on Deep Neural Network Layerscited by 1
  31. 2024Resilience in Knowledge Graph Embeddingscited by 1
  32. 2026Targeted Bit-Flip Attacks on LLM-Based Agentscited by 1
  33. 2022Dormant Neural Trojanscited by 0
  34. 2024LSP Framework: A Compensatory Model for Defeating Trigger Reverse Engineering via Label Smoothing Poisoningcited by 0
  35. 2024Performance Evaluation of Knowledge Graph Embedding Approaches under Non-adversarial Attackscited by 0
  36. 2024One Pixel is All I Needcited by 0
  37. 2025SFIBA: Spatial-based Full-target Invisible Backdoor Attackscited by 0