# On the Effect of Bit-Level Parameter Perturbations in Machine Learning and Deep Learning Models

arXiv: https://arxiv.org/abs/2609.26280 · HTML: https://mlsanity.com/paper/2609.26280/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 26 references that are in the map.
- First posted on arXiv 14 Aug 2026.

## Builds on (most cited first, 7 of 7)

- [Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search](https://mlsanity.com/paper/1903.12269/) (2019)
- [How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defenses](https://mlsanity.com/paper/2305.10862/) (2023)
- [DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips](https://mlsanity.com/paper/2003.13746/) (2020)
- [GPUHammer: Rowhammer Attacks on GPU Memories are Practical](https://mlsanity.com/paper/2507.08166/) (2025)
- [Adversarial Parameter Attack on Deep Neural Networks](https://mlsanity.com/paper/2203.10502/) (2022)
- [Improving the Performance of the LSTM and HMM Model via Hybridization](https://mlsanity.com/paper/1907.04670/) (2019)
- [Crossfire: An Elastic Defense Framework for Graph Neural Networks Under Bit Flip Attacks](https://mlsanity.com/paper/2501.13776/) (2025)

## Abstract (arXiv)

In this chapter, we investigate how classical machine learning models respond to small, targeted modifications in their parameters. We compare and contrast these results to analogous experiments on deep learning models. For classical learning models, we consider Hidden Markov Models (HMM) and Support Vector Machines (SVM), and for comparison, we conduct analogous experiments involving Multilayer Perceptrons (MLP) and Long Short-Term Memory (LSTM) networks. When applied to the Drebin Android malware dataset, our results show that classical models are brittle, in the sense that a limited set of selected parameters can have a dramatic effect on model behavior. In a related set of experiments, we investigate the steganographic capacity of these same learning models, that is, the proportion of bits in model parameters that can be overwritten without having a significant adverse affect on a model. We find that classical models offer limited steganographic capacity due to their compact, parameter-efficient, and relatively sensitive parameter structure. In contrast, neural networks are parameter-redundant, enabling higher steganographic capacity, where modifications can be distributed across many parameters with minimal impact on performance. These results highlight differences in how classical and neural models respond to parameter changes, with clear implications for both robustness and hidden information embedding. Overall, this work provides a framework for understanding parameter sensitivity and steganographic capacity across different classes of learning models.