Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；PCL Research Center of Networks and Communications, Peng Cheng Laboratory（鹏城实验室PCL网络与通信研究中心）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Secure Computing Lab of Big Data, Shenzhen Research Institute of Big Data（深圳大数据研究院大数据安全计算实验室）；Tencent AI Lab（腾讯AI Lab）
To explore the vulnerability of deep neural networks (DNNs), many attack paradigms have been well studied, such as the poisoning-based backdoor attack in the training stage and the adversarial attack in the inference stage. In this paper, we study a novel attack paradigm, which modifies model parameters in the deployment stage for malicious purposes. Specifically, our goal is to misclassify a specific sample into a target class without any sample modification, while not significantly reduce the prediction accuracy of other samples to ensure the stealthiness. To this end, we formulate this problem as a binary integer programming (BIP), since the parameters are stored as binary bits ($i.e.$, 0 and 1) in the memory. By utilizing the latest technique in integer programming, we equivalently reformulate this BIP problem as a continuous optimization problem, which can be effectively and efficiently solved using the alternating direction method of multipliers (ADMM) method. Consequently, the flipped critical bits can be easily determined through optimization, rather than using a heuristic strategy. Extensive experiments demonstrate the superiority of our method in attacking DNNs.
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院，清华大学）；School of Data Science, Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Shenzhen Research Institute of Big Data（深圳大数据研究院）；Tencent（腾讯）
Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors
Karlsruhe Institute of Technology (KIT)（卡尔斯鲁厄理工学院）；Department of Technical Cognitive Systems（技术认知系统系）；FZI Research Center for Information Technology（信息技术研究所以）
Flipping Minds by Flipping Bits: Decision-Level Cognitive Hijacking of Large Language Models
Information Engineering University（信息工程大学）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所信息安全国家重点实验室）
PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
Oregon State University（俄勒冈州立大学）；University of British Columbia（不列颠哥伦比亚大学）；University of Toronto（多伦多大学）；George Mason University（乔治·梅森大学）；Rutgers University（罗格斯大学）；University of Texas at Arlington（德克萨斯大学阿灵顿分校）
Agnostic Learning under Targeted Poisoning: Optimal Rates and the Role of Randomness
Department of Mathematics, Technion（技术学院数学系）；Departments of Mathematics, Computer Science, and Data and Decision Sciences, Technion and Google Research（技术学院数学系、计算机科学系和数据与决策科学系，以及谷歌研究）
Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent
University of Vienna（维也纳大学）；Doctoral School Computer Science, Faculty of Computer Science, University of Vienna（维也纳大学计算机学院计算机科学博士学院）；Christian Doppler Laboratory for Assurance and Transparency in Software Protection, Faculty of Computer Science, University of Vienna（维也纳大学计算机学院克里斯蒂安·多普勒软件保护保障与透明度实验室）；Research Network Data Science, Faculty of Computer Science, University of Vienna（维也纳大学计算机学院数据科学研究网络）
该研究提出首个专门针对图神经网络的Injectivity Bit Flip Attack，通过攻击量化消息传递神经网络的邻域聚合函数削弱其结构区分能力，仅翻转少量比特就能让高表达力的图同构网络输出随机结果，破坏力优于迁移自CNN的位翻转攻击。
Efficient Preference Poisoning Attack on Offline RLHF
Department of Electrical and Computer Engineering, University of California, Davis, Davis, CA, USA（加州大学戴维斯分校电气与计算机工程系）；Department of Electrical and Computer Engineering, University of Iowa, Iowa City, IA, USA（爱荷华大学电气与计算机工程系）
