DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips
arXiv:2003.13746
Abstract
Security of machine learning is increasingly becoming a major concern due to the ubiquitous deployment of deep learning in many security-sensitive domains. Many prior studies have shown external attacks such as adversarial examples that tamper with the integrity of DNNs using maliciously crafted inputs. However, the security implication of internal threats (i.e., hardware vulnerability) to DNN models has not yet been well understood. In this paper, we demonstrate the first hardware-based attack on quantized deep neural networks-DeepHammer-that deterministically induces bit flips in model weights to compromise DNN inference by exploiting the rowhammer vulnerability. DeepHammer performs aggressive bit search in the DNN model to identify the most vulnerable weight bits that are flippable under system constraints. To trigger deterministic bit flips across multiple pages within reasonable amount of time, we develop novel system-level techniques that enable fast deployment of victim pages, memory-efficient rowhammering and precise flipping of targeted bits. DeepHammer can deliberately degrade the inference accuracy of the victim DNN system to a level that is only as good as random guess, thus completely depleting the intelligence of targeted DNN systems. We systematically demonstrate our attacks on real systems against 12 DNN architectures with 4 different datasets and different application domains. Our evaluation shows that DeepHammer is able to successfully tamper DNN inference behavior at run-time within a few minutes. We further discuss several mitigation techniques from both algorithm and system levels to protect DNNs against such attacks. Our work highlights the need to incorporate security mechanisms in future deep learning system to enhance the robustness of DNN against hardware-based deterministic fault injections.
References in corpus (18)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size
- Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
- DoReFa-Net: Training Low Bitwidth Convolutional Neural Networks with Low Bitwidth Gradients
- Deep EHR: A Survey of Recent Advances in Deep Learning Techniques for Electronic Health Record (EHR) Analysis
- Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activations
- Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition
- Binarized Neural Networks
- Achieving Human Parity in Conversational Speech Recognition
- Is feature selection secure against training data poisoning?
- Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
- A Berkeley View of Systems Challenges for AI
- Chiron: Privacy-preserving Machine Learning as a Service
- Simple Black-Box Adversarial Perturbations for Deep Networks
- Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attacks
- CSI Neural Network: Using Side-channels to Recover Your Artificial Neural Network Information
- DeepLaser: Practical Fault Attack on Deep Neural Networks
- Understanding Rowhammer Attacks through the Lens of a Unified Reference Framework