DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips

Security of machine learning is increasingly becoming a major concern due to the ubiquitous deployment of deep learning in many security-sensitive domains. Many prior studies have shown external attacks such as adversarial examples that tamper with the integrity of DNNs using maliciously crafted inputs. However, the security implication of internal threats (i.e., hardware vulnerability) to DNN models has not yet been well understood. In this paper, we demonstrate the first hardware-based attack on quantized deep neural networks-DeepHammer-that deterministically induces bit flips in model weights to compromise DNN inference by exploiting the rowhammer vulnerability. DeepHammer performs aggressive bit search in the DNN model to identify the most vulnerable weight bits that are flippable under system constraints. To trigger deterministic bit flips across multiple pages within reasonable amount of time, we develop novel system-level techniques that enable fast deployment of victim pages, memory-efficient rowhammering and precise flipping of targeted bits. DeepHammer can deliberately degrade the inference accuracy of the victim DNN system to a level that is only as good as random guess, thus completely depleting the intelligence of targeted DNN systems. We systematically demonstrate our attacks on real systems against 12 DNN architectures with 4 different datasets and different application domains. Our evaluation shows that DeepHammer is able to successfully tamper DNN inference behavior at run-time within a few minutes. We further discuss several mitigation techniques from both algorithm and system levels to protect DNNs against such attacks. Our work highlights the need to incorporate security mechanisms in future deep learning system to enhance the robustness of DNN against hardware-based deterministic fault injections.

由于深度学习在许多对安全敏感的领域广泛应用，机器学习的安全性日益成为一个主要关注点。许多先前的研究已经表明存在外部攻击，例如对抗样本，它使用恶意构造的输入篡改深度神经网络（DNN）的完整性。然而，内部威胁（即硬件漏洞）对DNN模型的安全影响尚未得到很好的理解。在本文中，我们展示了对量化深度神经网络的首次基于硬件的攻击——DeepHammer，它通过利用行锤（rowhammer）漏洞确定性地诱导模型权重中的比特翻转，从而破坏DNN的推理。DeepHammer在DNN模型中进行积极的比特搜索，以识别在系统约束下可翻转的最脆弱的权重比特。为了在合理的时间内触发多个页面上的确定性比特翻转，我们开发了新的系统级技术，这些技术能够实现受害页面的快速部署、高效内存的行锤攻击以及目标比特的精确翻转。DeepHammer能够故意将受害DNN系统的推理准确性降低到仅与随机猜测相当的水平，从而完全耗尽目标DNN系统的智能。我们系统地展示了针对具有4种不同数据集和不同应用领域的12种DNN架构在真实系统上的攻击。我们的评估表明，DeepHammer能够在几分钟内成功篡改运行时的DNN推理行为。我们进一步从算法和系统两个层面讨论了几种缓解技术，以保护DNN免受此类攻击。我们的工作强调了在未来的深度学习系统中纳入安全机制的必要性，以增强DNN对基于硬件的确定性故障注入的鲁棒性。