Traditional Deep Neural Network (DNN) security is mostly related to the well-known adversarial input example attack. Recently, another dimension of adversarial attack, namely, attack on DNN weight parameters, has been shown to be very powerful. As a representative one, the Bit-Flip-based adversarial weight Attack (BFA) injects an extremely small amount of faults into weight parameters to hijack the executing DNN function. Prior works of BFA focus on un-targeted attack that can hack all inputs into a random output class by flipping a very small number of weight bits stored in computer memory. This paper proposes the first work of targeted BFA based (T-BFA) adversarial weight attack on DNNs, which can intentionally mislead selected inputs to a target output class. The objective is achieved by identifying the weight bits that are highly associated with classification of a targeted output through a class-dependent weight bit ranking algorithm. Our proposed T-BFA performance is successfully demonstrated on multiple DNN architectures for image classification tasks. For example, by merely flipping 27 out of 88 million weight bits of ResNet-18, our T-BFA can misclassify all the images from 'Hen' class into 'Goose' class (i.e., 100 % attack success rate) in ImageNet dataset, while maintaining 59.35 % validation accuracy. Moreover, we successfully demonstrate our T-BFA attack in a real computer prototype system running DNN computation, with Ivy Bridge-based Intel i7 CPU and 8GB DDR3 memory.
Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；PCL Research Center of Networks and Communications, Peng Cheng Laboratory（鹏城实验室PCL网络与通信研究中心）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Secure Computing Lab of Big Data, Shenzhen Research Institute of Big Data（深圳大数据研究院大数据安全计算实验室）；Tencent AI Lab（腾讯AI Lab）
Verification of Bit-Flip Attacks against Quantized Neural Networks
National University of Singapore（新加坡国立大学）；ShanghaiTech University（上海科技大学）；ByteDance Inc（字节跳动公司）；Institute of Software, Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Nanjing Institute of Software Technology（南京软件技术研究院）；Singapore Management University（新加坡管理大学）
Crossfire: An Elastic Defense Framework for Graph Neural Networks Under Bit Flip Attacks
Faculty of Computer Science, University of Vienna（维也纳大学计算机学院）；Doctoral School Computer Science, University of Vienna（维也纳大学计算机博士学院）；Research Network Data Science University of Vienna（维也纳大学数据科学研究网络）
Adversarial Robustness in One-Stage Learning-to-Defer
School of Computing, National University of Singapore（新加坡国立大学计算机学院）；Fédération ENAC ISAE-SUPAERO ONERA, Université de Toulouse, France（法国图卢兹大学ENAC ISAE-SUPAERO ONERA联合体）；Institute for Infocomm Research, A*STAR , Singapore（新加坡星展研究所）；IPAL, IRL 2955, Singapore（新加坡IPAL实验室）
Flipping Minds by Flipping Bits: Decision-Level Cognitive Hijacking of Large Language Models
Information Engineering University（信息工程大学）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所信息安全国家重点实验室）
PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
Oregon State University（俄勒冈州立大学）；University of British Columbia（不列颠哥伦比亚大学）；University of Toronto（多伦多大学）；George Mason University（乔治·梅森大学）；Rutgers University（罗格斯大学）；University of Texas at Arlington（德克萨斯大学阿灵顿分校）
Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors
Karlsruhe Institute of Technology (KIT)（卡尔斯鲁厄理工学院）；Department of Technical Cognitive Systems（技术认知系统系）；FZI Research Center for Information Technology（信息技术研究所以）
Quantification of Uncertainty with Adversarial Models in Medical Image Segmentation
Institute of Artificial Intelligence, Center for Medical Data Science, Medical University of Vienna, Austria（人工智能研究所、医学数据科学中心、维也纳医学大学，奥地利）；Comprehensive Center for AI in Medicine, Medical University of Vienna, Austria（医学人工智能综合中心、维也纳医学大学，奥地利）；ELLIS Unit Linz, LIT AI Lab and Institute for Machine Learning, Johannes Kepler University Linz, Austria（林茨ELLIS单位、LIT人工智能实验室和机器学习研究所、林茨约瑟夫·冯·克拉夫特大学，奥地利）；Institute for Machine Learning, Johannes Kepler University Linz, Austria（机器学习研究所、林茨约瑟夫·冯·克拉夫特大学，奥地利）；Clinical Research Center for Medical AI, Johannes Kepler University Linz, Austria（医学人工智能临床研究中心、林茨约瑟夫·冯·克拉夫特大学，奥地利）
Efficient Preference Poisoning Attack on Offline RLHF
Department of Electrical and Computer Engineering, University of California, Davis, Davis, CA, USA（加州大学戴维斯分校电气与计算机工程系）；Department of Electrical and Computer Engineering, University of Iowa, Iowa City, IA, USA（爱荷华大学电气与计算机工程系）
