mlsanityData to 7 Oct 2026

RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy

arXiv 2103.13813 ↗First posted 22 Mar 2021cs.LG cs.CR cs.CVcited by 11

Not on the map. Why?

Abstract (arXiv)

Recently developed adversarial weight attack, a.k.a. bit-flip attack (BFA), has shown enormous success in compromising Deep Neural Network (DNN) performance with an extremely small amount of model parameter perturbation. To defend against this threat, we propose RA-BNN that adopts a complete binary (i.e., for both weights and activation) neural network (BNN) to significantly improve DNN model robustness (defined as the number of bit-flips required to degrade the accuracy to as low as a random guess). However, such an aggressive low bit-width model suffers from poor clean (i.e., no attack) inference accuracy. To counter this, we propose a novel and efficient two-stage network growing method, named Early-Growth. It selectively grows the channel size of each BNN layer based on channel-wise binary masks training with Gumbel-Sigmoid function. Apart from recovering the inference accuracy, our RA-BNN after growing also shows significantly higher resistance to BFA. Our evaluation of the CIFAR-10 dataset shows that the proposed RA-BNN can improve the clean model accuracy by ~2-8 %, compared with a baseline BNN, while simultaneously improving the resistance to BFA by more than 125 x. Moreover, on ImageNet, with a sufficiently large (e.g., 5,000) amount of bit-flips, the baseline BNN accuracy drops to 4.3 % from 51.9 %, while our RA-BNN accuracy only drops to 37.1 % from 60.9 % (9 % clean accuracy improvement).

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 31 of its 47 references that are in the map. First posted on arXiv 22 Mar 2021.

Builds on

31 of 47 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  6. 2016XNOR-Net: ImageNet Classification Using Binary Convolutional Neural Networkscited by 829
  7. 2015BinaryConnect: Training Deep Neural Networks with binary weights during propagationscited by 571
  8. 2016DoReFa-Net: Training Low Bitwidth Convolutional Neural Networks with Low Bitwidth Gradientscited by 557
  9. 2018Bi-Real Net: Enhancing the Performance of 1-bit CNNs With Improved Representational Capability and Advanced Training Algorithmcited by 233
  10. 2019Forward and Backward Information Retention for Accurate Binary Neural Networkscited by 169
  11. 2017Towards Accurate Binary Convolutional Neural Networkcited by 148
  12. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
19 more
  1. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  2. 2019DARTS+: Improved Differentiable Architecture Search with Early Stoppingcited by 105
  3. 2019XNOR-Net++: Improved Binary Neural Networkscited by 94
  4. 2020Rotated Binary Neural Networkcited by 77
  5. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  6. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 55
  7. 2020DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flipscited by 53
  8. 2017WRPN: Wide Reduced-Precision Networkscited by 49
  9. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  10. 2018XNOR Neural Engine: a Hardware Accelerator IP for 21.6 fJ/op Binary Neural Network Inferencecited by 28
  11. 2020Growing Efficient Deep Networks by Structured Continuous Sparsificationcited by 28
  12. 2019Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networkscited by 25
  13. 2020FT-CNN: Algorithm-Based Fault Tolerance for Convolutional Neural Networkscited by 21
  14. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
  15. 2018Regularized Binary Network Trainingcited by 13
  16. 2020DeepDyve: Dynamic Verification for Deep Neural Networkscited by 12
  17. 2017Another Flip in the Wall of Rowhammer Defensescited by 11
  18. 2020Functional Error Correction for Robust Neural Networkscited by 6
  19. 2021BlockHammer: Preventing RowHammer at Low Cost by Blacklisting Rapidly-Accessed DRAM Rowscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 0; 2023: 1; 2024: 4; 2025: 2; 2026: 3.

11 papers.

  1. 2021HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networkscited by 9
  2. 2025Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flipscited by 4
  3. 2024DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networkscited by 3
  4. 2024PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flipscited by 3
  5. 2023DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNscited by 2
  6. 2024DeepBaR: Fault Backdoor Attack on Deep Neural Network Layerscited by 1
  7. 2026Targeted Bit-Flip Attacks on LLM-Based Agentscited by 1
  8. 2024An Empirical Study of Aegiscited by 0
  9. 2025Hessian-aware Training for Enhancing DNNs Resilience to Parameter Corruptionscited by 0
  10. 2026Quantum Tunneling-Aware Machine Learning: Physics-Derived Noise Models for Robust Deploymentcited by 0
  11. 2026Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerabilitycited by 0