Computing systems

This attack involves an attacker increasing the power consumption and/or response time of an AI system, rendering it unusable.

To carry out the attack, the attacker synthesizes special input data known as "sponge examples" using optimization algorithms. These inputs maximize the computational cost required by the model to produce a solution [2]. Research shows that this attack has a pronounced impact on large language models and, to a lesser extent, computer vision models. The attack is transferable across different hardware platforms (CPU, GPU, ASIC) and different model architectures, making it a significant threat to ML-as-a-Service solutions.

This attack targets the random access memory (RAM) of an AI system's computing unit to manipulate the parameters or hyperparameters of the AI model.

The attack exploits a hardware vulnerability in the RAM, where intensive cyclic interference with memory cells causes bit value changes in adjacent cells.

Experiments have demonstrated [3] that several well-known neural network architectures, such as VGG, ResNet, DenseNet, Inception, are susceptible to bit-flip attacks - on average, up to 50% of their parameters are vulnerable to such attacks, where the inversion of the 31st bit in their binary representation leads to performance degradation. These inversions result in a drop in the relative classification accuracy on the ImageNet dataset by more than 10%. Furthermore, in most of the models studied [3], at least one parameter was found where a bit-flip reduced classification accuracy by over 90%.