# DeepNcode: Encoding-Based Protection against Bit-Flip Attacks on Neural Networks

arXiv: https://arxiv.org/abs/2405.13891 · HTML: https://mlsanity.com/paper/2405.13891/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 56 references that are in the map.
- First posted on arXiv 22 May 2024.

## Builds on (most cited first, 17 of 17)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [A White Paper on Neural Network Quantization](https://mlsanity.com/paper/2106.08295/) (2021)
- [Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activations](https://mlsanity.com/paper/1609.07061/) (2016)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [TBT: Targeted Neural Network Attack with Bit Trojan](https://mlsanity.com/paper/1909.05193/) (2019)
- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attacks](https://mlsanity.com/paper/1906.01017/) (2019)
- [Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits](https://mlsanity.com/paper/2102.10496/) (2021)
- [SNIFF: Reverse Engineering of Neural Networks with Fault Attacks](https://mlsanity.com/paper/2002.11021/) (2020)
- [RowHammer: A Retrospective](https://mlsanity.com/paper/1904.09724/) (2019)
- [RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery](https://mlsanity.com/paper/2101.08254/) (2021)
- [Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks](https://mlsanity.com/paper/2302.13520/) (2023)
- [RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy](https://mlsanity.com/paper/2103.13813/) (2021)
- [HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networks](https://mlsanity.com/paper/2111.01932/) (2021)
- [FooBaR: Fault Fooling Backdoor Attack on Neural Network Training](https://mlsanity.com/paper/2109.11249/) (2021)
- [DeepStrike: Remotely-Guided Fault Injection Attacks on DNN Accelerator in Cloud-FPGA](https://mlsanity.com/paper/2105.09453/) (2021)

## Built on by (most cited first, 3 of 3)

- [Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips](https://mlsanity.com/paper/2502.07408/) (2025)
- [DeepBaR: Fault Backdoor Attack on Deep Neural Network Layers](https://mlsanity.com/paper/2407.21220/) (2024)
- [Beyond TVLA: Anderson-Darling Leakage Assessment for Neural Network Side-Channel Leakage Detection](https://mlsanity.com/paper/2603.18647/) (2026)

## Abstract (arXiv)

Fault injection attacks are a potent threat against embedded implementations of neural network models. Several attack vectors have been proposed, such as misclassification, model extraction, and trojan/backdoor planting. Most of these attacks work by flipping bits in the memory where quantized model parameters are stored. In this paper, we introduce an encoding-based protection method against bit-flip attacks on neural networks, titled DeepNcode. We experimentally evaluate our proposal with several publicly available models and datasets, by using state-of-the-art bit-flip attacks: BFA, T-BFA, and TA-LBF. Our results show an increase in protection margin of up to 7.6× for 4-bit and 12.4× for 8-bit quantized networks. Memory overheads start at 50% of the original network size, while the time overheads are negligible. Moreover, DeepNcode does not require retraining and does not change the original accuracy of the model.