Fault injection attack against deep neural network-parameter exposure in random Bits-flip model

Recent studies have revealed that fault injection attacks can expose internal parameters of deep neural networks (DNNs). However, prior efforts to reverse-engineer DNNs through fault injection have been largely theoretical, as flipping even a single bit, particularly the sign bit, is both challenging to execute and verify. To overcome these limitations, we propose an algorithm capable of recovering the bias and weight parameters of DNN output layers, even in the presence of multiple unknown bit flips, including non-sign bits such as exponent bits, caused by fault injection attacks. Specifically, for output layers employing the Softmax activation function, our approach infers secret parameters by analyzing changes in parameter values before and after fault injection. The algorithm was validated on image classification neural networks implemented in Keras using 64-bit floating point representations, with fault injection attacks performed during output layer computations. Results demonstrate that the algorithm can recover output layer parameters with an error rate as low as 10−15, even when the sign bit and up to the 8th exponent bit near the least significant bit are randomly flipped. Moreover, this methodology extends to output layers with other activation functions and more complex Convolutional neural networks architectures, revealing a critical security vulnerability in DNNs.