mlsanityData to 14 Oct 2026

Versatile Weight Attack via Flipping Limited Bits

arXiv 2207.12405 ↗First posted 25 Jul 2022cs.CR cs.LGcited by 13

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack in the training stage and the adversarial attack in the inference stage. In this paper, we study a novel attack paradigm, which modifies model parameters in the deployment stage. Considering the effectiveness and stealthiness goals, we provide a general formulation to perform the bit-flip based weight attack, where the effectiveness term could be customized depending on the attacker's purpose. Furthermore, we present two cases of the general formulation with different malicious purposes, i.e., single sample attack (SSA) and triggered samples attack (TSA). To this end, we formulate this problem as a mixed integer programming (MIP) to jointly determine the state of the binary bits (0 or 1) in the memory and learn the sample modification. Utilizing the latest technique in integer programming, we equivalently reformulate this MIP problem as a continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of multipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of SSA and TSA in attacking DNNs.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 45 of its 94 references that are in the map. First posted on arXiv 25 Jul 2022.

Builds on

45 of 94 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits21 Feb

Other references · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2013Intriguing properties of neural networkscited by 5,155
  8. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  9. 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,593
  10. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 971
  11. 2015End-to-End Training of Deep Visuomotor Policiescited by 875
  12. 2016Universal adversarial perturbationscited by 784
32 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  2. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  3. 2017Adversarial Patchcited by 517
  4. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  5. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  6. 2020Backdoor Learning: A Surveycited by 426
  7. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  8. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  9. 2019Hidden Trigger Backdoor Attackscited by 371
  10. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  11. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  12. 2019Label-Consistent Backdoor Attackscited by 296
  13. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
  14. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  15. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
  16. 2017Neural Trojanscited by 153
  17. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  18. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  19. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  20. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 108
  21. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  22. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 57
  23. 2018Model-Reuse Attacks on Deep Learning Systemscited by 49
  24. 2020Targeted Attack for Deep Hashing based Retrievalcited by 35
  25. 2019Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variablescited by 26
  26. 2019Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networkscited by 26
  27. 2020Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruptioncited by 26
  28. 2019On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Methodcited by 21
  29. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
  30. 2017Another Flip in the Wall of Rowhammer Defensescited by 12
  31. 2019In-Place Zero-Space Memory Protection for CNNcited by 9
  32. 2021Random and Adversarial Bit Error Robustness: Energy-Efficient and Secure DNN Acceleratorscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 5; 2025: 2; 2026: 1.

13 papers.

Sort:

By area:

  1. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 67
  2. 2023Label Poisoning is All You Needcited by 29
  3. 2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Modelscited by 23
  4. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  5. 2023One-bit Flip is All You Need: When Bit-flip Attack Meets Model Trainingcited by 14
  6. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  7. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  8. 2024Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformerscited by 5
  9. 2024PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flipscited by 5
  10. 2025SABRE-FL: Selective and Accurate Backdoor Rejection for Federated Prompt Learningcited by 2
  11. 2024Impactful Bit-Flip Search on Full-precision Modelscited by 0
  12. 2025Hessian-aware Training for Enhancing DNNs Resilience to Parameter Corruptionscited by 0
1 more
  1. 2026Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flipscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy
  2. 2024DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks
  3. 2023Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables
  4. 2025Dynamic Parameter Optimization for Highly Transferable Transformation-Based Attacks
  5. 2021BDFA: A Blind Data Adversarial Bit-flip Attack on Deep Neural Networks
  6. 2022M-to-N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models
  7. 2023DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs
  8. 2024A Practical Trigger-Free Backdoor Attack on Neural Networks ↗