DNN-Defender：一种以受害者为中心的 DRAM 内防御机制，用于驯服针对 DNN 的对抗性权重攻击
DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs
AI总结：
本文提出 DNN-Defender，一种面向量化 DNN 的 DRAM 内以受害者为中心的防御，通过交换与优先级保护将定向 RowHammer 权重比特翻转削弱为随机攻击水平，且无准确率损失、训练或硬件开销。
摘要：
随着深度学习被部署在许多安全敏感领域，机器学习安全正变得日益重要。近期研究表明，攻击者可以利用系统级技术，借助 DRAM 的 RowHammer 漏洞，确定性且精确地翻转深度神经网络（DNN）模型权重中的比特，从而影响推理准确率。现有防御机制基于软件，例如权重重构需要高昂的训练开销或造成性能下降。另一方面，通用的基于硬件、以受害者/攻击者为中心的机制会带来昂贵的硬件开销，并保留受害者行与攻击行之间的空间连接。本文提出首个为量化 DNN 量身定制、基于 DRAM 且以受害者为中心的防御机制，名为 DNN-Defender，它利用 DRAM 内交换的潜力，通过优先级保护机制抵御定向比特翻转攻击。结果表明，DNN-Defender 可提供高水平保护，将定向 RowHammer 攻击的性能降低至随机攻击水平。此外，所提防御在 CIFAR-10 和 ImageNet 数据集上没有准确率下降，且无需任何软件训练，也不会产生硬件开销。
英文摘要：
With deep learning deployed in many security-sensitive areas, machine learning security is becoming progressively important. Recent studies demonstrate attackers can exploit system-level techniques exploiting the RowHammer vulnerability of DRAM to deterministically and precisely flip bits in Deep Neural Networks (DNN) model weights to affect inference accuracy. The existing defense mechanisms are software-based, such as weight reconstruction requiring expensive training overhead or performance degradation. On the other hand, generic hardware-based victim-/aggressor-focused mechanisms impose expensive hardware overheads and preserve the spatial connection between victim and aggressor rows. In this paper, we present the first DRAM-based victim-focused defense mechanism tailored for quantized DNNs, named DNN-Defender that leverages the potential of in-DRAM swapping to withstand the targeted bit-flip attacks with a priority protection mechanism. Our results indicate that DNN-Defender can deliver a high level of protection downgrading the performance of targeted RowHammer attacks to a random attack level. In addition, the proposed defense has no accuracy drop on CIFAR-10 and ImageNet datasets without requiring any software training or incurring hardware overhead.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
