# One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training

arXiv: https://arxiv.org/abs/2308.07934 · HTML: https://mlsanity.com/paper/2308.07934/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 29 of its 37 references that are in the map.
- First posted on arXiv 12 Aug 2023.

## Builds on (most cited first, 29 of 29)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks](https://mlsanity.com/paper/1804.00792/) (2018)
- [Backdoor Learning: A Survey](https://mlsanity.com/paper/2007.08745/) (2020)
- [Invisible Backdoor Attack with Sample-Specific Triggers](https://mlsanity.com/paper/2012.03816/) (2020)
- [Quantized Convolutional Neural Networks for Mobile Devices](https://mlsanity.com/paper/1512.06473/) (2015)
- [Fixed Point Quantization of Deep Convolutional Networks](https://mlsanity.com/paper/1511.06393/) (2015)
- [TBT: Targeted Neural Network Attack with Bit Trojan](https://mlsanity.com/paper/1909.05193/) (2019)
- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [SynFace: Face Recognition with Synthetic Data](https://mlsanity.com/paper/2108.07960/) (2021)
- [Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases](https://mlsanity.com/paper/2007.15802/) (2020)
- [Backdoor Attack against Speaker Verification](https://mlsanity.com/paper/2010.11607/) (2020)
- [Can Neural Nets Learn the Same Model Twice? Investigating Reproducibility and Double Descent from the Decision Boundary Perspective](https://mlsanity.com/paper/2203.08124/) (2022)
- [DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips](https://mlsanity.com/paper/2003.13746/) (2020)
- [Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits](https://mlsanity.com/paper/2102.10496/) (2021)
- [DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories](https://mlsanity.com/paper/2111.04625/) (2021)
- [Targeted Attack for Deep Hashing based Retrieval](https://mlsanity.com/paper/2004.07955/) (2020)
- [Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks](https://mlsanity.com/paper/1905.12032/) (2019)
- [Hardly Perceptible Trojan Attack against Neural Networks with Bit Flips](https://mlsanity.com/paper/2207.13417/) (2022)
- [Orthogonal Deep Features Decomposition for Age-Invariant Face Recognition](https://mlsanity.com/paper/1810.07599/) (2018)
- [Versatile Weight Attack via Flipping Limited Bits](https://mlsanity.com/paper/2207.12405/) (2022)
- [Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA](https://mlsanity.com/paper/2011.03006/) (2020)
- [Retrospective: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors](https://mlsanity.com/paper/2306.16093/) (2023)
- [ℓp-Box ADMM: A Versatile Framework for Integer Programming](https://mlsanity.com/paper/1604.07666/) (2016)
- [Speaker Identity Preservation in Dysarthric Speech Reconstruction by Adversarial Speaker Adaptation](https://mlsanity.com/paper/2202.09082/) (2022)
- [Spoofing-Aware Speaker Verification by Multi-Level Fusion](https://mlsanity.com/paper/2203.15377/) (2022)
- [CodeX: Bit-Flexible Encoding for Streaming-based FPGA Acceleration of DNNs](https://mlsanity.com/paper/1901.05582/) (2019)

## Built on by (most cited first, 14 of 14)

- [Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand](https://mlsanity.com/paper/2310.14942/) (2023)
- [REFINE: Inversion-Free Backdoor Defense via Model Reprogramming](https://mlsanity.com/paper/2502.18508/) (2025)
- [BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection](https://mlsanity.com/paper/2308.12439/) (2023)
- [PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips](https://mlsanity.com/paper/2412.07192/) (2024)
- [Machine Learning in Space: Surveying the Robustness of on-board ML models to Radiation](https://mlsanity.com/paper/2405.02642/) (2024)
- [Verification of Bit-Flip Attacks against Quantized Neural Networks](https://mlsanity.com/paper/2502.16286/) (2025)
- [DoCIA: An Online Document-Level Context Incorporation Agent for Speech Translation](https://mlsanity.com/paper/2504.05122/) (2025)
- [BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Models](https://mlsanity.com/paper/2505.16670/) (2025)
- [CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration](https://mlsanity.com/paper/2506.13160/) (2025)
- [How a Bit Becomes a Story: Semantic Steering via Differentiable Fault Injection](https://mlsanity.com/paper/2512.14715/) (2025)
- [On the Convergence of Stochastic Gradient Descent with Perturbed Forward-Backward Passes](https://mlsanity.com/paper/2602.20646/) (2026)
- [Spatiotemporal-Aware Bit-Flip Injection on DNN-based Advanced Driver Assistance Systems (extended version)](https://mlsanity.com/paper/2604.03753/) (2026)
- [Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips](https://mlsanity.com/paper/2606.09548/) (2026)
- [TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edge](https://mlsanity.com/paper/2608.22716/) (2026)

## Abstract (arXiv)

Deep neural networks (DNNs) are widely deployed on real-world devices. Concerns regarding their security have gained great attention from researchers. Recently, a new weight modification attack called bit flip attack (BFA) was proposed, which exploits memory fault inject techniques such as row hammer to attack quantized models in the deployment stage. With only a few bit flips, the target model can be rendered useless as a random guesser or even be implanted with malicious functionalities. In this work, we seek to further reduce the number of bit flips. We propose a training-assisted bit flip attack, in which the adversary is involved in the training stage to build a high-risk model to release. This high-risk model, obtained coupled with a corresponding malicious model, behaves normally and can escape various detection methods. The results on benchmark datasets show that an adversary can easily convert this high-risk but normal model to a malicious one on victim's side by flipping only one critical bit on average in the deployment stage. Moreover, our attack still poses a significant threat even when defenses are employed. The codes for reproducing main experiments are available at urlhttps://github.com/jianshuod/TBA.