ROBBIN：推理阶段基于Rowhammer的后门注入攻击
ROBBIN: Rowhammer-Based Backdoor Injection during Inference
浏览论文内容
中文总结 AI 辅助
本研究提出ROBBIN，一种硬件感知的基于Rowhammer的推理阶段后门注入攻击，通过结合DRAM设备位翻转模式优化后门构建，在三款DDR4芯片上实现近90%攻击成功率且正常输入准确率超83%，性能可靠。
中文摘要 AI 辅助
现有的基于Rowhammer的推理阶段后门攻击仅在算法层面设计位翻转策略，未考虑底层DRAM硬件实际产生的位翻转。算法后门构建与其硬件实现之间的脱节会导致攻击性能不可靠，因为意外位置的附带位翻转会降低触发输入的攻击成功率（ASR）和正常输入的测试准确率（TA）。因此，这类攻击的性能在不同DRAM设备间差异显著，因为每个设备都有一组独特的可利用位翻转位置。本研究提出ROBBIN，一种硬件感知的基于Rowhammer的后门注入攻击，将设备特定漏洞整合到后门构建过程中。ROBBIN首先表征目标DRAM的位翻转模式，利用该信息迭代选择模型权重的DRAM页映射，以最大化ASR同时在Rowhammer攻击下保持TA。ROBBIN将每次锤击诱导的位翻转视为攻击设计的组成部分，而非先构建与硬件无关的后门并将附带翻转视为副作用，从而产生在不同设备间保持鲁棒性的后门。在ResNet-20和VGG-16模型、CIFAR-10数据集及三款商用DDR4芯片上的评估显示，ROBBIN始终实现近90%的ASR，同时保持TA高于83%，证明其在不同DRAM设备间的可靠后门效能。
英文摘要
Existing Rowhammer-based inference-time backdoor attacks design their bit-flip strategies purely at the algorithmic level, without accounting for the bit-flips that the underlying DRAM hardware will actually produce. This disconnection between the algorithmic backdoor construction and its hardware realization leads to unreliable attack performance, as collateral bit-flips at unintended locations degrade both the attack success rate (ASR) on triggered inputs and the test accuracy (TA) for normal inputs. Consequently, the performance of such attacks varies significantly across different DRAM devices, as each device presents a unique set of exploitable bit-flip locations. This work presents ROBBIN, a hardware-aware Rowhammer-based backdoor injection attack that integrates the device-specific vulnerability into the backdoor construction process. ROBBIN first characterizes the bit-flip patterns of a target DRAM and uses this information to iteratively select DRAM \textit{page} mappings for the model weights that would maximize ASR while preserving TA under Rowhammering. By treating every hammering-induced bit-flip as an integral part of the attack design rather than first constructing a hardware-agnostic backdoor and dismissing collateral flips as side effects, ROBBIN produces backdoors that remain robust across devices. Evaluated on ResNet-20 and VGG-16 with CIFAR-10 across three commodity DDR4 chips, ROBBIN consistently achieves close to 90\% ASR while maintaining TA above 83\%, demonstrating reliable backdoor efficacy across diverse DRAM devices.
发表机构
- Northeastern University（东北大学）
机构由 AI 辅助整理，请以论文原文为准。
