mlsanityData to 14 Oct 2026

DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks

arXiv 2405.13891 ↗First posted 22 May 2024cs.CR cs.AIcited by 3

Not on the map. Why?

Abstract (arXiv)

Fault injection attacks are a potent threat against embedded implementations of neural network models. Several attack vectors have been proposed, such as misclassification, model extraction, and trojan/backdoor planting. Most of these attacks work by flipping bits in the memory where quantized model parameters are stored. In this paper, we introduce an encoding-based protection method against bit-flip attacks on neural networks, titled DeepNcode. We experimentally evaluate our proposal with several publicly available models and datasets, by using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results show an increase in protection margin of up to 7.6× for 4-bit and 12.4× for 8-bit quantized networks. Memory overheads start at 50% of the original network size, while the time overheads are negligible. Moreover, DeepNcode does not require retraining and does not change the original accuracy of the model.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 17 of its 56 references that are in the map. First posted on arXiv 22 May 2024.

Builds on

17 of 56 references.

References · 17

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2021A White Paper on Neural Network Quantizationcited by 472
  4. 2016Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activationscited by 426
  5. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  6. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  7. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 108
  8. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 57
  9. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  10. 2020SNIFF: Reverse Engineering of Neural Networks with Fault Attackscited by 23
  11. 2019RowHammer: A Retrospectivecited by 19
  12. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
5 more
  1. 2023Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networkscited by 17
  2. 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracycited by 11
  3. 2021HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networkscited by 9
  4. 2021FooBaR: Fault Fooling Backdoor Attack on Neural Network Trainingcited by 6
  5. 2021DeepStrike: Remotely-Guided Fault Injection Attacks on DNN Accelerator in Cloud-FPGAcited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 1.

3 papers.

  1. 2025Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flipscited by 4
  2. 2024DeepBaR: Fault Backdoor Attack on Deep Neural Network Layerscited by 1
  3. 2026Beyond TVLA: Anderson-Darling Leakage Assessment for Neural Network Side-Channel Leakage Detectioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training
  2. 2023Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables
  3. 2024Impactful Bit-Flip Search on Full-precision Models
  4. 2025Verification of Bit-Flip Attacks against Quantized Neural Networks
  5. 2023Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent
  6. 2026Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
  7. 2026Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks
  8. 2023DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs