mlsanityData to 7 Oct 2026

ZeBRA: Precisely Destroying Neural Networks with Zero-Data Based Repeated Bit Flip Attack

arXiv 2111.01080 ↗First posted 1 Nov 2021cs.LG cs.CRcited by 3

Not on the map. Why?

Abstract (arXiv)

In this paper, we present Zero-data Based Repeated bit flip Attack (ZeBRA) that precisely destroys deep neural networks (DNNs) by synthesizing its own attack datasets. Many prior works on adversarial weight attack require not only the weight parameters, but also the training or test dataset in searching vulnerable bits to be attacked. We propose to synthesize the attack dataset, named distilled target data, by utilizing the statistics of batch normalization layers in the victim DNN model. Equipped with the distilled target data, our ZeBRA algorithm can search vulnerable bits in the model without accessing training or test dataset. Thus, our approach makes the adversarial weight attack more fatal to the security of DNNs. Our experimental results show that 2.0x (CIFAR-10) and 1.6x (ImageNet) less number of bit flips are required on average to destroy DNNs compared to the previous attack method. Our code is available at https://github. com/pdh930105/ZeBRA.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 29 of its 44 references that are in the map. First posted on arXiv 1 Nov 2021.

Builds on

29 of 44 references.

References · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  6. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  10. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  11. 2013Playing Atari with Deep Reinforcement Learningcited by 3,211
  12. 2016Adversarial examples in the physical worldcited by 1,762
17 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2018ShuffleNet V2: Practical Guidelines for Efficient CNN Architecture Designcited by 1,132
  3. 2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 937
  4. 2019A Survey of Deep Learning Techniques for Autonomous Drivingcited by 401
  5. 2020ZeroQ: A Novel Zero Shot Quantization Frameworkcited by 265
  6. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  7. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  8. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  9. 2019Single-Path NAS: Designing Hardware-Efficient ConvNets in less than 4 Hourscited by 87
  10. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
  11. 2020Very Deep Transformers for Neural Machine Translationcited by 50
  12. 2019Fooling a Real Car with Adversarial Traffic Signscited by 29
  13. 2019Learning Gentle Object Manipulation with Curiosity-Driven Deep Reinforcement Learningcited by 25
  14. 2019Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networkscited by 25
  15. 2017Is Deep Learning Safe for Robot Vision? Adversarial Examples against the iCub Humanoidcited by 19
  16. 2019RowHammer: A Retrospectivecited by 19
  17. 2020T-BFA: Targeted Bit-Flip Adversarial Weight Attackcited by 4

Built on by

Cited by year

Citing papers per year: 2022: 1; 2023: 1; 2024: 0; 2025: 1.

3 papers.

  1. 2022A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networkscited by 5
  2. 2025Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flipscited by 4
  3. 2023Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferentcited by 0